MalwarebytesPublished
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
By Mark Stockley
Excerpt
Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud, Dropbox, Box, Yandex).
Similar to its previous variants, it uses several anti-analysis techniques to make sure it is not running in an analysis environment. Here are some of the checks:
Checking the DLLs related to iDefense SysAnalyze…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Malwarebytes on blog.malwarebytes.com.
Mentioned in the excerpt
More from Malwarebytes1
- HelloKitty: When Cyberpunk met cy-purr-crimeMalwarebytes · Published 17 Mar 2021
On the same topics
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
- Star Blizzard refines phishing and malware delivery with the RedFlick techniqueMicrosoft · Published 29 Sep
