DarkHydrus__2019__DarkHydrus_delivers_new_Trojan_that_can_use_Google_Drive_for_C2_communications.pdf

Palo Alto Unit 42 details DarkHydrus activity delivering a new RogueRobin.NET trojan via macro-enabled Excel documents that drop a C# payload and persist via a startup LNK; the malware uses DNS tunneling (various query types), sandbox and debugger checks, and optionally an alternate Google Drive-based C2 (obtaining OAuth tokens, uploading/downloading files) while leveraging an AppLocker bypass (regsvr32/.sct). The report includes sample hashes, C2 domains, nameservers, mapping of clustered infrastructure, and defensive guidance (WildFire/verdicts, domain classification, AutoFocus tags).