WebRAT is a backdoor with info-stealing capabilities that can steal credentials for Steam, Discord, and Telegram accounts, as well as cryptocurrency wallet data. It can spy on victims through webcams and capture screenshots. The malware establishes persistence through Windows Registry modifications, Task Scheduler, and injecting itself into random system directories. The fake exploits are delivered as password-protected ZIP files containing an empty file with password as filename, corrupted decoy DLL file, batch file for execution chain, and main dropper named rasmanesc.exe. The dropper elevates privileges, disables Windows Defender, then downloads and executes WebRAT from hardcoded URL.