Raspberry Robin & Detecting miXeD CaSE ObFuSCaTIoN With Splunk
Raspberry Robin aka "QNAP Worm" is a suspected pay-per-install malware botnet linked to threat actor DEV-0856.
Raspberry Robin spreads through infected USB, users click a .lnk file on the USB and from there msiexec.exe grabs a remotely hosted .msi file and quietly installs it, which is the next stage of the Raspberry Robin payload.
One of the interesting things about Raspberry Robin is that it uses a very distinctive, low effort, form of command line obfuscation, mixed case (or "alternating caps").
You can see what that looks like below, from what looks like a Defender detection in the attached screenshot.
I wanted to come up with a way to detect mixed case obfuscation in Splunk, you can see what I came up with below:
index=winlogs EventCode=4688 Creator_Process_Name=*\\cmd.
| rex field=Process_Command_Line max_match=0 "(?<upper>[A-Z])"
| rex field=Process_Command_Line max_match=0 "(?<lower>[a-z])"
| eval count_upper=mvcount(upper), count_lower=mvcount(lower), percent_difference=((count_
| where percent_difference >= 50
| table _time percent_difference Account_Name Creator_Process_Name New_Process_Name Process_Command_Line
To test this I replicated an example of recent Raspberry Robin's msiexec.exe activity. Please note I substituted out a .msi download from the official 7-zip site in place of the malicious payload and that the "gHyte=UghhTu" type padding around the msiexec activity seems to be totally ignored by msiexec, which only seems to be interested in input that matches it's expected input.
Two rexs and three evals isn't ideal, there may be more efficient ways of doing this.
Results in Splunk will look like this, if Raspberry Robin or similar activity is present:
.png)
If I had the time I'd also look into web proxy logs for msiexec activity, apparently the user agent for msiexec will show up as "Windows_Installer", something to look into later.
Happy hunting!
