Talos Group123

ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.

APT37 obfuscates strings and payloads.

APT37 uses steganography to send images to users that are embedded with shellcode.

APT37 identifies the victim username.

APT37 injects its malware variant, ROKRAT, into the cmd.exe process.

APT37's Freenki malware lists running processes using the Microsoft Windows API.

APT37 has used the command-line interface.

APT37 executes shellcode and a VBA script to decode Base64 strings.

APT37 uses HTTPS to conceal C2 communications.

APT37 collects the computer name, the BIOS model, and execution path.

APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.

APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.

ROKRAT can check for VMware-related files and DLLs related to sandboxes.

APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.

APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.

ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.

ROKRAT can steal credentials by leveraging the Windows Vault mechanism.

APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).

APT37 delivers malware using spearphishing emails with malicious HWP attachments.

ROKRAT can check for debugging tools.