rokrat | 2026-10-15_0c33490decdba7bdea77b23c1d456b1b_icedid_mespinoza_njrat_rokrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-15_0c33490decdba7bdea77b23c1d456b1b_icedid_mespinoza_njrat_rokrat_ryuk
Size 1.2MB
Sample261016-3gfd4aez2x
SHA256 9cfb49faa1fe56fcc59dcfc5b5d47357d333588f2fc4f11577083b9444ff3793
MD5 0c33490decdba7bdea77b23c1d456b1b
SHA1 9b80ce893d243687798ffde771bb1acb4e725cb7
SHA512 bfbe9a1955e6e3e74fe0f27c503f4e479ea56f451a18ac6acb156161c7e72bc6ea15730bf745e5220a352e8730e6c30fc97c3c498423279f035877645387471e
SSDEEP 24576:G105UPzEXp6040KE1wYBfY6PTsXan5rN3uSZGIcHMLahDV0vncDz50MUGTgcw:G2UPzYp6N0KE1wYBH5vZGIcHMLahDV0t
TLSH
T1F6555B1C695481E4C1B6D0B8CB56A5DBF761BC654721FACB0290B22F2E73AE04EFF560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat rokrat

Malware Config

Signatures

Family: Rokrat
Rokrat is a remote access trojan written in c++.
rat rokrat

Detect Rokrat payload 1 IoCs

resource	yara_rule
sample	family_rokrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_0c33490decdba7bdea77b23c1d456b1b_icedid_mespinoza_njrat_rokrat_ryuk

File Explorer

2026-10-15_0c33490decdba7bdea77b23c1d456b1b_icedid_mespinoza_njrat_rokrat_ryuk

.exe 1.2MB

2026-10-15_0c33490decdba7bdea77b23c1d456b1b_icedid_mespinoza_njrat_rokrat_ryuk

IMPHASH 2201beed89cee2f2a593b401f1590622
SHA256 9cfb49faa1fe56fcc59dcfc5b5d47357d333588f2fc4f11577083b9444ff3793
MD5 0c33490decdba7bdea77b23c1d456b1b
SHA1 9b80ce893d243687798ffde771bb1acb4e725cb7
SHA512 bfbe9a1955e6e3e74fe0f27c503f4e479ea56f451a18ac6acb156161c7e72bc6ea15730bf745e5220a352e8730e6c30fc97c3c498423279f035877645387471e
SSDEEP 24576:G105UPzEXp6040KE1wYBfY6PTsXan5rN3uSZGIcHMLahDV0vncDz50MUGTgcw:G2UPzYp6N0KE1wYBH5vZGIcHMLahDV0t
TLSH
T1F6555B1C695481E4C1B6D0B8CB56A5DBF761BC654721FACB0290B22F2E73AE04EFF560
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect Rokrat payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

434828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathW InitializeCriticalSectionEx FindClose WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetLastError Process32NextW FileTimeToSystemTime DeleteFileW CloseHandle RaiseException CreateThread DecodePointer GetWindowsDirectoryW GetProcAddress DeleteCriticalSection GetCurrentProcessId WriteFile WideCharToMultiByte GetTempFileNameW GetTickCount HeapFree VirtualAlloc GetDriveTypeA GetModuleFileNameW K32GetModuleFileNameExW GetEnvironmentVariableW GetModuleHandleA HeapAlloc GetLogicalDriveStringsA ExitProcess GetComputerNameW GetProcessHeap lstrcmpiA K32EnumProcessModules IsDebuggerPresent ResetEvent SetEvent GetCurrentProcess FindNextFileW QueryPerformanceFrequency SetEndOfFile WriteConsoleW FlushFileBuffers SetStdHandle WaitForSingleObjectEx FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA TerminateProcess SetLastError FindFirstFileW ReadFile GetModuleHandleW CreateDirectoryW GetOEMCP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetACP GetStdHandle GetModuleHandleExW LoadLibraryExW FreeLibrary InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader HeapReAlloc GlobalFree HeapSize GetFileSizeEx GetFileAttributesExW InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext OutputDebugStringW LocalFree GetCPInfo GetLocaleInfoW LCMapStringW GetStringTypeW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount EncodePointer LeaveCriticalSection EnterCriticalSection

user32

GetDC wsprintfA wsprintfW GetSystemMetrics SetProcessDPIAware

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

RegQueryValueExA RegOpenKeyExA RegOpenKeyExW GetUserNameW RegQueryValueExW CryptAcquireContextA CryptReleaseContext CryptGenRandom RegCloseKey

shell32

ShellExecuteW ShellExecuteExA ShellExecuteA

oleaut32

VariantClear

wininet

InternetReadFile HttpQueryInfoA InternetOpenUrlA InternetOpenA InternetCloseHandle

gdiplus

GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipSaveImageToFile GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipGetImageEncoders

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

winhttp

WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpReceiveResponse WinHttpCrackUrl WinHttpSetTimeouts WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpWriteData WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption

Name

.text

Size

882KB

Virtual Size

882KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

287KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=10, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=41, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=13, id=241, version=40116,

count=185, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=209, version=65501,

count=4, id=199, version=41118,

count=8, id=259, version=24123,

count=1, id=208, version=65501,

count=2, id=261, version=23013,

count=71, id=261, version=24123,

count=40, id=260, version=24123,

count=25, id=203, version=65501,

count=290, id=1, productName=Unmarked objects,

count=17, id=265, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,