# IoC for Raspberry Robin/Roshtyak Malware analysis and more technical information at ### Table of Contents * [Samples (SHA-256)](#samples-sha-256) * [Network indicators](#network-indicators) ## Samples (SHA-256) #### Roshtyak ``` 05c771c6ab0fb3b75dcaa748750ec31de621e61a23e42b52431d67b1025a1e56 09600477ff392293e3fbef40b3ecdb489819f6f0c74c3c8ec90efa58a0e8bd6f 0b5860e7a380623920a2426dd72fe5981ec1f21600b381e414eb54b0b2dffcc6 0f2fefe08d185e1a03d065ff45840b5bd3b9c0492b3b8434fc785e96eb981a23 105a6bfbc28c85c95411468c6e45ca66ceddfd16e04049c076160b689d0421a1 1073d38346b39fb3d92f4cd814ea13d32ecf5b16c07c87560802343bd1605dfd 1308405ad1cacc637c888a93028962c0638d3a09f8042e9d51fa269d9af5be75 181303c131c604ca92454680d988782230aa9d424ff7b1aae8eac172adcc63f5 1d0191c5dc6cd12bc3718fbc1c7bff5dc037d79f6e0aa29441a9d2c717a81005 2011a4d44868c7ae5888e002e560bdefaee80fb1ebc475ab27cc087ceaba3421 273f8a8e3f1f7aebebb62cd85ccde99f31c97cfb690bf1d82137dc907d8b46c8 2b58155372b12666d1ffd2b868200c6d4708bce810cda5de1df4d027878bee50 2d09627f1e18e10a84ee46a39393a475f2221646845619d0e91c53e55b6ced78 3258221c3cfe43e436dcdcd861094958fb3b2a0c6e6fbd480340a617bd6c6372 325e69483cabd38079c34b6aac5f7ecb6bd971e2ad050009569fbf5f87e5b4e5 3456982084e2ba7e9bf2640d6635aad3b73daa0e6d4b5d2fadc8231234a8fefb 3e97d7208c0b4d30bd9e2df8128d149bc63678e6bb4de1c856652ff1771e399d 41a872cfc4d45bebd449c1f07df957003ce9e2b70f61723c87a11c9d3ad18a5c 4bdc63acbbdc6f332d710327cae95825e517e5023c8c3d708433d4adbd905565 4ec325580b1b5df51c1ce739795ba0bd791b87eb46b30d01f1720f1a4a4855f4 4f7d0d590e1beed28c106c4dfb0484621fceea018b9f655987b42a623e58b18e 6198efa6bec2d0ecf4eace023570538289e8160866caee151bda35be7736c1b6 6265d6edfbf0dc8e475bb1ad50d211963302e3ee6fb3ffa1554995fc132e7288 634688f7b8f7b1cdc1103fdf1d27a2f0a9d944eca3561949b6638325905d9523 641e899d788a5a12aaa9ce95a3b136ef69746ea41075364c545131b44a671150 64aa54501ee346360ef487938058dc6987a2217928eb3bd097bae24a3b1f33af 667e9bd9ae498dcfb9948f7a77c188fb26df9eb2fcc51bbe41ab7c2a3ddff230 6966cf4fdf8d2903e6592dbe33d9c384ecab2a04c52f7ceb4443fdd76d4243ea 6f179213ad18db6dc9e85159af8224f1aafde8db534cb7d1e6400eeafc4650f8 70dbb7409aa5bf237f0463da8a26e2c0ea12d7f2c35e9bce89a9b2e820ac638d 7752fc97466c4d70051d078cfe0741655a0671881b04de7880baa6bd23a1aea7 825c881dd6061a1b181bdecd74da45a894e9ab6c5674f019172e4926d1e19b6e 8b9ea540f76c84460a5457b060489341b3374e0b17c24895b3df68e73bc12011 8c6eb7b3590a221d6e5dde90c1b3c1a46cc37ab5e0becf0c2fb96358856760d3 8d35efd658a4c648f1f0bda743b235ea298ba427aa9c24fe7d37b34f65029636 8ff280e6e5ce3d38fb92c687cfe7ad39538b041632ed018815eb126b24e5d491 9239c45b08079866ad61b0f35709bf0502af35e0661439b886bf085b0242bdee 92491497b83a8ad213c15c3f43fc34358a6d7e5ccf3cfbc7e93bb3f436a96456 9254db5b18f53f25d68ab5a1e973a46590965403cb3b38ce0a0c171653e810b7 99c0c2111241b8ab416a7405a0453b77b3e5749bfd1fb182848b903d1adae15f 9c362e16e56723885d4c3ad88ce36d57713f24d01f23d52b0c465d5d4767dd8f a14f14c7b468c40f865db7512d632b7268ba958786ad2b6e3c8cae85eaec9fae a19a4037df70ff896bbbf923b250098d78933af9ad77d1017d4f5b85e5a8b8fb a1b2435d7cc11d738419b0d1b9a2c7d6b8c071f17ac08f6dce5eb85771dc624c a43a2e2351b2087f48c52d33b18e6278bd50d8e64c18462335988300c27febb9 a5b7f672907cc9716d3ccc20f2c783fef110dd1a92f0c03acf1e6b7cab121e76 b09ed3931a6fbfa3a2bf701c92302e80f716f0c29384046b34b78429a5274c7d b0b16fcec7631b087f7cd5965676a3ff39b9e29b3696454cbec489623da922de b13823805b534d14f88fa2c017c469517e81d6aa19994ba432f683b1dc304d58 b4cb7640d4ecacaf554744229f5dd5d07fba70b72cc19d268b3fb70a7e4914a4 b59cbd494a290e3c98db577558c97071d2667ad414e77495e56132c4c5b81313 bad38e743708ea746930e8f4b6663a162add4503821d998a6049961e82c48250 bd6ddcecebe506a720c12191c0b06fc928cb04252b18c7ec27b0cd163cd5866f c158550e9871f0337417ab19111f233fb4fa653f63ac184922d3eb6e3eb720f9 c45cb46b5b052459a4e8d93377f22c482eafe2930a18571c92b4970d7f31da23 c64878de9c1f1114988726b990e51e76a63d09773b67ac000918c7befd9fba9b cc945f11956cb1c4a5c0cc80e4f49409976138816326bb13a2e65bf9e38c0d7c cdb1485fc915ccc5359389f27780c8dce6e44e9c2623cf7ecf362d1ea13dd01d d0e4b91971520c3aa4b92af5203627666cd83261f41dfb02f29371069d25de52 d41af31a3d833b8470bd2fac52c258ada62819cdf212bee1ae4168e100c9438d d4bfc8c52f58dabc6c25d28142af9386f4b70f79dcc42518e00b114696ca57fb e8ebd9b7bcf8bb42b910c9fd5b94f9ffa98399fe3d6a09c1490dacf2ae680270 edea13bf957e4c450c1028a1071fdbd9efeec94717c172260912eaf022d32621 f0a7fc685747beb21d9339aed02eb9f7ee85996d79d226858fea8c2f83af36cc fc2fdacbbb116992dcd444cbc4c65179a33277ca588f02f9c696129ffe341b9e fd843db504171aab5fbbc2955fda9471f726a4d006c28ad25174f729f4c8b874 ``` ## Network indicators #### Onion C&Cs ``` ip2djbz3xidmkmkw:53148 tq2srsgevhutzw42:43477 krq2qyjhfwh4trww:51499 xph6exfmdo7b4tkw:38607 p2dw3umgw6qhrld3:25947 2q3n7ycm7vxe73g6:30656 kzzuxfvchn5kb73c:21646 42xgf6qae5wjbcva:45252 miwia5zo4oxcj7n6:11472 gk7jrmr5v3nw3u7m:40090 nwogcq7cmhth7e4x:15588 lbwgagk54ww5c3nj:32284 re5sb73yb75nbkrm:33033 