Rockrat

Overview

Backdoor:Win32/Rockrat is a specific family of Remote Access Trojan (RAT) designed to provide a threat actor with complete, interactive control over a compromised Windows endpoint (`T1059`). Like many modern RATs, Rockrat is often deployed as a secondary payload after an initial breach, allowing attackers to exfiltrate data, monitor user activity, and pivot laterally across the corporate network.

Understanding Rockrat (Remote Access)
To an end-user, the computer functions normally, though it may occasionally feel sluggish. For a SOC analyst, a Rockrat detection is a high-severity alert indicating an active, human-driven intrusion. An attacker sitting at a remote console is using Rockrat to interact with the machine in real-time, completely bypassing standard authentication controls.

Execution and Control Mechanics
Once deployed, Rockrat typically establishes persistence via standard Registry Run keys or hidden scheduled tasks (`T1547.001`). It then initiates a persistent, outbound connection to its Command and Control (C2) server (`T1071.001`). The RAT provides a suite of capabilities to the attacker: opening a hidden command shell (`cmd.exe`), capturing keystrokes (`T1056.001`), taking screenshots, downloading/uploading files, and sometimes activating the webcam or microphone.

Indicators of Compromise & Impact
The impact is total loss of confidentiality and integrity for the compromised host. Host-based IoCs include unknown executables running from `%AppData%` or `%Temp%` making continuous outbound network connections. EDR logs may show Rockrat spawning `cmd.exe` to execute administrative commands (like `net user` or `ping`) or reading sensitive files. Network IoCs are characterized by long-lived TCP sessions with beaconing behavior to suspicious IP addresses or dynamic DNS domains.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ROCKRAT {
    meta:
        description = "Detects Rockrat (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "rockrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Rockrat Activity
id: e13e24929588b57d9aef5ab0303354d3
status: experimental
description: Detects generic indicators of the rockrat malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*rockrat*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately to sever the attacker's interactive connection and prevent data exfiltration.
2. Analyze EDR and command-line logs to determine exactly what actions the attacker performed while the RAT was active (e.g., did they dump LSASS?).
3. Identify the C2 domain/IP address the RAT was communicating with and block it at the perimeter.
4. Assume any credentials typed on the infected machine are compromised and force a password reset.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not leave the machine on the network to 'monitor' the attacker; they can rapidly deploy ransomware if they sense they are being watched.
2. Avoid trusting the integrity of the operating system after a RAT infection; the machine should be completely wiped and re-imaged.

References & External Analysis

• Search "rockrat" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Bisonal
• Cloudguard
• Look2Me
• Slowpcfighter
• Gametool

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/rockrat.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.