Malware

Deno-based RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

4 techniques

T1189Drive-by CompromiseEvidence1

The victim was directed to a fake self-service portal designed to resemble a legitimate support workflow. The page prompted the user to download a file and extract it into their AppData directory.

T1566.002Spearphishing LinkEvidence2

The victim was directed to a fake self-service portal that mimicked a legitimate support workflow. The page instructed the user to download a file named patch09913.b.

T1566.003Spearphishing via ServiceEvidence1

Once the victim is disoriented, an attacker calls them over Teams, posing as an IT support agent.

T1566.004Spearphishing VoiceEvidence2

Shortly afterward, the targeted users received Microsoft Teams calls from an attacker impersonating internal IT support.

Execution

3 techniques

T1059.007JavaScriptEvidence3

The payload was not a traditional compiled implant. Instead, it consisted of a modular Deno-based Remote Access Trojan and proxy framework split across four JavaScript files.

T1204User ExecutionEvidence1

The page prompted the user to download a file and extract it into their AppData directory. Once extracted, the primary payload executed without triggering an immediate alert.

T1204.002Malicious FileEvidence2

The user was instructed to extract the ZIP archive into their AppData\Roaming\DenoJSEnv directory. Following the extraction, the primary payload was executed.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

All four JavaScript files were heavily obfuscated using a technique called string array shifting, where readable strings are replaced with scrambled arrays that only reconstruct at runtime.

T1036MasqueradingEvidence1

The initial contact came through Microsoft Teams, where the attacker called employees from an external account that closely mimicked an internal IT support identity.

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

Alerts only surfaced later when the attacker began follow-on activities like LDAP queries and certificate-related reconnaissance.

T1018Remote System DiscoveryEvidence1

Alerts only surfaced later when the attacker began follow-on activities like LDAP queries and certificate-related reconnaissance.

Lateral Movement

1 technique

T1534Internal SpearphishingEvidence1

The attacker called employees from an external account that closely mimicked an internal IT support identity.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The C2 server sat behind a CloudFront domain, helping disguise outbound traffic as contact with a legitimate content delivery network.

T1090ProxyEvidence1

webui.js provides the implant’s proxy capability. It turns the compromised host into a pivot point for internal network access.

T1090.002External ProxyEvidence1

The C2 server sat behind a CloudFront domain, helping disguise outbound traffic as contact with a legitimate content delivery network.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 months ago

domain●●●●●●●●●●●●View more in app4 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jun 17, 2026

Hackers Use Rokarolla Android Malware to Disable Google Play Protect and Control Devices

A modular remote access trojan built on the Deno JavaScript/TypeScript runtime. It is delivered through a mailbombing plus fake Microsoft Teams IT-support impersonation scheme, executes via multiple obfuscated JavaScript modules, connects to a CloudFront-backed C2, runs local commands, and enables internal network pivoting while attempting to evade detection.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Deno-based RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

4 techniques

T1189Drive-by CompromiseEvidence1

The victim was directed to a fake self-service portal designed to resemble a legitimate support workflow. The page prompted the user to download a file and extract it into their AppData directory.

T1566.002Spearphishing LinkEvidence2

The victim was directed to a fake self-service portal that mimicked a legitimate support workflow. The page instructed the user to download a file named patch09913.b.

T1566.003Spearphishing via ServiceEvidence1

Once the victim is disoriented, an attacker calls them over Teams, posing as an IT support agent.

T1566.004Spearphishing VoiceEvidence2

Shortly afterward, the targeted users received Microsoft Teams calls from an attacker impersonating internal IT support.

Execution

3 techniques

T1059.007JavaScriptEvidence3

The payload was not a traditional compiled implant. Instead, it consisted of a modular Deno-based Remote Access Trojan and proxy framework split across four JavaScript files.

T1204User ExecutionEvidence1

The page prompted the user to download a file and extract it into their AppData directory. Once extracted, the primary payload executed without triggering an immediate alert.

T1204.002Malicious FileEvidence2

The user was instructed to extract the ZIP archive into their AppData\Roaming\DenoJSEnv directory. Following the extraction, the primary payload was executed.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

All four JavaScript files were heavily obfuscated using a technique called string array shifting, where readable strings are replaced with scrambled arrays that only reconstruct at runtime.

T1036MasqueradingEvidence1

The initial contact came through Microsoft Teams, where the attacker called employees from an external account that closely mimicked an internal IT support identity.

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

Alerts only surfaced later when the attacker began follow-on activities like LDAP queries and certificate-related reconnaissance.

T1018Remote System DiscoveryEvidence1

Alerts only surfaced later when the attacker began follow-on activities like LDAP queries and certificate-related reconnaissance.

Lateral Movement

1 technique

T1534Internal SpearphishingEvidence1

The attacker called employees from an external account that closely mimicked an internal IT support identity.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The C2 server sat behind a CloudFront domain, helping disguise outbound traffic as contact with a legitimate content delivery network.

T1090ProxyEvidence1

webui.js provides the implant’s proxy capability. It turns the compromised host into a pivot point for internal network access.

T1090.002External ProxyEvidence1

The C2 server sat behind a CloudFront domain, helping disguise outbound traffic as contact with a legitimate content delivery network.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 months ago

domain●●●●●●●●●●●●View more in app4 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jun 17, 2026

Hackers Use Rokarolla Android Malware to Disable Google Play Protect and Control Devices

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.