Attention, everyone! Virus Total recognizes it as a Trojan, but the situation is much more complicated than that:
this file is a virus, I performed an analysis using a memory dump and by analyzing netstat.
Type: RAT, VMProtect 3.x packer.
Injected shellcode, inβprocess execution.
SetWindowsHookEx β keylogger.
There are 4 ESTABLISHED connections active from the malware process.
It uses ANTI evasion techniques.
VMProtect 3.x packing β code obfuscation
Process injection β runs inside a legitimate process
WebSocket encryption β TLS 1.3 to hide traffic
Cloud infrastructure β appears legitimate
Custom binary protocol β not recognized by IDS
Registry hooking β persistence after reboot