5fajnveyn2bd4nm7:5990 sv2fubnuttyzvfgl:39828 xh6pciiw6yeqz3bs:19956 xup6y7cxgjorezif:51516 niddw7jlqyc64xwc:36583 gwtpcz4n3wtkwhj4:64393 w4qjsuu5x5kwvkgu:61921 wkhipwh6fb5j5hzx:25280 rs24qxgkhecjcgdn:51533 6lmt3ott62q5pwae:52403 dvivtswsxdxsqqxa:26960 i3uhj2pyh4cwwbmy:54343 7udhxrfpz6qwvspy:31399 3wquaem4x5qylhs5:17953 rim3qyk3tdbt2iw3:60747 nczflpbaow2ta7ua:19155 qwhbbp6ye2l25wv6:13927 vcammjx7ddus5kfr:64148 obowq55leh2wguwg:35882 pvy2atf27dq2d334:2720 ga3zm6uelxuniyq4:60117 ml7sphy7w3k2ge6d:12508 ``` #### Raspberry Robin C&Cs ``` 0dz[.]me 0e[.]si 0i[.]pm 0t[.]yt 0v[.]wf 0w[.]pm 0x9[.]biz 13j[.]me 1h3[.]me 1i[.]pm 1j[.]pm 1j4[.]xyz 1k4[.]xyz 1n4[.]xyz 1u[.]pm 21k[.]website 2i[.]nu 2i[.]pm 2j4[.]xyz 2um[.]xyz 2yd[.]eu 3e[.]pm 3h[.]wf 3h1[.]xyz 4c[.]pm 4j[.]pm 4j1[.]xyz 4j5[.]xyz 4k1[.]xyz 4kx[.]xyz 4m[.]wf 4q[.]pm 4s[.]pm 4s3[.]me 4w[.]rs 4w[.]wf 5j8[.]xyz 5jb[.]me 5jk[.]club 5kj[.]xyz 5kx[.]me 5qe8[.]com 5qw[.]pw 5s[.]pm 5z[.]wf 66j[.]me 6id[.]xyz 6j2[.]xyz 6qo[.]at 6t[.]nz 6t[.]re 6w[.]re 6wr9[.]com 6xj[.]xyz 6y[.]re 7d[.]rs 7yfb[.]com 8t[.]pm 8t[.]wf 9r[.]re 9r[.]sk aij[.]hk as3[.]biz b3vv[.]com b8x[.]org b9[.]pm bpyo[.]in c0[.]wf c4z[.]pl c7[.]lc d4j[.]club dj2[.]biz doem[.]re dsi[.]mk e9[.]wf egso[.]net ej3[.]xyz ejk[.]bz ejk[.]li euya[.]cn f0[.]tel fnx[.]wf fxb[.]tw fz[.]ms g3[.]rs g4[.]tel g4[.]wf getmyfile[.]eu glnj[.]nl gloa[.]in gz3[.]nl h0[.]wf i0up[.]com i49[.]xyz i4x[.]xyz i6n[.]xyz iz[.]gy j1n[.]me j2[.]gy j3n[.]xyz j4r[.]xyz j4z[.]co j4z[.]xyz j5m[.]biz j5n[.]xyz j68[.]info j8[.]si jjl[.]one jrtz[.]re jrx[.]fr jrx[.]tw jzm[.]pw k0[.]pm k1n[.]club k5j[.]one k5m[.]co k5x[.]xyz k6c[.]org k6j[.]me k6j[.]pw kglo[.]link kj1[.]xyz kjaj[.]top kr4[.]xyz krrz[.]pm l5k[.]xyz l6nk[.]com l9b[.]org lgf[.]pw lwip[.]re lwxa[.]eu m0[.]wf m0[.]yt m5n[.]biz mirw[.]wf mn1[.]biz mnem[.]wf msix[.]pm mwgq[.]net mz3[.]biz mzjc[.]is n3[.]wf n5[.]ms n51[.]biz n54[.]me n5k[.]me nk0[.]club nt3[.]xyz nwz[.]li nz4[.]xyz nzm[.]one oj8[.]eu omzk[.]org p3[.]ms p9[.]tel pjz[.]one q0[.]pm q2[.]rs qji6[.]com qmpo[.]art r0[.]pm r0[.]wf r4e[.]pl r6[.]nz ri7[.]biz rx3[.]xyz s0[.]pm s8[.]cx skqv[.]eu t0[.]wf t7[.]nz tiua[.]uk trzx[.]eu tz6[.]org u0[.]pm u8wp[.]com ue2[.]eu uoej[.]net uqw[.]futbol uz3[.]me v0[.]cx vn6[.]co vs[.]gy w4[.]nz w4[.]rs w4[.]wf w6[.]nz wak[.]rocks xjam[.]hk xz4[.]biz y0[.]wf y3x[.]biz ynns[.]uk yuiw[.]xyz z7s[.]org zbs[.]is zie5[.]com zjc[.]bz zk[.]qa zk4[.]me zk5[.]co zxn[.]fyi ```