Description
[ROKRAT](https://attack.mitre.org/software/S0240) is a cloud-based remote access tool (RAT) used by [APT37](https://attack.mitre.org/groups/G0067) to target victims in South Korea. [APT37](https://attack.mitre.org/groups/G0067) has used ROKRAT during several campaigns from 2016 through 2021.(Citation: Talos ROKRAT)(Citation: Talos Group123)(Citation: Volexity InkySquid RokRAT August 2021)
External References
Techniques Used by This Malware
- T1005 — Data from Local System
- T1010 — Application Window Discovery
- T1012 — Query Registry
- T1027 — Obfuscated Files or Information
- T1033 — System Owner/User Discovery
- T1041 — Exfiltration Over C2 Channel
- T1055 — Process Injection
- T1056.001 — Keylogging
- T1057 — Process Discovery
- T1059.005 — Visual Basic
- T1070.004 — File Deletion
- T1071.001 — Web Protocols
- T1082 — System Information Discovery
- T1083 — File and Directory Discovery
- T1102.002 — Bidirectional Communication
- T1105 — Ingress Tool Transfer
- T1106 — Native API
- T1112 — Modify Registry
- T1113 — Screen Capture
- T1115 — Clipboard Data
- T1123 — Audio Capture
- T1140 — Deobfuscate/Decode Files or Information
- T1204.002 — Malicious File
- T1480.001 — Environmental Keying
- T1497.001 — System Checks
- T1555.003 — Credentials from Web Browsers
- T1555.004 — Windows Credential Manager
- T1566.001 — Spearphishing Attachment
- T1567.002 — Exfiltration to Cloud Storage
- T1622 — Debugger Evasion