AtlasRAT is a modular Windows RAT delivered through a four-stage in-memory loader chain, beginning with a Delphi executable disguised as AGE Flash Player and ending in TLS-based, ChaCha20-encrypted command-and-control with plugin execution, offline keylogging, and DLL injection into WeChat processes. Analysis suggests a builder-based malware framework with multiple versions and branches, while attribution to Silver Fox remains unconfirmed and only circumstantial. #AtlasRAT #SilverFox #WeChat.exe #FlashPlay.Exe #MainDll.Dll #Persistence86.Dll
Keypoints
- AtlasRAT is a Windows-based remote access malware built around a four-stage in-memory loader chain.
- The initial stage is a Delphi executable, FlashPlay.Exe, disguised as AGE Flash Player and used as an in-memory PE loader.
- The loader chain reconstructs encrypted fragments with Base64, XOR, and AES-256-CBC to produce x86 shellcode and then loads the final DLL payload.
- The final payload, MainDll.Dll, uses TLS client initialization with a self-signed certificate impersonating CN=update.Microsoft.Com and communicates with C2 using ChaCha20 encryption.
- Its capabilities include plugin execution, file download and execution, offline keylogging, process checks, and remote DLL injection into WeChat.Exe.
- Persistence86.Dll supports BITS database tampering, NTUSER.MAN logon persistence, and UAC bypass using CMSTPLUA and registry hijacking.
- Evidence from VirusTotal suggests a modular, builder-based malware framework with multiple lineages, x86/x64 branches, and possible private distribution rather than a single operator.
MITRE Techniques
- [T1027 ] Obfuscated Files or Information – The malware hides and reconstructs payloads using encoded/encrypted fragments (‘reconstructs encrypted fragments using Base64, XOR, and AES-256-CBC’).
- [T1055 ] Process Injection – The final payload performs remote DLL injection and process injection, including targeting WeChat.Exe (‘remote LoadLibraryW injection targeting WeChat.Exe’).
- [T1105 ] Ingress Tool Transfer – It downloads and executes files from the command-and-control infrastructure (‘executing plugins, downloading and executing files’).
- [T1056.001 ] Keylogging – The malware performs offline keylogging as part of its credential collection capability (‘performs offline keylogging’).
- [T1090 ] Proxy: External Proxy – The loader retrieves a stage from the C2 server and uses infrastructure to deliver the final payload (‘the loader delivered from the C2 server’).
- [T1134.002 ] Create Process with Token – Not directly stated; no confirmed use in article.
- [T1543.003 ] Windows Service – Persistence-related behavior includes BITS database tampering for persistence (‘tamper with the BITS database’).
- [T1547.001 ] Registry Run Keys / Startup Folder – The report notes logon persistence via NTUSER.MAN and Run key mechanisms (‘achieve logon persistence via NTUSER.MAN’).
- [T1218 ] System Binary Proxy Execution – UAC bypass uses living-off-the-land binaries such as fodhelper.Exe and eventvwr.Exe (‘bypassing UAC using CMSTPLUA, fodhelper.Exe, and eventvwr.Exe’).
- [T1553.004 ] Install Root Certificate – Not directly confirmed; the article only mentions a self-signed certificate impersonation (‘self-signed certificate impersonating CN=update.Microsoft.Com’).
Indicators of Compromise
- [Files ] Loader and payload files – FlashPlay.Exe, MainDll.Dll, and Persistence86.Dll
- [PDB Paths ] Development/build artifacts – C:Usersxxx857857DesktopatlasPro验证版2026.6.2ReleasePluginx86MainDll.PDB, C:Usersxxx857857DesktopatlasPro Trial Version 2026.6.2ReleaseExtendx86persistence86.PDB
- [SHA-256 Hashes ] Sample hashes observed in the report – 03d93b56ac4219a8ac8a55fd4ba777618b5682cc84bec0efe8ea78e497dd3b3d, 04bef2153417efeb408d8e027bd91bb6db5b957c43ceb7429a15cb76ef436af3, and 3 more hashes
- [IP Addresses ] C2 / related infrastructure – 150.158.50.175:443, 116.204.169.70, and 8 more IPs including 101.43.53.116 and 143.92.32.49
- [Domains ] Network infrastructure – bifa668[.]com and Bifa668.Com
- [Certificate Subject ] TLS impersonation artifact – CN=update.Microsoft.Com
- [Configuration Markers ] Malware-specific markers – By@V<, BFuck, and SFuck
- [Payload / Artifact Paths ] Persistence and support artifacts – GlobalNtuserManPayload, C:UsersPublicDocumentsWxfun.Dll, C:UsersPublicDocumentsoffline.Ini, and C:UsersPublicDocumentsMODIf.Html
Read more: https://asec.ahnlab.com/en/94704/