Procedure examples

ROKRAT can collect host data and specific file types.

ROKRAT can use the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.

ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.

ROKRAT can encrypt data prior to exfiltration by using an RSA public key.

ROKRAT can collect the username from a compromised host.

ROKRAT can send collected files back over same C2 channel.

ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.

ROKRAT can use `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.

ROKRAT can list the current running processes on the system.

ROKRAT has used Visual Basic for execution.

ROKRAT can request to delete files.

ROKRAT can use HTTP and HTTPS for command and control communication.

ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.

ROKRAT has the ability to gather a list of files and directories on the infected system.

ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.

ROKRAT can retrieve additional malicious payloads from its C2 server.

ROKRAT can use a variety of API calls to execute shellcode.

ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.

ROKRAT can capture screenshots of the infected system using the `gdi32` library.

ROKRAT can extract clipboard data from a compromised host.

ROKRAT has an audio capture and eavesdropping module.

ROKRAT can decrypt strings using the victim's hostname as the key.

ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.

ROKRAT relies on a specific victim hostname to execute and decrypt important strings.

ROKRAT can check for VMware-related files and DLLs related to sandboxes.

ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.

ROKRAT can steal credentials by leveraging the Windows Vault mechanism.

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.

ROKRAT can send collected data to cloud storage services such as PCloud.

ROKRAT can check for debugging tools.