Not Every Fox is Silver: Inside an AtlasRAT loader chain

What Happened

A malware called AtlasRAT has been discovered that tricks users by pretending to be a Flash Player application. Once installed, it loads additional malicious components in memory (without saving them to disk, making detection harder) and connects back to attacker-controlled servers using encrypted communication. The malware can record what you type, inject itself into the WeChat messaging app, and maintain access to your computer even after reboots by exploiting built-in Windows features. It also tries to gain administrator-level access by abusing legitimate Windows tools. Security researchers found 146 different versions of this malware, suggesting it may be sold or distributed to multiple groups rather than being used by a single attacker. Organizations should check their systems for the listed indicators of compromise and ensure their security tools are updated to detect this threat.

Key Takeaways

• AtlasRAT is a modular Windows RAT delivered via a four-stage in-memory loader chain starting with a Delphi executable disguised as AGE Flash Player
• Final payload MainDll.Dll uses TLS with ChaCha20 encryption for C2, supports modular plugins, offline keylogging, and remote LoadLibraryW injection into WeChat.Exe
• Persistence module persistence86.Dll leverages BITS database tampering, NTUSER.MAN logon persistence, and UAC bypass via CMSTPLUA, fodhelper.exe, and eventvwr.exe
• Malware uses a self-signed certificate impersonating CN=update.Microsoft.Com for TLS client initialization
• VirusTotal retrohunt found 146 unique samples across 6 PDB builds and 2 developer usernames, suggesting commercial or privately distributed malware rather than a single operator

Affected Systems

• Windows (x86 and x64)
• WeChat (targeted for DLL injection)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Social engineering delivers Delphi executable (FlashPlay.Exe) disguised as AGE Flash Player
2. Execution: Stage 1 loader performs in-memory PE loading; Stage 2 reconstructs encrypted fragments using Base64, XOR, and AES-256-CBC to create x86 downloader shellcode
3. C2: Downloader shellcode beacons to C2 server; manually mapped loader calls ServiceRun export leading to final DLL
4. Persistence: Persistence86.Dll establishes logon persistence via NTUSER.MAN, BITS database tampering, and UAC bypass using CMSTPLUA and registry hijacking
5. Credential Access: Offline keylogging module captures keystrokes and stores data in offline.Ini
6. Lateral Movement: Remote LoadLibraryW injection targets WeChat.Exe process for DLL injection

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article provides descriptive threat hunting guidance (e.g., checking for ServiceRun exports, By@V< markers, handshake strings, and certificate fingerprints) but does not include formal YARA, Sigma, Snort, Suricata, or query rules.

Detection Engineering Assessment

Required Log Sources

• Process creation and thread injection events (Sysmon EID 8, EID 1)
• Registry modification events (Sysmon EID 12, 13, 14)
• File creation events in C:\Users\Public\Documents (Sysmon EID 11)
• Network connection events (Sysmon EID 3, firewall logs)
• TLS certificate inspection logs (proxy/IDS)
• BITS service event logs
• UAC bypass-related process execution (eventvwr.exe, fodhelper.exe, CMSTPLUA)

Hunting Hypotheses

Control Gaps

• In-memory PE loading and manual mapping may bypass file-based AV scanning
• TLS-encrypted C2 with ChaCha20 prevents network-level payload inspection
• BITS database tampering may not be monitored by standard endpoint controls
• NTUSER.MAN-based persistence is less commonly monitored compared to Run key persistence

Key Behavioral Indicators

• 32-bit DLL with ServiceRun export function
• Presence of By@V< configuration marker alongside BFuck or SFuck handshake strings
• Self-signed TLS certificate with CN=update.Microsoft.Com
• Files created in C:\Users\Public\Documents\ (offline.Ini, Wxfun.Dll, MODIf.Html)
• Remote thread creation targeting WeChat.Exe via LoadLibraryW
• NTUSER.MAN file creation or modification in user profile directories
• UAC bypass execution chains via CMSTPLUA, fodhelper.exe, or eventvwr.exe
• Mutex Global\NtuserManPayload indicating persistence payload activation

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether your network security tools can inspect and block TLS connections using self-signed certificates, particularly those impersonating Microsoft domains like CN=update.Microsoft.Com.
• Consider implementing monitoring for BITS service database modifications, which AtlasRAT abuses for persistence.
• If applicable, consider restricting WeChat.Exe execution in enterprise environments where it is not a business requirement, reducing the injection target surface.

