Raindrop is a loader used by APT29 that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was discovered in January 2021 and was likely used since at least May 2020.[1][2]

ID: S0565
Platforms: Windows
Version: 1.3
Created: 19 January 2021
Last Modified: 11 April 2024

Techniques Used

Domain ID Name Use
Enterprise T1140 Deobfuscate/Decode Files or Information

Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.[1][2]

Enterprise T1036 Masquerading

Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.[1][2]

.005 Match Legitimate Name or Location

Raindrop was installed under names that resembled legitimate Windows file and directory names.[1][2]

Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.[1][2]

.003 Obfuscated Files or Information: Steganography

Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.[1]

.013 Obfuscated Files or Information: Encrypted/Encoded File

Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.[1][2]

Enterprise T1497 .003 Virtualization/Sandbox Evasion: Time Based Evasion

After initial installation, Raindrop runs a computation to delay execution.[1]

Groups That Use This Software

ID Name References
G0016 APT29



ID Name Description
C0024 SolarWinds Compromise