Resoker: A Telegram Based Remote Access Trojan

Resoker: A Telegram-Based Remote Access Trojan

Overview: Resoker is a sophisticated Remote Access Trojan (RAT) that leverages the Telegram Bot API for command and control. It enables attackers to remotely monitor, manipulate, and control an infected system by executing various commands such as capturing screenshots, downloading files, disabling Task Manager, and more.

Key Features of Resoker

1. Telegram-Based Command & Control (C2)

• Communication: The malware establishes a connection with the Telegram Bot API to receive commands from attackers.
• Commands:
  • /screenshot: Takes a screenshot of the infected system.
  • /download [URL] [name]: Downloads files from a specified URL and saves them locally.
  • /block_taskmgr & /unblock_taskmgr: Disables or re-enables Task Manager to prevent users from terminating the malware process.
  • /startup: Adds itself to startup registry keys for persistence.
  • /uac_min & /uac_max: Modifies User Account Control (UAC) settings to minimize security prompts.

2. Persistence Mechanisms

• Registry Key: Resoker sets a value in the Windows

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.