FHN 
Security researchers have uncovered AtlasRAT, a sophisticated modular remote access trojan (RAT) that targets Windows systems using a four-stage in-memory attack chain. Instead of relying on files stored on disk, the malware loads its components directly into memory, making it significantly harder for traditional antivirus solutions to detect.
The malware also abuses WeChat by injecting malicious DLLs into the application, allowing attackers to maintain long-term access, monitor activity, and potentially steal sensitive information.
How the Attack Works
AtlasRAT begins with a Delphi executable disguised as a legitimate AGE Flash Player installer (FlashPlay.exe). While it appears harmless, the installer secretly launches the malware’s multi-stage infection process.
The attack unfolds in four stages:
- Stage 1: Decrypts and loads the next payload directly into memory without creating files on disk.
- Stage 2: Rebuilds encrypted shellcode using multiple encryption techniques, including Base64, XOR, and AES-256-CBC.
- Stage 3: Connects to a hardcoded command-and-control (C2) server and manually loads the next component into memory.
- Stage 4: Executes MainDll.dll, the primary AtlasRAT payload that provides attackers with remote access to the infected system.
By keeping every stage in memory, AtlasRAT significantly reduces forensic evidence and avoids many file-based security controls.
Advanced Remote Access Capabilities
Once active, AtlasRAT establishes an encrypted communication channel using TLS combined with ChaCha20 encryption. The malware even uses a self-signed certificate that mimics Microsoft to help disguise its network traffic.
The RAT allows attackers to:
- Execute additional plugins remotely
- Download and run malicious files
- View and terminate running processes
- Perform offline keylogging
- Continue collecting data even when the system is disconnected from the internet
WeChat DLL Injection
One of AtlasRAT’s most notable capabilities is its ability to inject malicious DLLs into WeChat.exe using LoadLibraryW and CreateRemoteThread.
This enables attackers to:
- Hide inside a trusted application
- Maintain long-term persistence
- Monitor user activity
- Potentially steal sensitive communications
Using a legitimate messaging application also helps the malware blend into normal system activity.
Persistence Techniques
AtlasRAT includes a dedicated persistence module called persistence86.dll, which helps the malware survive system reboots.
Its persistence techniques include:
- Modifying the Windows BITS database
- Abusing NTUSER.MAN for logon persistence
- Bypassing User Account Control (UAC)
- Using registry hijacking to maintain access
These methods make removal more difficult and help attackers retain control of compromised devices.
Threat Intelligence Findings
Researchers identified 146 unique AtlasRAT samples during a 180-day VirusTotal analysis. Multiple malware variants, versioned builds, and development artifacts suggest AtlasRAT is part of a continuously evolving malware framework rather than a single campaign.
Current public analysis has been shared by security researchers from ASEC, Proofpoint, Hexastrike, and other threat intelligence teams.
Proofpoint attributes AtlasRAT activity to TA4922, a Chinese-speaking cybercrime group known for using HR and finance-themed phishing lures. Other researchers have observed similarities with campaigns linked to the Silver Fox threat cluster, although there is currently no conclusive evidence connecting the two groups.
Detection Opportunities
Security teams should monitor for indicators such as:
- Unusual TLS connections using suspicious self-signed Microsoft-themed certificates
- Remote DLL injection into WeChat.exe
- CreateRemoteThread activity originating from untrusted processes
- Unexpected modifications to the BITS database or NTUSER.MAN
- Suspicious files such as offline.ini, AtlasPro.ini, MODIf.html, and Wxfun.dll
These behaviors may indicate an active AtlasRAT compromise.
AtlasRAT is more than a traditional remote access trojan. Its modular architecture, four-stage in-memory execution, encrypted communications, DLL injection, and advanced persistence mechanisms make it a highly capable threat designed to evade conventional security defenses.
As the malware continues to evolve, organizations should strengthen endpoint monitoring, memory-based threat detection, and behavioral analytics to identify attacks that bypass traditional file-based security solutions.
IOCs
| Indicator | Type |
|---|---|
| FlashPlay.exe | File (executable) |
| MainDll.dll | File (DLL) |
| Persistence86.dll | File (DLL) |
| C:\Users\xxx857857\Desktop\atlasPro验证版2026.6.2\Release\Plugin\x86\MainDll.pdb | File (PDB path) |
| C:\Users\xxx857857\Desktop\atlasPro Trial Version 2026.6.2\Release\Extend\x86\persistence86.pdb | File (PDB path) |
| 150.158.50.175:443 | Network (IP:Port) |
| 116.204.169.70 | Network (IP) |
| bifa668.com | Network (Domain) |
| 23.226.57.50 | Network (IP) |
| 27.124.20.172 | Network (IP) |
| 38.46.13.82 | Network (IP) |
| 82.23.246.175 | Network (IP) |
| 192.163.162.30 | Network (IP) |
| 206.119.191.242 | Network (IP) |
About the Author
