Malwarebytes RokRAT VBA January 2021

ROKRAT can collect host data and specific file types.

ROKRAT can encrypt data prior to exfiltration by using an RSA public key.

ROKRAT can collect the username from a compromised host.

ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.

ROKRAT has used Visual Basic for execution.

ROKRAT can use HTTP and HTTPS for command and control communication.

ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.

ROKRAT can retrieve additional malicious payloads from its C2 server.

ROKRAT can use a variety of API calls to execute shellcode.

ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.

ROKRAT can capture screenshots of the infected system using the `gdi32` library.

ROKRAT can decrypt strings using the victim's hostname as the key.

ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.

ROKRAT can check for VMware-related files and DLLs related to sandboxes.

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.

ROKRAT can send collected data to cloud storage services such as PCloud.

ROKRAT can check for debugging tools.