RokRATMalware
- dogcall
It is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex.From MISP Galaxy
Last reported 5 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
6 of 37 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1020Automated Exfiltration
“T1020”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1046Network Service Discovery
“T1046”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
ScarCruft compromete plataforma de juegos en ataque de cadena de suministro con fines de espionaje“El cliente Windows de la plataforma fue comprometido mediante una actualización maliciosa que derivó en el backdoor RokRAT, el cual posteriormente desplegó el backdoor BirdCall.”
-
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack“The gaming platform’s Windows client was compromised through a malicious update leading to the RokRAT backdoor, which deployed the more sophisticated BirdCall backdoor.”
Indicators in its reports
named in the reports above- hxxps://www.sqgame[.]netin 2 reports
- www.sqgame[.]netin 2 reports
- hxxps://www.sqgame[.]net/games/gamedownload.aspxin 2 reports
- hxxp://sqgame.com[.]cn/ybht.apkin 2 reports
- sqgame.com[.]cnin 2 reports
- 03e3ece9f48cf410…a2fb3c6b26cfin 2 reports
- hxxp://sqgame.com[.]cn/sqybhs.apkin 2 reports
- fc0c691db7e2d2bd…8df72168b7d9in 2 reports
- hxxp://xiazai.sqgame.com[.]cn/dating/20240429.zipin 2 reports
- xiazai.sqgame.com[.]cnin 2 reports
- a8fe823d451d636d0a0366c0629ef5c3in 2 reports
- zohomail[.]comin 2 reports
Copy these 12 indicators · defanged
Thanks — we review every report.