Answer Brief
AhnLab ASEC details a four-stage in-memory loader chain for AtlasRAT, a Windows RAT using Delphi-based Flash Player lures, TLS-ChaCha20 C2, offline keylogging, and WeChat.exe DLL injection, with evidence pointing to a builder-based framework rather than a single operator, highlighting implications for regional threat monitoring.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
ASEC publishes analysis of AtlasRAT loader chain and payload functionality
Executive Summary: AhnLab ASEC details a four-stage in-memory loader chain for AtlasRAT, a Windows RAT using Delphi-based Flash Player lures, TLS-ChaCha20 C2, offline keylogging, and WeChat.exe DLL injection, with evidence pointing to a builder-based framework rather than a single operator, highlighting implications for regional threat monitoring.
Why It Matters
The ASEC report on AtlasRAT provides a detailed technical breakdown of a sophisticated malware loader chain that begins with a Delphi-compiled executable masquerading as a Flash Player update. This initial stage acts as an in-memory PE loader, setting up a multi-stage execution flow that avoids disk writes until necessary. The use of memory-only execution for early stages reflects a deliberate effort to evade traditional file-based detection mechanisms, a common trait in modern espionage-focused malware.
The second stage involves decoding encrypted payload components using a combination of Base64, XOR, and AES-256-CBC to reconstruct a 1,374-byte x86 downloader shellcode. This shellcode then contacts a C2 server to retrieve the next loader, which is manually mapped into memory before invoking ServiceRun to load the final DLL payload. This modular approach allows attackers to update or swap components without changing the initial infection vector, increasing operational flexibility.
Technical Signal
The final payload, MainDll.dll, implements a full-featured RAT with several notable capabilities. It initializes a TLS client using a self-signed certificate with the subject CN=update.microsoft.com, a clear attempt to mimic legitimate Microsoft update traffic and bypass network-based trust checks. Communications are encrypted using ChaCha20 over TLS, a modern and efficient cipher suite that provides strong confidentiality and is increasingly adopted in malware to avoid detection by legacy decryption tools.
Functionally, AtlasRAT supports modular plugin execution, file download and execution, process existence checks, keylogging start/stop, and clean exit routines. Its most distinctive feature is the remote injection of a DLL into WeChat.exe via LoadLibraryW, indicating a specific interest in harvesting data from the widely used messaging platform in East and Southeast Asia. This is complemented by an offline keylogging module that captures input even when the system is disconnected from the network, storing logs locally for later exfiltration.
Operational Impact
Persistence is handled by a separate plugin, persistence86.dll, which employs multiple techniques: modifying the BITS service for stealthy download execution, leveraging NTUSER.MAN for logon persistence, and hijacking CMSTPLUA and related registry keys to bypass UAC. These methods demonstrate a deep understanding of Windows internals and suggest the malware is designed for long-term, stealthy operation in enterprise environments.
Crucially, the report notes that while some contextual links to the Silver Fox group have been suggested, there is insufficient evidence to confirm a direct operational relationship. Instead, the scale and diversity of the observed samples—146 unique files, six versioned PDB builds, two developer usernames, and 27 heuristic lineages—point to a builder-based framework. The presence of both x86 and x64 branches, along with gradual certificate integration and repeated recompilations, indicates a structured development process likely aimed at licensing or private distribution rather than exclusive use by a single threat actor.
What To Watch
For defenders, the report emphasizes that while no specific mitigations are prescribed, hunting can be guided by the provided IOCs. Key network indicators include specific IPs and domains like bifa668[.]com, while file-based indicators focus on PDB paths from the atlasPro validation build directory. Behavioral rules should target the combination of By@V< markers with BFuck or SFuck handshake strings, anomalous TLS client initialization with spoofed Microsoft certificates, and signs of WeChat.exe injection via remote thread creation.
The analysis concludes that understanding AtlasRAT’s development and distribution model is more valuable than attributing it to a specific group at this time. Its modularity, use of legitimate-looking lures, and targeting of regionally significant applications like WeChat make it a relevant signal for organizations monitoring supply chain risks, credential theft, and platform-specific threats in environments where WeChat is prevalent.
Organizations with operations in East Asia should prioritize verifying whether their endpoint detection and response (EDR) tools can detect the specific behavioral patterns described, particularly the combination of memory-based loader execution, TLS certificate spoofing, and WeChat process injection. Security teams should validate that their network monitoring can identify the anomalous TLS handshake patterns associated with the CN=update.microsoft.com certificate spoof and the By@V< marker combined with BFuck or SFuck strings.
Furthermore, defenders should review their logging capabilities for the specific file system artifacts mentioned, including the creation of offline.ini, MODIf.html, and Wxfun.dll in the Public Documents directory, as well as modifications to NTUSER.MAN and BITS job queues. The presence of persistence86.dll-related PDB paths in file telemetry may also indicate developer artifacts worth investigating.
Given the modular nature of AtlasRAT, organizations should consider whether their threat intelligence feeds include the specific IOCs provided, particularly the hash values and PDB paths, and whether they have established baselines for normal WeChat.exe behavior to detect anomalous DLL injection attempts. Regular hunting exercises should focus on the temporal correlation between initial Flash Player-themed lures and subsequent WeChat process anomalies.
Finally, the report’s emphasis on the builder-based framework suggests that defenders should monitor for variations in the loader chain structure across different samples, as this may indicate evolving capabilities or distribution through multiple channels. The dual x86/x64 support and gradual integration of evasion techniques like certificate spoofing imply ongoing development that warrants continuous reassessment of detection coverage.
This assessment remains grounded in the technical observations from the ASEC report, avoiding attribution beyond what the evidence supports. The focus on builder-based development and regional targeting provides actionable insight for defenders seeking to understand malware evolution and platform-specific risks in East Asia.
Event Type: security
Importance: high
Affected Companies
- AhnLab
Affected Sectors
- cybersecurity
- malware analysis
- threat intelligence
Key Numbers
- Unique samples in 180-day retrohunt: 146
- Versioned PDB builds identified: 6
- Heuristic lineages observed: 27
Timeline
- ASEC publishes analysis of AtlasRAT loader chain and payload functionality
Frequently Asked Questions
What is AtlasRAT and how does it initially infect systems?
AtlasRAT is a Windows-based remote access trojan that begins infection via a Delphi executable disguised as AGE Flash Player, serving as the first stage of a four-step in-memory loader chain.
What are the key capabilities of the final AtlasRAT payload?
The final payload performs TLS-based ChaCha20 encrypted C2 communication, modular plugin execution, offline keylogging, and remote DLL injection into WeChat.exe via LoadLibraryW.
What evidence suggests AtlasRAT is part of a builder-based framework rather than a single-operator tool?
The presence of 146 unique samples, 6 versioned PDB builds, 27 heuristic lineages, and dual x86/x64 branches indicates a repeatable builder system, not isolated development by a single actor.
How does AtlasRAT achieve persistence and privilege escalation on infected systems?
It uses the persistence86.dll plugin for BITS database manipulation, NTUSER.MAN-based logon persistence, and UAC bypass via CMSTPLUA, fodhelper.exe, and eventvwr.exe hijacking.
What IOCs can defenders use to detect AtlasRAT activity?
Defenders should monitor for By@V< markers, BFuck\0\0\0 or SFuck\0\0\0 handshake strings, CN=update.microsoft.com TLS certificate traces, and artifacts like offline.ini, MODIf.html, Wxfun.dll, and NTUSER.MAN.