ROKRAT Malware APT-37

Aamir Muhammad@Aamir

•updated Mar 25, 2026•4•0•81

Threat Hunt: RoKRAT Malware – Injection & Steganography 🛠 High‑Level TTPs Initial Access: Malicious .lnk files within compressed archives. Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption. Defense Evasion: Process injection into trusted Windows binaries & payload concealment via steganography. Command & Control: Abuse of pCloud, Yandex Disk, and Dropbox APIs with embedded tokens to blend with legitimate traffic.