Loading malware…
ROKRAT is a Windows remote access trojan used for cyberespionage by the North Korea-linked APT37 group, also known as ScarCruft and Group123. Its targets include South Korean organizations and individuals involved in North Korean affairs, including human-rights organizations, defectors, journalists, academics, and policy specialists.
ROKRAT supports remote command execution, additional payload retrieval and execution, process termination, and file management. Its collection capabilities include keylogging, screenshots, audio recording, clipboard theft, document collection, and credential theft from web browsers and Windows Vault. It gathers host, user, operating-system, hardware, process, and removable-drive information. Command-and-control traffic and exfiltration can use HTTP or HTTPS and legitimate cloud-service APIs, including pCloud, Yandex, and Dropbox. Collected data is encrypted before transmission.
Delivery commonly involves spear-phishing emails containing malicious Hangul Office or Microsoft Word documents, or links to archives containing malicious Windows shortcuts. These attacks use impersonation and North Korea-related political, human-rights, or conference themes, often displaying legitimate-looking decoy documents. Staged PowerShell and shellcode loaders decrypt and execute ROKRAT in memory. A June 2024 campaign also delivered it through malicious advertisements exploiting CVE-2024-38178 in a legacy Windows browser engine.
ROKRAT uses process injection, obfuscation, debugger detection, and sandbox and virtualization checks to hinder analysis. Some variants use the victim hostname to gate execution and decrypt strings. It can delete infection artifacts to remove traces. A separately deployable destructive module associated with historical ROKRAT operations overwrote the master boot record and rebooted the system.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In June 2024, APT37 (Scarcruft), a North Korea-based threat group, exploited this vulnerability in an in-the-wild attack against specific organizations in South Korea. | The decrypted malware was executed by randomly selecting two executables in system32 and executing the injection in two stages by placing RokRAT in memory. The C2 of RokRAT used here was either Yandex or PCloud.
The email's attachments are two different HWP documents, both leveraging same vulnerability (CVE-2013-0808). This vulnerability targets the EPS (Encapsulated PostScript) format. The purpose of the shellcode is to download a payload from the Internet.
These malicious documents exploited an Internet Explorer 0-day vulnerability in the JScript engine, CVE-2022-41128. The vulnerability resides within “jscript9.dll”, the JavaScript engine of Internet Explorer, and can be exploited to execute arbitrary code when rendering an attacker-controlled website.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The decrypted malware was executed by randomly selecting two executables in system32 and executing the injection in two stages by placing RokRAT in memory. The C2 of RokRAT used here was either Yandex or PCloud.
The purpose of the malicious documents was to install and to execute ROKRAT, a remote administration tool (RAT).
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) ... LNK File Disguised as Certificate Distributing RokRAT Malware ... Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector ... Introducing ROKRAT
30 distinct techniques documented for this family, organized by ATT&CK tactic.
315 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
181 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as using registry-based checks to identify analysis environments.
A remote access trojan/backdoor used in a spear-phishing campaign that executes largely in memory, injects into explorer.exe, fingerprints infected hosts, uses cloud services for command-and-control, captures screens, steals files, and executes shell commands.
RokRAT is delivered via spear-phishing using a cloud-hosted ISO image and a document-like executable. The loader extracts embedded content, restores shellcode in memory, injects the RokRAT payload into explorer.exe, then gathers system details and communicates through cloud services including Dropbox, pCloud, and Yandex. It can take screenshots, collect files, enumerate drives, gather process information, execute commands, and remove selected traces.
RokRAT is the malware family explicitly referenced as the subject of an attack chain analysis. The post indicates it is used in an operation dubbed 'Capsule Vault' and is associated with ATT&CK techniques including phishing attachment abuse (T1566.002) and process injection (T1055).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.