Executive Summary
AtlasRAT is a Windows-based remote access Trojan characterized by a sophisticated modular framework and a four-stage in-memory loader chain. The infection typically begins with a Delphi executable, FlashPlay.Exe, disguised as an 'AGE Flash Player' or weaponized VPN installers. While circumstantial evidence suggests a link to the threat actor Silver Fox, the malware's diversity and scale hint at a potential commercial distribution model or a broader builder-based ecosystem.
The attack chain progresses through encrypted shellcode to a final DLL payload (MainDll.Dll) that utilizes TLS-based ChaCha20 encryption for C2 communication. Notable technical features include the use of self-signed certificates impersonating Microsoft update domains to bypass trust checks and the deployment of a specialized persistence module, persistence86.Dll, which manipulates the BITS database and hijacks registry keys.
The business impact is significant due to the malware's focus on credential theft through offline keylogging and its specific capability to inject DLLs into WeChat processes (WeChat.Exe), potentially allowing for communication monitoring or unauthorized messaging. Organizations should prioritize detection of manual PE mapping and unusual UAC bypass attempts using CMSTPLUA or systemic registry hijacking.