New ResokerRAT Malware Uses Telegram for Remote Control, Steals Screenshots

Key Takeaways

• ResokerRAT is a new remote access trojan that leverages the Telegram Bot API for command and control (C2) communications.
• It targets Windows systems, establishing persistence, escalating privileges, and exfiltrating screenshots.
• The malware employs anti-analysis techniques and terminates security tools like Task Manager.
• Detection is challenging due to its use of a legitimate messaging platform for C2, bypassing traditional network security measures.

New ResokerRAT Leverages Telegram for Covert Remote Control and Data Theft

A recently discovered remote access trojan (RAT), dubbed ResokerRAT, is actively exploiting Telegram’s bot API to establish a clandestine communication channel, enabling attackers to remotely monitor and control compromised Windows systems. This novel approach allows the malware to bypass conventional network security defenses by eschewing traditional command-and-control infrastructure in favor of a widely trusted messaging platform.

Instead of relying on a dedicated C2 server, ResokerRAT receives instructions from attackers and transmits stolen data via Telegram, significantly complicating detection efforts for standard network security tools. This innovative C2 method is detailed in a recent analysis by K7 Security Labs.

Initial Infection and Evasion

ResokerRAT is typically deployed as an executable file named “Resoker.exe.” Upon execution, the malware immediately operates in the background, initiating its malicious routines. These include establishing persistence mechanisms, requesting elevated privileges, and preparing to receive and execute remote commands.

Analysts at K7 Security Labs observed that one of the initial actions taken by the malware is the creation of a mutex named “GlobalResokerSystemMutex” via the Windows CreateMutexW API. This mutex serves to prevent multiple instances of ResokerRAT from running concurrently on the same system. Furthermore, the malware incorporates anti-analysis features, utilizing the IsDebuggerPresent function to detect the presence of a debugger. If a debugger is identified, ResokerRAT triggers a custom exception, designed to disrupt ongoing analysis efforts.

To achieve deeper system access, ResokerRAT attempts to relaunch itself with administrator privileges using the ShellExecuteExA function with the “runas” verb. Should this privilege escalation succeed, the original, lower-privileged instance of the malware terminates, and the newly elevated process takes over. If the elevation attempt fails, the malware reports the error back to the attacker via its Telegram bot. Additionally, ResokerRAT actively scans for and terminates common analysis tools, such as Taskmgr.exe, Procexp.exe, and ProcessHacker.exe, using the TerminateProcess function, further hindering forensic examination.

Persistence and Remote Command Execution

A critical feature of ResokerRAT is its ability to embed itself permanently within a compromised system while maintaining Telegram as its primary channel for live control. When an attacker issues the “/startup” command, the malware modifies the Windows registry, adding its executable path to the HKCUSoftwareMicrosoftWindowsCurrentVersionRun key under the name “Resoker.” This ensures that ResokerRAT automatically launches every time the infected machine starts. A confirmation message, “Added to startup,” is then transmitted back to the attacker via Telegram.

The communication between ResokerRAT and its operator is exclusively conducted through the Telegram Bot API. The malware continuously polls Telegram for new instructions by constructing a URL that incorporates a hardcoded bot token and chat ID. To evade network filters and detection, all exfiltrated data is URL-encoded before transmission. This consistent communication pattern has been verified through network capture analysis, revealing the steady flow of encoded traffic to api.telegram.org.

Among the various remote commands available to the attacker, the “/screenshot” command poses a significant privacy risk. When executed, ResokerRAT creates a “Screenshots” folder in its local directory and runs a hidden PowerShell script to capture the entire screen, saving it as a PNG file. This process occurs discreetly, without any visible indication to the user. Attackers can also weaken system defenses using the “/uac-min” command, which sets the ConsentPromptBehaviorAdmin registry value to 0 and disables the secure desktop prompt, all while maintaining the appearance of User Account Control (UAC) being active to avoid suspicion.

What You Should Do

• Monitor the Windows Run registry key (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) for any unauthorized or suspicious entries.
• Implement network monitoring to detect outbound HTTPS traffic to api.telegram.org originating from unknown or suspicious processes.
• Keep operating systems, applications, and security software fully updated with the latest patches.
• Exercise extreme caution when opening executable files (.exe) from untrusted sources, email attachments, or unfamiliar websites.
• Be vigilant for any sudden or unexplained inability to open diagnostic tools like Task Manager, as this could indicate malware activity.
• Consider deploying advanced endpoint detection and response (EDR) solutions capable of identifying and blocking novel C2 techniques.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.