Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Retrohunting Apt37: North Korean Apt Used Vba Self Decode Technique to Inject Rokrat
Threat Actors
Excerpt
https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/ Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat By Mark Stockley Published: 2021-01-05 · Archived: 2026-10-20 02:02:17 UTC Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This sample compilation date is 29 Oct 2019. This RAT is known to…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 3c59ad7c4426e8396369f084c35a2bd3f0caa3ba1d1a91794153507210a77c90 | High | Score 67/100 | First seen |
| URL | http://bit.ly/2Np1enh | High | Score 67/100 | First seen |
| SHA256 | c7ccd2aee0bddaf0e6c8f68edba14064e4a9948981231491a87a277e0047c0cb | High | Score 67/100 | First seen |
| SHA256 | a42844fc9cb7f80ca49726b3589700fa47bdacf787202d0461c753e7c73cfd2a | High | Score 67/100 | First seen |
| SHA256 | 676ae680967410e0f245df0b6163005d8799c84e2f8f87bad6b5e30295554e08 | High | Score 67/100 | First seen |
| SHA256 | 2a253c2aa1db3f809c86f410e4bd21f680b7235d951567f24d614d8e4d041576 | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…