{
  "name": "Tracking Updates to Raspberry Robin",
  "slug": "tracking-updates-to-raspberry-robin",
  "description": "Raspberry Robin, an advanced malware downloader active since 2021, has undergone significant updates. The malware now employs improved obfuscation methods, including multiple initialization loops and obfuscated stack pointers, making analysis more challenging. It has switched from AES-CTR to ChaCha-20 for network encryption and introduced a new local privilege escalation exploit (CVE-2024-38196). The malware embeds invalid TOR onion domains as C2 servers and includes a dynamic correction algorithm. Additional updates include expiration dates in the binary code and varied memory mapping for inter-module communication. These enhancements demonstrate Raspberry Robin's continued evolution and its developers' efforts to evade detection and hinder reverse-engineering.",
  "published": "2025-08-07T08:38:52+00:00",
  "created_at": "2025-08-07T08:38:52+00:00",
  "modified_at": "2025-08-07T09:39:04+00:00",
  "created_at_opencti": "2025-08-07T08:38:52+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-08-07",
    "CVE-2024-38196",
    "downloader",
    "encryption",
    "evasion",
    "obfuscation",
    "privilege-escalation",
    "raspberry robin",
    "roshtyak",
    "tor",
    "usb-spread"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "http://ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion:17249"
      },
      {
        "id": "",
        "name": "http://ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion:3574"
      },
      {
        "id": "",
        "name": "http://z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion:37022"
      },
      {
        "id": "",
        "name": "http://yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion:20247"
      },
      {
        "id": "",
        "name": "http://ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion:9080"
      },
      {
        "id": "",
        "name": "http://yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion:60939"
      },
      {
        "id": "",
        "name": "http://xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion:20938"
      },
      {
        "id": "",
        "name": "http://xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion:65293"
      },
      {
        "id": "",
        "name": "http://x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion:12656"
      },
      {
        "id": "",
        "name": "http://wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion:3569"
      },
      {
        "id": "",
        "name": "http://wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion:31059"
      },
      {
        "id": "",
        "name": "http://vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion:13066"
      },
      {
        "id": "",
        "name": "http://werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion:18703"
      },
      {
        "id": "",
        "name": "http://uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion:49600"
      },
      {
        "id": "",
        "name": "http://ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion:9211"
      },
      {
        "id": "",
        "name": "http://tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion:29543"
      },
      {
        "id": "",
        "name": "http://sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion:57063"
      },
      {
        "id": "",
        "name": "http://soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion:21586"
      },
      {
        "id": "",
        "name": "http://s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion:14826"
      },
      {
        "id": "",
        "name": "http://r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion:62377"
      },
      {
        "id": "",
        "name": "http://qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion:20325"
      },
      {
        "id": "",
        "name": "http://oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion:1342"
      },
      {
        "id": "",
        "name": "http://okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion:37435"
      },
      {
        "id": "",
        "name": "http://ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion:27842"
      },
      {
        "id": "",
        "name": "http://mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion:24793"
      },
      {
        "id": "",
        "name": "http://knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion:46367"
      },
      {
        "id": "",
        "name": "http://kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion:34469"
      },
      {
        "id": "",
        "name": "http://jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion:56005"
      },
      {
        "id": "",
        "name": "http://j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion:33534"
      },
      {
        "id": "",
        "name": "http://ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion:45505"
      },
      {
        "id": "",
        "name": "http://ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion:55782"
      },
      {
        "id": "",
        "name": "http://iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion:44714"
      },
      {
        "id": "",
        "name": "http://glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion:4647"
      },
      {
        "id": "",
