The ROKRAT author implements several techniques typically seen to frustrate human analysts and avoid sandbox execution. First, the malware does not run on Windows XP systems. It uses the GetVersion() API to get the OS version. The code used to perform this task: The malware checks the process names in use on the victim machine. It compares if the executed process name matches a partial name hardcoded in the sample