Claim
Removable media
The documented chain begins with prepared removable media.
Detection focus
Join device event, file creation and user context.
Bound to primary researchMalware Analysis / Artefact: Gemeldeter Folgepayload (.NET) · SHA-256 a9d5ec72fad4…
Raspberry Robin: USB LNK, LOLBins and follow-on access
Historical reconstruction of the worm and loader chain: removable media, LNK, cmd/msiexec, compromised NAS systems and the boundary to follow-on payloads.
- Scope
- Microsoft assessment of original USB propagation and later observed links to multiple follow-on payloads and ransomware access.
- Method
- Static source and architecture review; no malware obtained, built or executed.
- Evidence
- Published follow-on artefact identity; no local binary evidence set.
Finding
The multi-stage chain and forensic anchors are documented; historical telemetry counts do not carry into 2026.
No independent sample, runtime, C2 or campaign verification.
Analyst note
What the evidence actually supports.
Raspberry Robin is primarily a chain: removable media, LNK, system binaries and follow-on activity. This hash belongs to a published follow-on payload on previously affected hosts, explicitly not to a locally reviewed Raspberry Robin core sample.
- Artefact
- Gemeldeter Folgepayload (.NET)
- SHA-256
a9d5ec72fad42a197cbadcb1edc6811e3a8dd8c674df473fd8fa952ba0a23c15- Analysis basis
- Published follow-on artefact identity; no local binary evidence set.
Malware / Evidence Atlas
Removable media → Follow-on activity
The analysis path for this report. Every node shows what is supported, where detection can start and where the claim stops.
5flow nodes
2detection artefacts
2rule formats
Claim
LNK launch
A shortcut disguised as a folder starts the next stage.
Detection focus
Review LNK target, arguments and Explorer origin.
Bound to primary researchClaim
System binaries
Documented LOLBins retrieve or start additional components.
Detection focus
Correlate unusual arguments and LOLBin network access.
Bound to primary researchClaim
Persistence / C2
Persistence and connections are treated as separate evidence and then correlated.
Detection focus
Join RunOnce, file-path and connection events.
Bound to primary researchClaim
Follow-on activity
Historically observed follow-on families are not the automatic outcome of every infection.
Detection focus
Hash and attribute every follow-on payload independently.
Bounded or unresolvedConfig Surface
Configuration fingerprint
Review pivots derived from the report — not a live configuration or universal family indicator.
01
Entryremovable media
core
02
ShortcutLNK
core
03
System binariesLOLBin chain
core
04
Follow-on payloadseparate identity
boundary
Detection Pack
Defensive artefacts
Source, validation and limits accompany every rule.
SigmaOpen rule +
Defensive model
title: Raspberry Robin remote MSI candidate
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\\msiexec.exe'
ParentImage|endswith: '\\cmd.exe'
CommandLine|contains:
- 'http'
- '/i'
condition: selection
falsepositives:
- Legitimate administrative or software activity with the same isolated pattern
level: mediumKQLOpen rule +
Defensive model
DeviceProcessEvents
| where Timestamp > ago(30d) and FileName =~ "msiexec.exe" and InitiatingProcessFileName =~ "cmd.exe"
| where ProcessCommandLine has_any ("http://", "https://") and ProcessCommandLine has "/i"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLineScope, snapshot and evidence boundary
Microsoft assessment of original USB propagation and later observed links to multiple follow-on payloads and ransomware access. The bounded question is: which architecture and behaviour claims does this specific evidence set support, and which remain attributable only to the source?
What is supported — and what is missing
Primary sources, statically inspectable code and runtime observations carry different evidentiary weight. The map keeps those layers separate; missing first-party observation is not replaced by plausibility.
Evidence chain and open runtime gap
The map separates primary source, reproducible source snapshots and runtime evidence not collected here.
A file reference does not establish runtime behaviour. Recorded processing is not a new execution.
SourceToolDerivedEvidenceMissingVerified referenceRecordedUnresolved
Evidence
Traceable source with an explicit sample gap.
Primary source
Published analysis or pinned upstream snapshot.
- Primary source → Documented observationsdocumented by source · Recorded
Not independently replayed against a sample here.
Documented observations
Sample, sandbox or telemetry claims made by the source.
- Primary source → Documented observationsdocumented by source · Recorded
Not independently replayed against a sample here.
- Documented observations → No local malware sampleruntime unresolved · Unresolved
The review remains static or source-bound.
No local malware sample
No first-party runtime, C2 or campaign telemetry.
- Documented observations → No local malware sampleruntime unresolved · Unresolved
The review remains static or source-bound.