User Protection

• Consider ensuring endpoint detection and response tools are configured to alert on UAC bypass techniques involving CMSTPLUA, fodhelper.exe, and eventvwr.exe.
• Evaluate whether your endpoint protection can detect in-memory PE loading and manual mapping techniques used in the AtlasRAT loader chain.
• Consider monitoring for NTUSER.MAN file creation in user profile directories as a persistence indicator.

Security Awareness

• Consider reinforcing user awareness training about social engineering tactics, as AtlasRAT is distributed via deceptive Flash Player installers.
• Consider reminding users to report unexpected Flash Player installation prompts, as Flash Player has been deprecated and any such prompts are inherently suspicious.
• If applicable, consider educating users about the risks of running unverified software, particularly those claiming to be media players or browser plugins.

MITRE ATT&CK Mapping

Additional IOCs

• Ips:
  • 23[.]226[.]57[.]50 - C2 server IP associated with AtlasRAT infrastructure
  • 27[.]124[.]20[.]172 - C2 server IP associated with AtlasRAT infrastructure
  • 38[.]46[.]13[.]82 - C2 server IP associated with AtlasRAT infrastructure
  • 82[.]23[.]246[.]175 - C2 server IP associated with AtlasRAT infrastructure
  • 192[.]163[.]162[.]30 - C2 server IP associated with AtlasRAT infrastructure
  • 206[.]119[.]191[.]242 - C2 server IP associated with AtlasRAT infrastructure
  • 101[.]43[.]53[.]116 - C2 server IP associated with AtlasRAT infrastructure
  • 108[.]187[.]7[.]84 - C2 server IP associated with AtlasRAT infrastructure
  • 143[.]92[.]32[.]49 - C2 server IP associated with AtlasRAT infrastructure
  • 143[.]92[.]32[.]65 - C2 server IP associated with AtlasRAT infrastructure
• File Paths:
  • C:\Users\Public\Documents\Wxfun.Dll - Attacker-dropped DLL in Public Documents directory, part of AtlasRAT payload delivery
  • C:\Users\Public\Documents\offline.Ini - Offline keylogger configuration file dropped by AtlasRAT in Public Documents directory
  • C:\Users\Public\Documents\MODIf.Html - Attacker-dropped HTML file in Public Documents directory associated with AtlasRAT
  • C:\Users\xxx857857\Desktop\atlasPro验证版2026.6.2\Release\Plugin\x86\MainDll.PDB - PDB path revealing developer username xxx857857 and project name atlasPro, build version 2026.6.2
  • C:\Users\xxx857857\Desktop\atlasPro Trial Version 2026.6.2\Release\Extend\x86\persistence86.PDB - PDB path for persistence module revealing developer username and trial version build
• Command Lines:
  • Purpose: Remote DLL injection into WeChat process via LoadLibraryW | Tools: LoadLibraryW, WeChat.Exe | Stage: Lateral Movement / Execution | LoadLibraryW targeting WeChat.Exe via remote thread creation
• Other:
  • By@V< - Configuration marker string used in AtlasRAT samples for identification
  • BFuck\0\0\0 - C2 handshake string used during initial connection by AtlasRAT loader
  • SFuck\0\0\0 - C2 handshake string variant used during initial connection by AtlasRAT loader
  • CN=update.Microsoft.Com - Self-signed certificate subject name impersonating Microsoft for TLS client initialization in C2 communication
  • FlashPlay.Exe - Stage 1 Delphi executable disguised as AGE Flash Player, acts as in-memory PE loader
  • MainDll.Dll - Final payload DLL containing RAT functionality, modular plugins, and encrypted C2
  • Persistence86.Dll - Persistence plugin providing BITS tampering, NTUSER.MAN logon persistence, and UAC bypass capabilities