Technical Analysis

In this section, we describe the most significant changes we observed in Raspberry Robin’s functionality. It is worth noting that most of these changes were implemented shortly after our previous publication.

Obfuscation

Raspberry Robin continues to use the same obfuscation techniques discussed in our prior analysis of the malware. However, we have observed three notable changes, which we discuss below.

Initialization loops

One key update is the addition of extra initialization loops to the functions that have a flattened control flow. Previously, it was possible to brute-force the decryption key of each obfuscated function. To counter this, the developers introduced multiple loops, making brute-force efforts inefficient. This modification adds extra junk and obfuscated code into the function.

Obfuscated stack pointers

Another notable update is Raspberry Robin’s use of obfuscated stack pointers. This technique disrupts the decompilation process of IDA, since IDA assumes that the accessed pointer will be a large value. The output result is a failed function decompilation. To address this issue, analysts must manually fix the function’s stack.

The figure below shows how Raspberry Robin's obfuscated stack pointers interfere with the decompilation process of IDA.

Figure 1: Example of Raspberry Robin’s new obfuscated stack pointers.

Obfuscated conditional statements

The third notable change is the obfuscation of conditional statements. This modification further complicates the analysis of Raspberry Robin's logic during code analysis.

Figure 2: Example of Raspberry Robin’s obfuscation for conditional statements.

Network communication

Although the network encryption process of Raspberry Robin remains nearly the same, ThreatLabz has identified some key changes:

• Raspberry Robin now uses the ChaCha-20 encryption algorithm instead of AES-CTR for encrypting network data. While the 32-byte encryption key is hardcoded in the binary, the counter and nonce values are randomly generated per request.
• Raspberry Robin continues to use a 16-byte RC4 key. However, the 8-byte random seed is now appended to the end of the key, rather than the beginning. Additionally, hardcoded portions of the key vary between samples and campaigns.
• While the CRC-64 algorithm remains the same, its initial values are now randomized per sample/campaign.

The random counter and nonce values for ChaCha-20 are prepended to the encrypted data using the following structure.

struct encryptionInfo
{
 uint32_t nonce_part2;
 uint32_t nonce_part3;
 uint32_t counter;
 uint32_t nonce_part1;
};

Command-and-control (C2) onion domain obfuscation

Raspberry Robin has also updated its method of embedding intentionally corrupted TOR onion domains. Starting in early 2024, Raspberry Robin included a hardcoded algorithm within its TOR module to dynamically correct decrypted C2 domains. The Python code example below shows an example of the domain correction algorithm.

By early 2025, the threat actors modified this part of the code and the algorithm is different per sample/campaign. An example is shown in the figure below.

Figure 3: Raspberry Robin C2 dynamic correction algorithm.