LNK File Disguising as Certificate Distributes RokRAT Malware

MITRE Techniques

• [T1059.001] PowerShell – The LNK file executes PowerShell commands to create and execute a legitimate document file. Quote: “When the LNK file is executed, it runs PowerShell commands to create and execute a legitimate document file.”
• [T1059.003] Windows Command Shell – The LNK file contains a command to execute PowerShell via CMD. Quote: “The LNK file contains a command to execute PowerShell via CMD.”
• [T1027] Obfuscated/Compressed Files and Information – The data shows “Encoded RokRAT malware” inside viewer.dat. Quote: “Encoded RokRAT malware.”
• [T1055] Process Injection – The script allocates executable memory and creates a thread to run the payload. Quote: “VirtualProtect($buffer, …); … CreateThread(0, 0, $buffer, 0, 0, 0)”
• [T1567.002] Exfiltration to Cloud Storage – Collected information is transmitted to cloud services (pCloud, Yandex, DropBox). Quote: “transmitted to the threat actor’s cloud server using cloud services such as pCloud, Yandex, and DropBox.”
• [T1082] System Information Discovery – The malware collects PC information (system information, IP, router information, etc.). Quote: “Collection of PC information (system information, IP, router information, etc.)”
• [T1083] File and Directory Discovery – The malware collects directory listings and contents of Startup and APPDATA folders. Quote: “Collection of directory listings” and “Startup folder listings, %APPDATA% folder listings, and recently used file listings”
• [T1070.004] Indicator Removal on Host – File Deletion – The malware deletes specific files in the Startup folder. Quote: “Deletion of specific files (with VBS, CMD, BAT, and LNK extensions) within the Startup folder”