ResokerRAT Hijacks Telegram API to Command Infected Windows PCs

A newly identified Windows malware dubbed ResokerRAT abuses Telegram’s Bot API as its main command-and-control (C2) channel to remotely monitor and control infected systems without relying on a traditional attacker‑owned server.

By blending in with legitimate encrypted Telegram traffic, it becomes harder for network defenses to distinguish its C2 communication from normal user activity.

When ResokerRAT runs, it first creates a mutex named “Global\ResokerSystemMutex” using the CreateMutexW API to ensure only a single instance of the malware executes on the system.

It then calls IsDebuggerPresent to detect attached debuggers and, if found, triggers custom exception handling to disrupt analysis.

The malware also attempts to restart itself with elevated rights using ShellExecuteEx with the “runas” option; if elevation fails, it logs the error and reports the failure back to the operator over its C2 channel.

ResokerRAT further evades analysis by enumerating running processes via Process32NextW and terminating known monitoring tools such as Taskmgr.exe, Procexp.exe, and ProcessHacker.exe using OpenProcess and TerminateProcess.

In addition, it installs a global keyboard hook with SetWindowsHookExW and the WH_KEYBOARD_LL flag, not to keylog, but to block specific defensive key combinations like ALT+TAB, ALT+F4, CTRL+SHIFT+ESC, CTRL+ALT+DEL, and the Windows key.

This prevents users and analysts from easily switching tasks, closing windows, or invoking Task Manager.

ResokerRAT Hijacks Telegram API

According to the report, ResokerRAT is controlled through simple text‑based commands delivered via Telegram, each mapped to a specific function on the victim host.

Checks the running processes using Process32NextW and checks their names. If specific monitoring or analysis tools are detected, the malware opens the process using OpenProcess and terminates it using TerminateProcess to prevent analysis.

The /screenshot command creates a “Screenshots” folder next to the malware and launches a hidden PowerShell routine that loads System.Windows.Forms and System.Drawing, captures the full screen with CopyFromScreen, and saves the output as PNG files for visual surveillance.

The /block_taskmgr command sets the DisableTaskMgr registry value to 1 to prevent Task Manager from opening, while /unblock_taskmgr resets it to 0 to restore normal behavior and reduce user suspicion.

Persistence is achieved with the /startup command, which writes the malware path under HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a “Resoker” value and sends a “Added to startup” confirmation message back to the attacker.

ResokerRAT also weakens Windows security prompts using /uac-min by modifying several UAC‑related registry keys: it sets ConsentPromptBehaviorAdmin to 0 to suppress elevation prompts, turns PromptOnSecureDesktop to 0 to turn off the protected dimmed desktop, but keeps EnableLUA at 1 so UAC appears enabled and does not force a reboot.

The /uac-max command reverses these changes, restoring default UAC behavior by re‑enabling secure desktop and admin prompts while leaving UAC formally on.

Through the /download command, the RAT can fetch additional payloads from attacker‑supplied URLs into a local “downloads” folder using a hidden PowerShell downloader, then verify and optionally report back on download success.

This gives operators a flexible way to stage second‑stage tools or payloads on already compromised systems.

Telegram‑based C2 and MITRE mapping

For C2, ResokerRAT constructs URLs that embed a hardcoded Telegram bot token and chat ID, then repeatedly polls the Telegram Bot API over HTTPS for new commands and exfiltrates results and logs back over the same channel.

Before transmission, the malware URL‑encodes collected data to ensure reliable delivery across the encrypted application‑layer protocol.

Researchers observed this Telegram traffic in packet captures, confirming active bot‑based command retrieval and response.

Its behavior aligns with several MITRE ATT&CK techniques, including PowerShell execution (T1059.001) for screenshots and downloads, Run‑key persistence (T1547.001), access token or privilege manipulation (T1134), indirect command execution via hidden PowerShell (T1202), impairing defenses by disabling Task Manager (T1562.001), hidden windows (T1564.003), process discovery (T1057), input capture via hooks (T1056.001), and application‑layer C2 over HTTPS to Telegram (T1071, T1573).

Security teams should monitor for unusual Telegram Bot API traffic from endpoints, review startup and UAC‑related registry keys, and deploy reputable, regularly updated endpoint protection to detect and block ResokerRAT’s components and PowerShell activity chains.

IOCs

Hash	File Name	Detection name
7a1d6c969e34ea61b2ea7a714a56d143	Resoker.exe	Trojan ( 0001140e1 )

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.