1. Home
  2. Software
  3. Rover

Rover

Rover is malware suspected of being used for espionage purposes. It was used in 2015 in a targeted email sent to an Indian Ambassador to Afghanistan. [1]

ID: S0090
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 31 May 2017
Last Modified: 17 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1119 Automated Collection

Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.[1]
Enterprise T1020 Automated Exfiltration

Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.[1]
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.[1]
Enterprise T1005 Data from Local System

Rover searches for files on local drives based on a predefined list of file extensions.[1]
Enterprise T1025 Data from Removable Media

Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.[1]
Enterprise T1074 .001 Data Staged: Local Data Staging

Rover copies files from removable drives to C:\system.[1]
Enterprise T1083 File and Directory Discovery

Rover automatically searches for files on local drives based on a predefined list of file extensions.[1]
Enterprise T1056 .001 Input Capture: Keylogging

Rover has keylogging functionality.[1]
Enterprise T1112 Modify Registry

Rover has functionality to remove Registry Run key persistence as a cleanup procedure.[1]
Enterprise T1113 Screen Capture

Rover takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.[1]

References

  1. Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.