Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dark Hydrus delivers new Trojan that can use Google Drive for C2 communications

Summary: Unit 42 collected three macro-enabled .xlsm delivery documents, created between December 2018 and January 2019, that install a new C# variant of the RogueRobin trojan, which uses regsvr32.exe to run a .sct file as an AppLocker bypass and persists via a OneDrive.lnk startup shortcut. The trojan runs sandbox and debugger checks, communicates with its C2 server through DNS tunneling using nslookup.exe across TXT, SOA, MX, CNAME, SRV, A and AAAA query types, and adds use of the Google Drive API as an alternative C2 channel.

Why it matters: RogueRobin hides its command traffic inside ordinary DNS queries and can fall back to Google Drive, so blocking a known C2 domain or watching for unusual HTTP destinations may not surface an infection that is already taking commands.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related