Limit: A published observation is not an independent reproduction.
Entry and delivery chain
The early chain uses infected USB media with LNK files disguised as folders; some older drives also contained autorun.inf. After user interaction, the shortcut starts cmd.exe and msiexec.exe to retrieve content from compromised QNAP NAS systems. UserAssist can preserve forensic evidence of execution.
Architecture and data flow
Raspberry Robin is both a worm and a distribution platform. Microsoft observed later delivery of FakeUpdates, IcedID, Bumblebee and Truebot, plus transitions to hands-on-keyboard activity. This ecosystem role explains its impact while making the final stage variable.
Analysis resistance and persistence
The chain abuses legitimate Windows components and compromised external infrastructure. LNK, cmd and msiexec are commonplace; deviation comes from removable-media context, unusual parameters, remote MSI destinations and child processes, not the binary name alone.
Capabilities, objective and impact
The major increase in risk occurs when the worm becomes a paid or shared access platform. Observed links to Cobalt Strike and ransomware show possible outcomes but do not establish that every Raspberry Robin infection followed that path.
Telemetry plan and evidence chain
A defensible chain begins with LNK execution from removable media, checks Explorer/UserAssist context, cmd-to-msiexec, remote package paths and subsequent DLL or network activity. Organizations should also remove legacy autorun settings and unnecessary MSI network paths. A defensible investigation preserves process GUID and full ancestry, user and session, command line, signer and hash state, file and registry changes, DNS/connection destinations and follow-on access to sensitive data in one timeline. Temporal proximity is an evidence parameter, not mere visualization. Missing sensor coverage is marked per stage so that an unseen event is not falsely treated as an event that did not occur.
Detection engineering and countertesting
A defensible chain begins with LNK execution from removable media, checks Explorer/UserAssist context, cmd-to-msiexec, remote package paths and subsequent DLL or network activity. Organizations should also remove legacy autorun settings and unnecessary MSI network paths. The following model is deliberately narrow, not engine-validated and must be tested against legitimate administration and software paths.
title: Raspberry Robin remote MSI candidate
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\\msiexec.exe'
ParentImage|endswith: '\\cmd.exe'
CommandLine|contains:
- 'http'
- '/i'
condition: selection
falsepositives:
- Legitimate administrative or software activity with the same isolated pattern
level: mediumRead the code
Line numbers refer to this excerpt. Choose a note to highlight its range.
Alternative hypotheses and negative tests
Before assigning the family, each signal used by the model is tested independently against software deployment, administration tools, installers, browser or backup software and known internal scripts. At least one structural anchor and one temporally consistent behaviour chain must align. Sources and prevalence data are from 2022. Relationships with other families describe observed handoffs, not shared development or unchanged current infrastructure. A negative countercheck rejects only the tested hypothesis; it is not a general all-clear.
Attribution and variant risk
Sources and prevalence data are from 2022. Relationships with other families describe observed handoffs, not shared development or unchanged current infrastructure.
Final assessment
The review provides a defensible architecture and detection baseline for the named snapshot. It is not proof of current activity, complete variant coverage or a specific operator.
Findings at a glance
- Removable media, LNK and LOLBins form a context-dependent propagation chain.
- Variable follow-on payloads turn the worm into an access platform.
- Forensic execution evidence is stronger than individual historical domains.
Review limits
- No independent sample, runtime, C2 or campaign verification.
- Sources and prevalence data are from 2022. Relationships with other families describe observed handoffs, not shared development or unchanged current infrastructure.
- Defensive models were not validated with a target engine.
Context, not evidence
The Evidence Anchor at the start identifies the binary, file or revision actually used. These links provide context and reported observations; they do not substitute for local sample analysis.
Microsoft Threat Intelligence — Raspberry Robin ecosystem ↗Red Canary — Raspberry Robin ↗Conclusion
Conclusion: structure before signature
The greatest defensive value comes from connecting entry, internal architecture, persistence, impact and telemetry. Individual names, hashes or IOCs remain supporting evidence, not the conclusion.
Next steps
- Test models against synthetic positives and legitimate negatives.
- Rebind version and evidence snapshot with every update.
- Extend runtime claims only after first-party, lawfully available telemetry.
Basis of this judgmentHigh for directly inspectable structure; limited for runtime and campaign claims not independently reproduced.
Microsoft assessment of original USB propagation and later observed links to multiple follow-on payloads and ransomware access.
Microsoft assessment of original USB propagation and later observed links to multiple follow-on payloads and ransomware access.