ROKRAT

Malware & Tools · ROKRAT

· MalwareS0240 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021.(Citation: Talos ROKRAT)(Citation: Talos Group123)(Citation: Volexity InkySquid RokRAT August 2021)

Tactic Coverage

discovery (8)stealth (7)collection (5)credential access (3)execution (3)command and control (3)exfiltration (2)privilege escalation (1)defense impairment (1)persistence (1)initial access (1)

Used By (1 groups)

G0067APT37InkySquid, ScarCruft

Techniques (30)

T1005Data from Local System

collection

T1010Application Window Discovery

discovery

T1012Query Registry

discovery

T1027Obfuscated Files or Information

stealth

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1055Process Injection

References

https://attack.mitre.org/software/S0240 https://blog.talosintelligence.com/2017/04/introducing-rokrat.html https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/https://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

T1059.005Visual Basic

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1102.002Bidirectional Communication

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1113Screen Capture

collection

T1115Clipboard Data

collection

T1123Audio Capture

collection

T1140Deobfuscate/Decode Files or Information

stealth

T1204.002Malicious File

execution

T1480.001Environmental Keying

stealth

T1497.001System Checks

stealthdiscovery

T1555.003Credentials from Web Browsers

credential access

T1555.004Windows Credential Manager

credential access

T1566.001Spearphishing Attachment

initial access

T1567.002Exfiltration to Cloud Storage

exfiltration

T1622Debugger Evasion

stealthdiscovery