Telegram-Based ResokerRAT Adds Screenshot Capture and Persistence

ResokerRAT is a Telegram‑controlled Windows Remote Access Trojan that uses the Telegram Bot API for command-and-control and exfiltration, implements anti‑analysis and privilege escalation techniques (mutex, IsDebuggerPresent, ShellExecuteExA "runas"), disables/blocks system defenses (kills monitoring tools, disables Task Manager, manipulates UAC settings), captures screenshots and downloads payloads via hidden PowerShell, and maintains persistence via HKCU Run keys; the report maps behaviors to MITRE ATT&CK and provides at least one IOC (Resoker.exe hash) and detection recommendations.