RogueRobin

ATP Sandbox Adv. HeuristicsNetskope IPS

Stats

First seen: April 2022
Last seen: September 2026

MITRE ATT&CK techniques

18 techniques across 6 tactics.

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.001PowerShell

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.009Shortcut Modification
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.010Command Obfuscation
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.010Regsvr32
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks

TA0007 Discovery

T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1113Screen Capture

TA0011 Command and Control

T1102Web Service
- T1102.002Bidirectional Communication
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding

Associated groups

G0079DarkHydrus

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.RogueRobin	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-OTHER Win.Trojan.RogueRobin executable file download attempt	IPS-SWG

Related families

QakBot Empire Astaroth Bazar InvisiMole