This blog post comes from the RokRat Technical Analysis report. If you want to download it as a PDF click here

Executive Summary

APT37 has targeted countries such as South Korea, Japan, and other neighboring regions by distributing phishing emails that contain .lnk files disguised as PDFs to mislead users. Several files are dropped in the user directories once a user downloads and executes this .lnk file. These files then execute the payload, RokRAT, through PowerShell commands.

RokRAT, the payload executed by the .lnk files, is a powerful tool in the hands of APT37. It can remotely manage the victim system, gathering crucial information such as the username and computer name. It can also capture screenshots, record audio, and execute remote commands. These capabilities enable a range of malicious activities, including uploading and downloading files, exfiltrating data, and enumerating files and drives.

The attack vector is particularly concerning due to its sophisticated nature and the ability to maintain prolonged access to compromised systems. By leveraging these capabilities, APT37 can conduct extensive espionage and data theft operations. The malware’s multi-functional nature and deceptive phishing tactics underscore the importance of robust cybersecurity measures and user awareness to mitigate such threats.

Scope

Filename	CRS Report.lnk
Filetype	Windows shortcut
Written Language	–
MD5	358122718ba11b3e8bb56340dbe94f51
SHA1	0c61effe0c06d57835ead4a574dde992515b9382
SHA256	b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56
First Seen / Detection Date	2024-04-03
Initial Infection Vector	Phishing e-mail

Filename	payload.exe
Filetype	PE32
Written Language	C/C++
MD5	8dbd63bbb4d4f23b3c6dffd1ccc8cf3a
SHA1	31cc19d525061a28efb9c254b1b75ceb91a5619a
SHA256	096045beb6f853e249984c568fbd45d36512b2b1926053189221dda85fc3a71f
First Seen / Detection Date	2024-04-03
Initial Infection Vector	Payload

MITRE ATTA&CK Threat Matrix

• TA0001 Initial Access
  • T1566 Phishing
• TA0002 Execution
  • T1059 Command and Script Interpreter
• TA0005 Defense Evasion
  • T1027 Obfuscated Files or Information
  • T1622 Debugger Evasion
  • T1140 Deobfuscate/Decode Files or Information
  • T1070 Indicator Removal
    • T1070.004 File Deletion
  • T1497 Virtualization/Sandbox Evasion
    • T1497.001 System Checks
• TA0007 Discovery
  • T1033 System Owner/User Discovery
  • T1057 Process Discovery
  • T1082 System Information Discovery
  • T1083 File and Directory Discovery
  • T1087 Account Discovery
• TA0009 Collection
  • T1113 Screen Capture

Mitigation Strategies

Regularly check the %temp% and %public% directories on your system for any unusual or unauthorized files. These directories are commonly targeted by malware to store and execute malicious files. Implementing strict monitoring and cleanup routines can help identify and remove potential threats before they cause harm.

Be particularly wary of .lnk (shortcut) files disguised to look like PDF documents. Attackers often use such tactics to trick users into executing malicious code. Always verify the file extension and be suspicious of any unexpected .lnk files, especially if they arrive via email or from unknown sources.

Exercise caution when downloading and opening files from the internet, especially if the source is not verified or trustworthy.

Conclusion

This report presents an in-depth technical analysis of the RokRAT malware attributed to APT37. The malware exhibits a range of sophisticated features. RokRAT is particularly notable for its capacity to deeply infiltrate target systems, exfiltrate data, and perform remote command and control operations. Such malware represents a significant threat, especially to organizations with vulnerabilities in their information security.

Our examination has meticulously analyzed RokRAT’s code structure, communication protocols, and behavioral traits, offering crucial insights into its propagation mechanisms. These insights are invaluable for organizations aiming to develop more robust protective measures. The advanced stealth techniques employed by the malware highlight the need for more sensitive and enhanced alert systems.

RokRAT exemplifies the sophistication and persistence typical of Advanced Persistent Threat (APT) operations. Its architecture, which includes a multi-stage deployment with dropper and remote access trojan (RAT) components, enables it to perform initial reconnaissance and maintain undetected access to targeted systems. Its capability to execute arbitrary commands, manage files, and securely communicate with its command-and-control servers allows it to conduct a wide array of malicious activities, ranging from data theft to the delivery of secondary payloads.

This blog post comes from the RokRat Technical Analysis report. If you want to download it as a PDF click here