        "name": "http://gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion:54050"
      },
      {
        "id": "",
        "name": "http://g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion:58387"
      },
      {
        "id": "",
        "name": "http://df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion:13201"
      },
      {
        "id": "",
        "name": "http://el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion:6212"
      },
      {
        "id": "",
        "name": "http://daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion:31817"
      },
      {
        "id": "",
        "name": "http://d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion:63185"
      },
      {
        "id": "",
        "name": "http://d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion:52210"
      },
      {
        "id": "",
        "name": "http://d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion:52295"
      },
      {
        "id": "",
        "name": "http://cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion:10192"
      },
      {
        "id": "",
        "name": "http://csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion:13609"
      },
      {
        "id": "",
        "name": "http://c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion:53120"
      },
      {
        "id": "",
        "name": "http://bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion:22316"
      },
      {
        "id": "",
        "name": "http://ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion:4853"
      },
      {
        "id": "",
        "name": "http://aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion:37737"
      },
      {
        "id": "",
        "name": "http://7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion:62326"
      },
      {
        "id": "",
        "name": "http://7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion:432"
      },
      {
        "id": "",
        "name": "http://7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion:37085"
      },
      {
        "id": "",
        "name": "http://5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion:54638"
      },
      {
        "id": "",
        "name": "http://6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion:11703"
      },
      {
        "id": "",
        "name": "http://5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion:33774"
      },
      {
        "id": "",
        "name": "http://4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion:61565"
      },
      {
        "id": "",
        "name": "http://4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion:35870"
      },
      {
        "id": "",
        "name": "http://42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion:30971"
      },
      {
        "id": "",
        "name": "http://3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion:24849"
      },
      {
        "id": "",
        "name": "http://3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion:40763"
      },
      {
        "id": "",
        "name": "http://3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion:48285"
      },
      {
        "id": "",
        "name": "http://2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion:6849"
      },
      {
        "id": "",
        "name": "ztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion"
      },
      {
        "id": "",
        "name": "ztgk5ebmxcq3onksgg3guxpe4abz4cktcfa5lgubcgyde3ojkbvyjnad.onion"
      },
      {
        "id": "",
        "name": "yuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion"
      },
      {
        "id": "",
        "name": "z5qg6hpu7sxjyws2fqxei2peywu2tttq6lxs5ybxesgffqmjpedyeuyd.onion"
      },
      {
        "id": "",
        "name": "ysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion"
      },
      {
        "id": "",
        "name": "yo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion"
      },
      {
        "id": "",
        "name": "xzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion"
      },
      {
        "id": "",
        "name": "xwm5hhm4oalqhe4u67dfsqovxygkxox4bleir4isyqpncskamxa7bead.onion"
      },
      {
        "id": "",
        "name": "x76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion"
      },
      {
        "id": "",
        "name": "wmdlzzdfkxikxrlw42rf75ug62semr3h6soc6tyoom3bb75zi7hjbrid.onion"
      },
      {
        "id": "",
        "name": "wlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion"
      },
      {
        "id": "",
        "name": "werbjkqsmcugdcbdn5yvriyy6q4m2qfk3mg7cf6sujzandkwlsnlucid.onion"
      },
      {
        "id": "",
        "name": "vvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion"
      },
      {
        "id": "",
        "name": "ves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion"
      },
      {
        "id": "",
        "name": "uxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion"
      },
      {
        "id": "",
        "name": "tfjhxbhmr3vrmjrhc543npj4nk64jksodoclyjuqfn5aflmi44f657id.onion"
      },
      {
        "id": "",
        "name": "soraykkm25es2phzeszxpinfhcbqgyn7i4tznb4atvks3gnsynm7avad.onion"
      },
      {
        "id": "",
        "name": "sgk5c76pgs7a3qfhzvmey2ecnunsfdbykgjxvunnbpnn3ixlu7a5eqyd.onion"
      },
      {
        "id": "",
        "name": "s54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion"
      },
      {
