TF-MAL-ps1.roguerobin

Description

ThreatFox malware family `ps1.roguerobin`. Printable name: RogueRobin.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• RogueRobin, Software S0270 | MITRE ATT&CK®
  web:attack.mitre.org

  RogueRobin RogueRobin is a payload used by DarkHydrus that has been developed in PowerShell and C#. [1] [2]

  2026-05-22 05:31 UTC
• Malware RogueRobin - NoHackMe
  web:cve.nohackme.com

  RogueRobin is a payload used by DarkHydrus that has been developed in PowerShell and C#.

  2026-05-22 05:31 UTC
• BPFDoor and Symbiote Rootkits Attacking Linux Systems Exploiting eBPF ...
  web:cybersecuritynews.com

  Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.

  2026-05-22 05:31 UTC
• Malware Analysis - RogueRobin - GitHub Pages
  web:guillaumeorlando.github.io

  At the end, the malware check is a debugger is being used: This last check close the anti-analysis techniques used by the RogueRobin trojan. B) Persistence method In order to stay hidden on a compromise system, RogueRobin copy itself in the AppData folder, under the name ' OneDrive.exe '.

  2026-05-22 05:31 UTC
• RogueRobin (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the RogueRobin malware family including references, samples and yara signatures.

  2026-05-22 05:31 UTC
• RogueRobin DNS Tunneling: A Look at DarkHydrus' Cyber Espionage Tactics
  web:radar.certfa.com

  A malware family known as RogueRobin , used by the DarkHydrus threat group, was discovered using DNS tunneling to covertly communicate with attackers and steal data.

  2026-05-22 05:31 UTC
• eBPF: A new frontier for malware - Red Canary
  web:redcanary.com

  Extended Berkeley Packet Filter (eBPF) is beginning to transform the Linux malware landscape. Here's what defenders should look out for.

  2026-05-22 05:31 UTC
• New eBPF Filters for Symbiote and BPFdoor Malware
  web:www.fortinet.com

  FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.

  2026-05-22 05:31 UTC
• RogueRobin Trojan - Malware removal instructions (updated) - PCrisk
  web:www.pcrisk.com

  What is RogueRobin ? STEP 1. Manual removal of RogueRobin malware . STEP 2. Check if your computer is clean. How to remove malware manually? Manual malware removal is a complicated task - usually it is best to allow antivirus or anti- malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for ...

  2026-05-22 05:31 UTC
• (PDF) eBPF-based Malware - ResearchGate
  web:www.researchgate.net

  Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.