ResokerRAT Uses Telegram for Remote Control and System Manipulation
Summary
The analysis details ResokerRAT’s Telegram-based command channel and its capabilities, including screenshot capture, file downloads, registry-based persistence, attempted privilege escalation, and anti-analysis measures.
Key points
- ResokerRAT polls the Telegram Bot API for commands and sends data or execution messages through the bot.
- Commands can capture screenshots and download files using hidden PowerShell, or change Task Manager and UAC-related settings.
- The malware adds a Run registry value named “Resoker” for persistence and attempts to relaunch with administrator privileges.
- Anti-analysis behavior includes a mutex, debugger checks, termination of named analysis tools, and blocking selected keyboard shortcuts.
- The article’s detailed description says the keyboard hook blocks shortcuts rather than logging keystrokes; its ATT&CK mapping separately labels this as input capture.
- The article identifies a Resoker.exe sample with MD5 hash 7a1d6c969e34ea61b2ea7a714a56d143.
Article Details
- Attack Vectors
- ResokerRAT uses Telegram Bot API endpoints to receive commands and send data from infected systems.
- The malware uses a Run registry value for persistence and attempts to relaunch with administrator privileges.
- Remote commands can capture screenshots, download files through hidden PowerShell, disable Task Manager, and modify UAC settings.
- The malware terminates selected analysis processes and blocks specified keyboard shortcuts.
- Defensive Notes
- The article recommends using reputable security software such as K7TotalSecurity and keeping it updated.
- Monitor for the described Resoker registry value, suspicious hidden PowerShell activity, termination of analysis tools, and Telegram Bot API traffic associated with the listed bot endpoints.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 7a1d6c969e34ea61b2ea7a714a56d143 | MD5 hash identified in the article as the Resoker.exe malware sample. |
| URL | hxxps[:]//api[.]telegram[.]org/bot8679995457:AAHiI3UDWmJaj4etgI4fAZK_wo4KJfhXLWc/getUpdates | Specific Telegram Bot API endpoint identified as ResokerRAT command-and-control infrastructure for retrieving commands. |
| URL | hxxps[:]//api[.]telegram[.]org/bot8679995457[:]AAHiI3UDWmJaj4etgI4fAZK_wo4KJfhXLWc/sendMessage?chat_id=8558596408&text=??%20RESOKER%20activated%20(hidden%20mode)&parse_mode=HTML | Specific Telegram Bot API endpoint identified in observed C2 traffic for sending ResokerRAT status messages. |
| URL | hxxps[:]//api[.]telegram[.]org/bot8679995457[:]AAHiI3UDWmJaj4etgI4fAZK_wo4KJfhXLWc/sendMessage?chat_id=8558596408&text=??%20Taking%20screenshot[.][.][.]&parse_mode=HTML | Specific Telegram Bot API endpoint identified in observed C2 traffic for sending a screenshot-status message. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware sends collected data back to the attacker through its Telegram C2 channel.T1056.001 · KeyloggingResokerRAT installs a global keyboard hook to monitor and block specified key combinations.T1057 · Process DiscoveryThe malware enumerates running processes and checks for analysis tools such as Taskmgr.exe, Procexp.exe, and ProcessHacker.exe.T1059.001 · PowerShellResokerRAT runs hidden PowerShell commands to capture screenshots and download files.T1071 · Application Layer ProtocolThe malware uses Telegram Bot API requests over HTTPS to receive commands and send data.T1105 · Ingress Tool TransferThe /download command retrieves files from a URL supplied by the attacker and saves them locally.T1113 · Screen CaptureThe /screenshot command captures the infected system's screen and saves it as a PNG.T1547.001 · Registry Run Keys / Startup FolderThe malware adds its executable path to a Windows Run registry value named Resoker for persistence.T1562.001 · Disable or Modify ToolsThe malware sets DisableTaskMgr to 1 to prevent users from opening Task Manager.T1564.003 · Hidden WindowPowerShell commands for screenshots and downloads are launched with a hidden window.T1573 · Encrypted ChannelThe article describes ResokerRAT's Telegram C2 communication as encrypted HTTPS traffic.
Malware
Products
K7TotalSecuritythe users be security-aware and avail the benefits of installing a reputed security software like K7TotalSecurity and regularly update the product to stay safe and secure.Microsoft Windowskey entry “Resoker” under HKCUSoftwareMicrosoftWindowsCurrentVersionRun (‘adds its executable path to a Windows Run registry value named “Resoker”’).TelegramResokerRAT is a Telegram-controlled Remote Access Trojan that uses the Telegram Bot API as its command-and-control channel to receive commands and exfiltrate data, while implementing persistence, privilege escalation,