New ResokerRAT Uses Telegram Bot API to Control Infected Windows Systems

New ResokerRAT Uses Telegram Bot API to Control Infected Windows Systems

A recently discovered malware variant, dubbed ResokerRAT, leverages the popular messaging platform Telegram's bot API to control compromised Windows systems. This sophisticated approach makes it challenging for security tools and network monitoring systems to detect malicious activities.

Key Features of ResokerRAT:

1. Telegram Bot Control:

   • The malware establishes a connection with a Telegram bot, allowing attackers to issue commands remotely.
   • Commands include capturing screenshots, downloading files, weakening User Account Control (UAC), and ensuring persistence across system reboots.

2. Silent Operations:

   • ResokerRAT operates stealthily by running hidden PowerShell scripts for tasks like taking screenshots or downloading additional payloads.
   • It uses URL encoding to obfuscate data transmitted through Telegram API endpoints, making detection more difficult.

3. Persistence Mechanisms:

   • The malware drops its executable path into the Windows Run registry key to ensure it runs automatically after system restarts.
   • It also weakens UAC settings by setting ConsentPromptBehaviorAdmin to 0 without user consent.

4. Command Capabilities:

   • `/s

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.