DOGCALL

Malware Profile Updated 3 months ago

Download STIX

Preview STIX

Dogcall, also known as ROKRAT, is a remote access Trojan (RAT) malware first reported by Talos in April 2017. It has consistently been attributed to the Advanced Persistent Threat (APT37) group, also known as Reaper. The malware uses third-party hosting services for data upload and command acceptance. Dogcall's primary function is to exploit and damage computer systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold your data hostage for ransom. A recent investigation by Volexity discovered Dogcall being delivered alongside another malware called BLUELIGHT. This discovery indicates an active development and maintenance of the backdoor malware, with adaptations made for different platforms such as macOS (CloudMensis) and Android (RambleOn). The APT37 group's modus operandi includes the use of a custom malware family, such as Dogcall. AutoFocus customers can track this threat via various tags including KONNI, NOKKI, Final1stspy, Dogcall, and Reaper. Interesting aspects of the relationship between Dogcall and its users include commented out North Korean-related lure information and Dogcall malware payload. The payload has been identified as part of the Dogcall malware family, which is attributed to the Reaper group, linked to North Korea by several security organizations. When executed, the malware deploys on the victim machine from files like "World Cup predictions.doc". This blog details the relationship found between the NOKKI and Dogcall malware families and introduces Final1stspy, a previously unreported malware family used to deploy Dogcall.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
ROKRAT	3	RokRAT is a sophisticated malware that has been used by the cyber-espionage group ScarCruft, primarily to target South Korean media and research organizations. The malware is typically delivered via phishing emails with ZIP file attachments containing LNK files disguised as Word documents. However,
BLUELIGHT	1	The BLUELIGHT malware, first observed in early 2021, was used as the final payload in a multistage attack. This attack involved a watering-hole assault on a South Korean online newspaper, an Internet Explorer exploit, and another ScarCruft backdoor. The attack process included multiple components li
Final1stspy	1	Final1stspy is a previously unreported malware family that has been discovered and named based on a pdb string found in the malware. This harmful software, designed to exploit and damage computer systems, is closely related to the NOKKI and DOGCALL malware families, used as a deployment mechanism fo
Rambleon	1	RambleOn is a newer version of the ROKRAT malware, specifically designed for Android devices. ROKRAT, also known as DOGCALL, has been a favored tool of cyber attackers and has evolved over time to be compatible with various platforms including macOS (CloudMensis) and Android (RambleOn). This demonst
NOKKI	1	NOKKI is a malicious software (malware) that was first identified in January 2018, with activities traced throughout the year. It originated from an investigation into a new malware family named NOKKI, which showed significant code overlap and other ties to KONNI, a previously identified malware. Th
Cloudmensis	1	CloudMensis, a form of malware specifically designed to exploit macOS systems, was first brought to light by ESET in July 2022. The software infiltrates devices primarily through email attachments, causing significant security breaches once inside. Once installed, CloudMensis works diligently to ide
KONNI	1	Konni is a malware, short for malicious software, that poses a significant threat to computer systems and data. It's designed to infiltrate systems surreptitiously through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside a system, Konni can wreak havoc by stealin
Reaper	1	Reaper, also known as APT37, Inky Squid, RedEyes, or ScarCruft, is a threat actor group attributed to North Korea. It deploys ROKRAT, a malicious tool that has been used in cyber exploitation since the 1970s. This group is also tied to the NOKKI malware family, which originated from research surroun

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Payload

Malware Payl...

Backdoor

Macos

Volexity

Android

Trojan

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Bluelight Malware	Unspecified	1	The Bluelight malware is a harmful software program designed to exploit and damage computer systems. It was identified by Volexity in a recent investigation, where it was found being delivered to a victim alongside another malware, RokRAT. The Bluelight malware infiltrates systems through suspicious

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
APT37	Unspecified	1	APT37, also known as ScarCruft, Reaper, or Group123, is a threat actor suspected to be linked to North Korea. It primarily targets South Korea but has also extended its activities to Japan, Vietnam, and the Middle East, focusing on various industry verticals such as chemicals, electronics, manufactu

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Source Document References

Information about the DOGCALL Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
MITRE	a year ago	NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT
MITRE	a year ago	North Korean BLUELIGHT Special: InkySquid Deploys RokRAT
Checkpoint	a year ago	Chain Reaction: ROKRAT’s Missing Link - Check Point Research
CERT-EU	a year ago	North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains