Unmasking APT-37 (ScarCruft) and Rokrat Malware: Key IOCs and Defense Strategies

Unveiling APT37 (ScarCruft) and Rokrat Malware: Understanding the Infrastructure and Strengthening Your Defenses

Advanced Persistent Threat (APT) groups are known for their sophisticated, long term campaigns that target high value organizations, governments, and industries. APT37, also known as ScarCruft, is one such group that has been responsible for several highly targeted cyberattacks. One of the group’s most notorious tools is the Rokrat malware, which has been used to infiltrate networks, exfiltrate sensitive data, and maintain a foothold within compromised systems.

Rokrat malware operates with remarkable stealth, often disguising itself and leveraging tools like PyInstaller to pack its malicious payload. In this post, we’ll take a deep dive into the Rokrat malware infrastructure, map out the tactics used by APT37 to spread it, and share critical Indicators of Compromise (IOCs) that can help you block this threat from your network.

The Rokrat Malware: A Detailed Investigation

Rokrat malware is a sophisticated backdoor trojan associated with APT37 (ScarCruft), a hacking group linked to North Korea. Rokrat is designed to give attackers persistent access to compromised systems and is often used for espionage, data exfiltration, and lateral movement within networks.

An in depth investigation into the Rokrat malware reveals its unique characteristics:

Packed with PyInstaller: Using PyInstaller, a popular tool for packaging Python applications into standalone executables, APT37 has made Rokrat harder to detect. PyInstaller bundles the malware, making it more challenging to identify through conventional file scanning methods.

Malicious Imports: When analyzing the malware with tools like Pestudio, we can see the following suspicious malicious imports used by the malware:

WriteFile: Used for writing data to files, possibly exfiltrating sensitive data.
OpenProcessToken: Allows the malware to obtain access tokens and potentially escalate privileges.
CreateProcessW: This function is used to create new processes, often to execute additional malicious payloads.
GetCurrentProcess: Allows the malware to manipulate and hide its process from detection.

VirusTotal Score: When submitted to VirusTotal, Rokrat’s score shows a significant detection rate of 37 malicious flags, confirming its high risk and potential for harm.

One key observation during the investigation is that the signature of Rokrat malware remains unknown, making it even more dangerous because traditional signature based detection tools might miss it.

However, the use of PyInstaller for packing is a vital clue that can help security professionals detect this threat.

Rokrat Infrastructure Map

When analyzing Rokrat’s infrastructure, we can identify key stages in the attack cycle that help trace its deployment and spread:

1. Initial Infection:
APT37 typically gains initial access via spear phishing emails or exploiting known vulnerabilities in unpatched systems. Once inside the network, they deploy Rokrat to maintain access and establish persistence.

2. Malware Execution and Persistence:
After Rokrat is executed, it connects to command and control (C2) servers to receive instructions and exfiltrate stolen data. The malware can execute further payloads, and its packed nature using PyInstaller makes detection harder.

3. Lateral Movement:
With Rokrat’s remote access capabilities, the threat actors can move laterally across networks, compromising additional systems and escalating their privileges. They can gain administrative rights and install further malware if needed.

4. Data Exfiltration:
Rokrat is used to steal valuable data, which is then exfiltrated back to the attackers via encrypted communication channels. Data related to military, government, and industrial sectors is often the target.

5. Long Term Access:
Rokrat is designed for long term persistence. The attackers can return at any time to perform additional malicious actions, maintain access, or deploy more tools.

By mapping out Rokrat’s infrastructure, organizations can better understand its behavior and adopt effective defensive measures.

Indicators of Compromise (IOCs) to Block

Blocking Rokrat’s IOCs is critical to preventing its infiltration and limiting the damage of an attack. The following table lists the file hashes and other IOCs associated with Rokrat, which can be used to block malicious activity in your network.

By blocking these IOCs at your network perimeter, endpoints, and servers, you can prevent the execution of Rokrat malware and minimize the chances of a successful APT37 attack.

Proactive Security Measures

While blocking IOCs is a crucial step in defending against Rokrat malware, additional proactive measures can further strengthen your security posture:

1. Regular Vulnerability Scanning: Ensure that all systems are updated with the latest patches and configurations to close any potential attack vectors that APT37 may exploit.

2. Endpoint Detection and Response (EDR): Implement advanced EDR solutions to detect suspicious activity, such as the execution of packed executables or unusual process behavior like those associated with PyInstaller.

3. Network Segmentation: Implement network segmentation to reduce lateral movement opportunities for attackers, limiting the spread of malware like Rokrat once inside.

4. User Education and Phishing Awareness: Educate employees on recognizing phishing attacks and other common social engineering tactics used by APT groups.

5. Incident Response Plan: Ensure your organization has an up to date incident response plan, including procedures for handling a Rokrat infection, and practice drills to minimize the damage in case of a breach.

Protecting Against APT37 and Rokrat Malware

APT37’s use of Rokrat malware highlights the increasing sophistication of states sponsored cyberattacks. Understanding the attack infrastructure, blocking key IOCs, and implementing proactive defense measures are essential steps in protecting your organization from these types of advanced persistent threats.

If you’re looking for ways to strengthen your defenses against APT37 and other advanced threats, our team of experts is here to help. Contact us today to learn how we can assist with network security mapping, malware detection, and incident response to protect your organization from evolving cyber threats.