RokRat.dll.bin
Classification: Malicious
RokRat.dll.bin is a trojan (application/x-dosexec). Detected by 47 antivirus engines. Linked to Apt37 activity. 5 sightings, last seen 2026-08-11.
Detection summary
- 47 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: APT37 (G0067)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Cyber Threat Alliance | 2026-08-11 10:10:18 | 2026-08-11 10:10:18 | malicious-activity | |
| APT37 | MalwarePatrol | 2026-03-03 18:12:26 | 2026-03-03 18:12:26 | malicious-activity | G0067 APT37 |
| Generic Malware | Hybrid-Analysis | 2026-02-04 21:45:09 | 2026-02-04 22:45:19 | ||
| Generic.Malware | MalwareBazaar Abuse.ch | 2025-08-06 06:23:04 | 2025-08-06 06:23:04 | malicious-activity |
Tags
apt37 moldy pisces operation daybreak venus 121 g0067 reaper group ricochet chollima apt-c-28 red eyes group 123 inkysquid scarcruft atk4 operation erebusSample information
- Filenames
- RokRat.dll.bin, e27467f7fdfa721e917384542ce10cc6108dfd78df14e23872cf8df916e0b8c6
- File type
- application/x-dosexec
- MD5
a2ee8d2aa9f79551eb5dd8f9610ad557- SHA-1
c53bdf6c05c13186a622ed9fd67f9edf2662bd47- SHA-256
e27467f7fdfa721e917384542ce10cc6108dfd78df14e23872cf8df916e0b8c6- First indexed
- 2025-08-06 07:19:14
- Last updated
- 2026-08-02 11:04:04
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Backdoor.Agent.status |
| AhnLab-V3 | Trojan/Win.Loader.C5777283 |
| Alibaba | TrojanDropper:Win32/RokRat.3dfd5edd |
| Arcabit | Trojan.Generic.D4949D95 |
| Avira | TR/Spy.Agent.nkkyr |
| BitDefender | Trojan.GenericKD.76848533 |
| CAT-QuickHeal | Trojan.Ghanarava.17542065140ad557 |
| CTX | dll.trojan.rokrat |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| ESET-NOD32 | a variant of Win32/TrojanDropper.Agent.TCC |
| Emsisoft | Trojan.GenericKD.76848533 (B) |
| F-Secure | Trojan.TR/Spy.Agent.nkkyr |
| Fortinet | W32/PossibleThreat |
| GData | Trojan.GenericKD.76848533 |
| Detected | |
| Gridinsoft | Susp.U.XOREncoded.sd!yf |
| Ikarus | Trojan.VMProtect |
| Jiangmin | Trojan.AVI.fg |
| K7AntiVirus | Trojan ( 005ca8fa1 ) |
| K7GW | Trojan ( 005ca8fa1 ) |
| Kaspersky | Trojan.Win32.RokRat.n |
| Kingsoft | malware.kb.a.986 |
| Lionic | Trojan.Win32.RokRat.4!c |
| Malwarebytes | Malware.AI.4149657788 |
| MaxSecure | Trojan.Malware.398905478.susgen |
| McAfeeD | ti!E27467F7FDFA |
| MicroWorld-eScan | Trojan.GenericKD.76848533 |
| Microsoft | Trojan:Win32/Casdet!rfn |
| NANO-Antivirus | Virus.Win32.Gen.ccmw |
| Paloalto | generic.ml |
| Rising | Trojan.Agent!1.12F70 (CLASSIC) |
| Sangfor | Dropper.Win32.Rokrat.Vjta |
| Skyhigh | Artemis!Trojan |
| Sophos | Mal/Generic-S |
| Symantec | Trojan Horse |
| Tencent | Malware.Win32.Gencirc.149764fc |
| TrellixENS | Artemis!A2EE8D2AA9F7 |
| TrendMicro | TROJ_FRS.VSNTGF25 |
| TrendMicro-HouseCall | TROJ_FRS.VSNTGF25 |
| VIPRE | Trojan.GenericKD.76848533 |
| Varist | W32/ABApplication.YHVW-8843 |
| Yandex | Trojan.RokRat!d1JeVcXnK9o |
| Zillya | Trojan.Agent.Win32.4296083 |
| alibabacloud | Trojan[dropper]:Win/Casdet.Gen |