ROKRAT

ROKRAT can collect host data and specific file types.^[4][3][5]

ROKRAT can modify the HKEY_CURRENT_USER\Software\Microsoft\Office\ registry key so it can bypass the VB object model (VBOM) on a compromised host.^[5]

ROKRAT can extract clipboard data from a compromised host.^[3]

ROKRAT can decrypt strings using the victim's hostname as the key.^[3][5]

ROKRAT can capture screenshots of the infected system using the gdi32 library.^{[1][6][7][4][5]}

ROKRAT can use the GetForegroundWindow and GetWindowText APIs to discover where the user is typing.^[1]

ROKRAT has the ability to gather a list of files and directories on the infected system.^[7][4][3]

ROKRAT can use a variety of API calls to execute shellcode.^[5]

ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.^[2]

ROKRAT can encrypt data prior to exfiltration by using an RSA public key.^[3][5]

ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.^{[1][6][7][4][3][5]}

ROKRAT can collect the username from a compromised host.^[5]

ROKRAT can check for debugging tools.^[2][4][5]

ROKRAT can retrieve additional malicious payloads from its C2 server.^[1][4][3][5]

ROKRAT can list the current running processes on the system.^[1][4]

ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe.^[5]

ROKRAT can send collected files back over same C2 channel.^[1]

ROKRAT has an audio capture and eavesdropping module.^[7]