Loading malware…
Rozena is a Windows backdoor malware family known for using staged PowerShell execution and fileless techniques to establish remote access on compromised hosts. First observed in 2015 and later seen in updated variants, Rozena commonly masquerades as a Microsoft Word document or other benign software while remaining a Windows executable. Its execution chain has included obfuscated and Base64-encoded PowerShell, in-memory decryption, and shellcode injection into PowerShell.exe using Windows API functions such as VirtualAlloc and CreateThread. Reported shellcode behavior includes opening a reverse shell or Meterpreter-style remote session that enables attacker command execution and file transfer.
Rozena has been delivered through multiple infection vectors. Documented campaigns used phishing lures and weaponized Microsoft Office documents exploiting CVE-2022-30190 (Follina) to invoke MSDT and launch PowerShell-based downloaders. Other observed packaging included MSI installers masquerading as legitimate software and samples dropped by other malware or downloaded from malicious sites. In Follina-based chains, Rozena was retrieved after remote HTML content triggered msdt.exe, followed by additional scripting to download the payload, establish persistence, and present a decoy document to distract the victim.
The malware is notable for defense evasion through abuse of legitimate Windows tooling, obfuscated PowerShell syntax, hidden execution, encoded commands, and fileless staging. Some observed installers also added Microsoft Defender exclusions before launching the payload. Persistence has been observed via Windows Run keys, and Rozena variants have used temporary or staged files that are decrypted in memory and then removed. The malware has been associated with reverse-shell functionality rather than ransomware behavior itself, although it has appeared in broader intrusion chains where other malware families or later-stage payloads were also discussed. Rozena targets Windows systems and is primarily characterized as a backdoor providing attacker-controlled remote access and post-compromise execution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
members of the VirusTotal community have linked it to exploitation of CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability also known as Follina. Threat actors have leveraged Follina to distribute malware, including the Rozena backdoor, AsyncRAT, and Qbot, which has previously delivered ransomware as a later-stage payload. | Threat actors have leveraged Follina to distribute malware, including the Rozena backdoor, AsyncRAT (remote access trojan), and Qbot, which has previously delivered ransomware as a later-stage payload.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
After decoding it, the main purpose of this shellcode is to start a reverse shell to the attacker’s host microsofto.duckdns[.]org with TCP port 55911.
The script also uses a pipeline operator (|) to send the command string to Invoke-Expression, that will execute the script on the infected machine. | The old and new Rozena malware still targets Microsoft Windows operating systems, but what made the difference is the new one’s adaption to the fileless technique which uses PowerShell scripts to execute its malicious intent.
The PowerShell code will download one batch file cd.bat... As shown in Figure 5, the cd.bat file has four tasks...
members of the VirusTotal community have linked it to exploitation of CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability also known as Follina.
These techniques can be in the form of exploits and code injections to execute malicious code directly in memory, storing scripts in registry, and executing commands via legitimate tools. | The decoded script will yield the injector script that will injects shellcode to PowerShell.exe.
It has a little obfuscation with a concatenation of separate strings that assemble at run time to hide the actual command and evade simple string detection. We decoded a Base64 string...
The parameters and functions consist of mixed lower and upper cases, and this is one of the obfuscation techniques used by this file for executing PowerShell scripts.
The attacker leverages the default Window’s feature, which is not to show the file extension... Rozena “Word.exe” uses the Microsoft Word file icon while it is an executable file.
These techniques can be in the form of exploits and code injections to execute malicious code directly in memory, storing scripts in registry, and executing commands via legitimate tools. | The decoded script will yield the injector script that will injects shellcode to PowerShell.exe.
Kill processes “msdt.exe” and “WINWORD.exe” to wipe out the trace of exploiting CVE-2022-30190... Delete the bat file.
Two malicious files communicate with it... It and a single housing authority IP address exchanged data 5,904 times between November 2 and December 30.
The series of code above is from the Metasploit framework that creates a reverse TCP connection.
46 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor malware cited as one of the payloads distributed via exploitation of Follina.
Mentioned only as the malware sample during whose analysis the MSI abuse technique was discovered.
Rozena is described as a trojan delivered inside an MSI file masquerading as a Chrome installer. The MSI contains legitimate-looking files plus a password-protected 7z archive and 7zr.exe; extracted contents include a Windows Service Wrapper and the Rozena PE payload. The sample also includes functionality to add the MSI extraction path to Microsoft Defender exclusions for AV evasion.
A backdoor delivered via a weaponized Office document exploiting Follina/MSDT. It is downloaded and saved as "Word.exe," then injects shellcode to launch a reverse shell to the attacker's machine, enabling full control of the compromised Windows system.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.