Loading malware…
RokRAT is a Windows espionage backdoor associated primarily with the North Korean threat actor APT37, also known as ScarCruft or RedEyes. It has been used in targeted operations focused heavily on South Korean victims, including individuals and organizations connected to North Korea-related policy, human rights, unification, journalism, civil society, government, military, and education themes.
RokRAT is typically delivered through spearphishing attachments and document-based lures, especially malicious Hangul Office and Microsoft Word files that require user execution. Public reporting also documents delivery through oversized or disguised LNK shortcut files that embed decoy documents and staged script components, as well as campaigns using shellcode loaders and reflective in-memory execution. Some observed chains use Visual Basic or PowerShell-based stages, OLE-embedded scripts, BAT files, and process injection to launch the payload without leaving a conventional on-disk implant.
The malware provides a broad surveillance and collection feature set. Confirmed capabilities include browser credential theft through direct access to browser SQLite stores, credential theft via Windows Vault, keylogging, screenshot capture, audio capture, clipboard theft, process discovery, username and host profiling, file and directory enumeration, collection of local files, retrieval of additional payloads, command execution, and exfiltration of stolen data over its command-and-control channel. RokRAT has also been observed sending collected files back through the same communications path and deleting files on request for cleanup or indicator removal.
RokRAT uses HTTP and HTTPS for command and control and is notable for abusing legitimate web and cloud services for bidirectional communications and exfiltration. Reported services include major cloud storage and web platforms such as Dropbox, Yandex, MediaFire, Twitter, Box, and pCloud. This design helps blend malicious traffic with normal user activity and complicates network-based detection.
The malware incorporates multiple anti-analysis and defense-evasion measures. Documented behaviors include debugger checks, sandbox and VMware-related environment checks, victim-specific execution constraints tied to the hostname, string decryption keyed to the victim hostname, and in-memory shellcode execution. Some variants inject shellcode into benign Windows processes using native APIs. RokRAT has also been observed modifying Office-related settings to weaken protections around Visual Basic automation.
RokRAT is best characterized as a long-running, multifunction espionage implant used in targeted intrusion campaigns rather than commodity malware. Its recurring use of politically themed lures, cloud-based command infrastructure, and surveillance-oriented collection functions makes it a prominent component of APT37 operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
These malicious documents exploited an Internet Explorer 0-day vulnerability in the JScript engine, CVE-2022-41128. The vulnerability resides within “jscript9.dll”, the JavaScript engine of Internet Explorer, and can be exploited to execute arbitrary code when rendering an attacker-controlled website.
The HWP document contained an embedded Encapsulated PostScript (EPS) object... The purpose of the EPS is to exploit a well-known vulnerability (CVE-2013-0808) to download a binary disguised as a .jpg file... The email's attachments are two different HWP documents both leveraging same vulnerability, CVE-2013-0808. | This file is decoded and finally an executable is launched: ROKRAT. This RAT has the added complexity that the command and control servers are legitimate websites. The malware uses Twitter and two cloud platforms, Yandex and Mediafire, apparently for both C2 communications and exfiltration platforms.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ROKRAT Windows malware ROKRAT, is a malware that is long attributed to a threat actor identified as APT37... Upon completion, malicious shellcode containing ROKRAT will be executed in memory.
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
In this article, we describe a cluster of observed activity that deploys ROKRAT... we have observed a shift to delivering ROKRAT with LNK files disguised as legitimate documents.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
$ay4=Get-WmiObject Win32_Process -filter "Name like 'Hwp%'";
Once the user clicks on the OLE object, the BAT script executes which in turn creates a PowerShell-based reflective DLL injection attack on the victim’s machine.
The HWP document attached contains an OLE object (batch file) which runs.
Followed by the further creation of additional classes this time importing Kernel32 in order to access GlobalAlloc and VirtualProtect methods
When Add-Type cmdlet is executed, CSC.exe (Visual C# Command-Line compiler) is invoked on the host by PowerShell, this is a notable TTP to observe on victims (Powershell.exe → CSC.exe → cvtres.exe).
These malware attacks, typically contain documents which have object linking or embedding (OLE). Malicious HWP (Hangul Word Processor) Object Linking and Embedding (OLE) documents refer to a type of cyber threat where attackers embed harmful content or code within HWP files using OLE technology.
ROKRAT can encrypt data prior to exfiltration by using an RSA public key.
ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe.
The script utilising WMI to looks for HWP and kill the process. This is a notable pattern since this is not common. It then performs some cleanup operations on two files, hhbrgof6.tmp & 327.bat.
ROKRAT can decrypt strings using the victim's hostname as the key.
ROKRAT relies on a specific victim hostname to execute and decrypt important strings.
ROKRAT can check for VMware-related files and DLLs related to sandboxes.
$mmy4::ShowWindow(([System.Diagnostics.Process]::GetCurrentProcess() | Get-Process).MainWindowHandle, 0);
ROKRAT can use SetWindowsHookEx and GetKeyNameText to capture keystrokes.
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
ROKRAT can use the GetForegroundWindow and GetWindowText APIs to discover where the user is typing.
ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.
The script utilising WMI to looks for HWP and kill the process. This is a notable pattern since this is not common.
ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.
ROKRAT has the ability to gather a list of files and directories on the infected system.
This RAT has the added complexity that the command and control servers are legitimate websites. The malware uses Twitter and two cloud platforms, Yandex and Mediafire, apparently for both C2 communications and exfiltration platforms. | these 3 platforms all make use of HTTPS connectivity, making it much more difficult to identify specific patterns
285 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
172 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan/backdoor used in a spear-phishing campaign that executes largely in memory, injects into explorer.exe, fingerprints infected hosts, uses cloud services for command-and-control, captures screens, steals files, and executes shell commands.
RokRAT is delivered via spear-phishing using a cloud-hosted ISO image and a document-like executable. The loader extracts embedded content, restores shellcode in memory, injects the RokRAT payload into explorer.exe, then gathers system details and communicates through cloud services including Dropbox, pCloud, and Yandex. It can take screenshots, collect files, enumerate drives, gather process information, execute commands, and remove selected traces.
RokRAT is the malware family explicitly referenced as the subject of an attack chain analysis. The post indicates it is used in an operation dubbed 'Capsule Vault' and is associated with ATT&CK techniques including phishing attachment abuse (T1566.002) and process injection (T1055).
RokRAT is the malware explicitly discussed in the referenced post, described as part of an analyzed attack chain in Operation Capsule Vault.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.