Attention, everyone! Virus Total recognizes it as a Trojan, but the situation is much more complicated than that:
this file is a virus, I performed an analysis using a memory dump and by analyzing netstat.
Type: RAT, VMProtect 3.x packer.
Injected shellcode, in‑process execution.
SetWindowsHookEx → keylogger.
There are 4 ESTABLISHED connections active from the malware process.
It uses ANTI evasion techniques.
VMProtect 3.x packing → code obfuscation
Process injection → runs inside a legitimate process
WebSocket encryption → TLS 1.3 to hide traffic
Cloud infrastructure → appears legitimate
Custom binary protocol → not recognized by IDS
Registry hooking → persistence after reboot