Malware

Resoker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.001PowerShellEvidence1

Despite being native C++ (MSVC 14.44, Visual Studio 2022), the RAT delegates complex operations like screenshots and file downloads to PowerShell... Screenshots : powershell -WindowStyle Hidden ... File downloads : powershell -WindowStyle Hidden -Command "(New-Object Net.WebClient).DownloadFile(...)"

T1106Native APIEvidence1

Execution Flow 1. Execution (resoker.exe) | +-- FreeConsole() -- Hide console window +-- CreateMutexW() -- Global\ResokerSystemMutex (single instance) +-- IsDebuggerPresent() -- Anti-debugging check +-- AdjustTokenPrivileges() -- Acquire SeDebugPrivilege

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

When the /startup command is issued, Resoker copies itself to a location and adds a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run for automatic execution at user login.

Privilege Escalation

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

When the /startup command is issued, Resoker copies itself to a location and adds a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run for automatic execution at user login.

T1548.002Bypass User Account ControlEvidence1

The manifest requests asInvoker execution level, meaning it does not auto-elevate and must use the /elevate command to request administrator privileges via UAC... /uac_min Disable UAC prompts Registry: ConsentPromptBehaviorAdmin=0, PromptOnSecureDesktop=0

Stealth

2 techniques

T1564.003Hidden WindowEvidence1

FreeConsole() -- Hide console window ... RegisterClassW and CreateWindowExW create the hidden message window (class name: ResokerHiddenClass) needed for the keyboard hook's message pump.

T1622Debugger EvasionEvidence1

+-- IsDebuggerPresent() -- Anti-debugging check ... The IsDebuggerPresent check is the most elementary anti-debugging technique available and is bypassed by virtually every analysis environment.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

[Thread 1] Keylogger | +-- SetWindowsHookExW() -- Low-level keyboard hook | +-- GetAsyncKeyState() -- Backup polling | +-- Output: resoker.log -- Timestamped keystroke log

Discovery

2 techniques

T1057Process DiscoveryEvidence1

CreateToolhelp32Snapshot/Process32FirstW/Process32NextW enables the RAT to find and kill analysis tools.

T1622Debugger EvasionEvidence1

+-- IsDebuggerPresent() -- Anti-debugging check ... The IsDebuggerPresent check is the most elementary anti-debugging technique available and is bypassed by virtually every analysis environment.

Collection

2 techniques

T1056.001KeyloggingEvidence1

[Thread 1] Keylogger | +-- SetWindowsHookExW() -- Low-level keyboard hook | +-- GetAsyncKeyState() -- Backup polling | +-- Output: resoker.log -- Timestamped keystroke log

T1113Screen CaptureEvidence1

Command Set Command Function Implementation /screenshot Capture full screen PowerShell: System.Windows.Forms screenshot, sent via /sendPhoto

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

Resoker uses the Telegram Bot API exclusively for command and control... WININET.dll ... InternetOpenA, InternetOpenUrlA, InternetReadFile ... handle all HTTP communication with the Telegram Bot API.

T1102.002Bidirectional CommunicationEvidence1

The Telegram Bot API communication follows a straightforward pattern: ... Polling : HTTP GET to https://api.telegram.org/bot<TOKEN>/getUpdates?offset=<N>&timeout=5 ... Text response : POST to /sendMessage ... File upload : POST to /sendPhoto

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Command Set ... /screenshot Capture full screen ... sent via /sendPhoto ... Text response : POST to /sendMessage with chat_id and parse_mode=HTML File upload : POST to /sendPhoto with multipart form data

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

Command dispatch -- /screenshot, /download, /block_taskmgr, etc. +-- Process killing -- taskmgr.exe, procexp.exe, ProcessHacker.exe ... /block_taskmgr Disable Task Manager Registry: DisableTaskMgr = 1

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 days ago

uri●●●●●●●●●●●●View more in app4 months ago

hash.sha256●●●●●●●●●●●●View more in app5 months ago

uri●●●●●●●●●●●●View more in app5 months ago

hash.md5●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 12, 2026

Resoker RAT: First Report on a Telegram-Controlled Trojan With Every OPSEC Failure in the Book - Breakglass Intelligence - Breakglass Intelligence

A custom Windows RAT written in native C++ that uses the Telegram Bot API for C2. It supports screenshot capture, file download, keylogging, Task Manager suppression, UAC manipulation, process killing, and registry-based persistence.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Resoker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.001PowerShellEvidence1

T1106Native APIEvidence1

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

When the /startup command is issued, Resoker copies itself to a location and adds a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run for automatic execution at user login.

Privilege Escalation

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

When the /startup command is issued, Resoker copies itself to a location and adds a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run for automatic execution at user login.

T1548.002Bypass User Account ControlEvidence1

Stealth

2 techniques

T1564.003Hidden WindowEvidence1

FreeConsole() -- Hide console window ... RegisterClassW and CreateWindowExW create the hidden message window (class name: ResokerHiddenClass) needed for the keyboard hook's message pump.

T1622Debugger EvasionEvidence1

+-- IsDebuggerPresent() -- Anti-debugging check ... The IsDebuggerPresent check is the most elementary anti-debugging technique available and is bypassed by virtually every analysis environment.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

[Thread 1] Keylogger | +-- SetWindowsHookExW() -- Low-level keyboard hook | +-- GetAsyncKeyState() -- Backup polling | +-- Output: resoker.log -- Timestamped keystroke log

Discovery

2 techniques

T1057Process DiscoveryEvidence1

CreateToolhelp32Snapshot/Process32FirstW/Process32NextW enables the RAT to find and kill analysis tools.

T1622Debugger EvasionEvidence1

+-- IsDebuggerPresent() -- Anti-debugging check ... The IsDebuggerPresent check is the most elementary anti-debugging technique available and is bypassed by virtually every analysis environment.

Collection

2 techniques

T1056.001KeyloggingEvidence1

[Thread 1] Keylogger | +-- SetWindowsHookExW() -- Low-level keyboard hook | +-- GetAsyncKeyState() -- Backup polling | +-- Output: resoker.log -- Timestamped keystroke log

T1113Screen CaptureEvidence1

Command Set Command Function Implementation /screenshot Capture full screen PowerShell: System.Windows.Forms screenshot, sent via /sendPhoto

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

Resoker uses the Telegram Bot API exclusively for command and control... WININET.dll ... InternetOpenA, InternetOpenUrlA, InternetReadFile ... handle all HTTP communication with the Telegram Bot API.

T1102.002Bidirectional CommunicationEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 days ago

uri●●●●●●●●●●●●View more in app4 months ago

hash.sha256●●●●●●●●●●●●View more in app5 months ago

uri●●●●●●●●●●●●View more in app5 months ago

hash.md5●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 12, 2026

Resoker RAT: First Report on a Telegram-Controlled Trojan With Every OPSEC Failure in the Book - Breakglass Intelligence - Breakglass Intelligence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.