Volexity InkySquid RokRAT August 2021

ROKRAT can collect host data and specific file types.

ROKRAT can encrypt data prior to exfiltration by using an RSA public key.

APT37 obfuscates strings and payloads.

APT37 has created scheduled tasks to run malicious scripts on a compromised host.

ROKRAT can use `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.

APT37 has used Ruby scripts to execute payloads.

APT37 has used Python scripts to execute payloads.

ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.

ROKRAT has the ability to gather a list of files and directories on the infected system.

ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.

APT37 has downloaded second stage malware from compromised websites.

ROKRAT can retrieve additional malicious payloads from its C2 server.

ROKRAT can extract clipboard data from a compromised host.

ROKRAT can decrypt strings using the victim's hostname as the key.

ROKRAT relies on a specific victim hostname to execute and decrypt important strings.

ROKRAT can send collected data to cloud storage services such as PCloud.