        "id": "",
        "name": "qtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion"
      },
      {
        "id": "",
        "name": "r4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion"
      },
      {
        "id": "",
        "name": "oqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion"
      },
      {
        "id": "",
        "name": "ne2vesxuik5dkz4vynmfped6rjfsjehmkajhkcpcjr5m3c3hc5bx5oad.onion"
      },
      {
        "id": "",
        "name": "okindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion"
      },
      {
        "id": "",
        "name": "mh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion"
      },
      {
        "id": "",
        "name": "kykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion"
      },
      {
        "id": "",
        "name": "knvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion"
      },
      {
        "id": "",
        "name": "jsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion"
      },
      {
        "id": "",
        "name": "j3w64lohpdl2fynduq7tey7v5kc5nfieblmi5g2znuadn75lkrgdi3yd.onion"
      },
      {
        "id": "",
        "name": "iz3iltwsdsaiqptqxba52bvwouzwoi56fw7vqbiw3znjo2jmifxmiuqd.onion"
      },
      {
        "id": "",
        "name": "ipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion"
      },
      {
        "id": "",
        "name": "ia5ynzyztblk7vde74szyhy6a7f57dqg6jvysnrm34fv2aivlcornzqd.onion"
      },
      {
        "id": "",
        "name": "gutayapi55tb5dmjhlmlwk3owg4aqy5fbyw7uk4skoagzv3le4ge6kad.onion"
      },
      {
        "id": "",
        "name": "glhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion"
      },
      {
        "id": "",
        "name": "g7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion"
      },
      {
        "id": "",
        "name": "el4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion"
      },
      {
        "id": "",
        "name": "df643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion"
      },
      {
        "id": "",
        "name": "daorqgcuse6jzt7r22si2q4t7rjz622vxd5xhq4v4rzcyukltnqg3pyd.onion"
      },
      {
        "id": "",
        "name": "d7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion"
      },
      {
        "id": "",
        "name": "d4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion"
      },
      {
        "id": "",
        "name": "cunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion"
      },
      {
        "id": "",
        "name": "c5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion"
      },
      {
        "id": "",
        "name": "csn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion"
      },
      {
        "id": "",
        "name": "bpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion"
      },
      {
        "id": "",
        "name": "ag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion"
      },
      {
        "id": "",
        "name": "aqumyf4ecfgbxgcnrels2qd2cq5obbnwr4zr37cqw3tg7v5o6kuhqqyd.onion"
      },
      {
        "id": "",
        "name": "7ray5zki7gjzms3bzbivwtcacyt4raaz6bixzmmgu6ljy5pjfpebowqd.onion"
      },
      {
        "id": "",
        "name": "7jfv34s2axfur4euvzqzzowyqksby7hyt3sizuxvucxoc6ma46qjooqd.onion"
      },
      {
        "id": "",
        "name": "7gb5jc3mr32qqyae2s3o5r4fpima2cqpuogpbcmwk7wyvwmqxpr4wdid.onion"
      },
      {
        "id": "",
        "name": "5oiwshn53yari5pza6ca3rxctq47e4azf6wzsvyidmt3j55d5lf7rvyd.onion"
      },
      {
        "id": "",
        "name": "6g6z6zsz7xc2ywqunbzzc4u2uv7yakc5aiaqbojbajmfioj3dfkzbnqd.onion"
      },
      {
        "id": "",
        "name": "5lqerrumqsknnphthjiwg45uas7xcer65am4vs7z4zheshmx6hxyh2yd.onion"
      },
      {
        "id": "",
        "name": "4x34ze2b5l7fh5b4miyvkg44ohajj2pb7hcewt3jt3wlccfbezejrgyd.onion"
      },
      {
        "id": "",
        "name": "4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion"
      },
      {
        "id": "",
        "name": "42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion"
      },
      {
        "id": "",
        "name": "3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion"
      },
      {
        "id": "",
        "name": "3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion"
      },
      {
        "id": "",
        "name": "3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion"
      },
      {
        "id": "",
        "name": "2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion"
      },
      {
        "id": "",
        "name": "5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6"
      },
      {
        "id": "",
        "name": "05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65"
      }
    ],
    "malware": [
      {
        "id": "legacy:malware:7723d01e45187bac",
        "name": "Raspberry Robin - S1130",
        "slug": "raspberry-robin-s1130"
      },
      {
        "id": "legacy:malware:2cc3e8fc5bcb63ab",
        "name": "Roshtyak",
        "slug": "roshtyak"
      }
    ],
    "intrusion_sets": [
      {
        "id": "0bc4653c-5e15-484f-9310-c15ac8b5add4",
        "name": "Raspberry Robin",
        "slug": "raspberry-robin"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2024-38196"
      }
    ]
  },
  "external_refs": [
    "https://www.zscaler.com/blogs/security-research/tracking-updates-raspberry-robin",
    "https://otx.alienvault.com/pulse/6894823cef05b4415dd5032a"
  ]
}