Search/ROKRAT
● Malware

ROKRAT

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021.

View graph Watch Export
Indicators tracked
0
Intelligence Reports40
40 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
43 relationships
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1056.001: Keylogging
source
T1123: Audio Capture
source
T1204.002: Malicious File
source
T1497.001: System Checks
source
T1566.001: Spearphishing Attachment
source
T1115: Clipboard Data
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1055: Process Injection
source
T1010: Application Window Discovery
source
T1112: Modify Registry
source
T1555.003: Credentials from Web Browsers
source
T1083: File and Directory Discovery
source
T1057: Process Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1027: Obfuscated Files or Information
source
T1102.002: Bidirectional Communication
source
T1567.002: Exfiltration to Cloud Storage
source
T1012: Query Registry
source
T1555.004: Windows Credential Manager
source
T1070.004: File Deletion
source
T1071.001: Web Protocols
source
T1059.005: Visual Basic
source
T1622: Debugger Evasion
source
T1105: Ingress Tool Transfer
source
T1480.001: Environmental Keying
source