AtlasRAT is being delivered through a fake Flash Player installer that looks harmless but can give attackers remote control of a Windows computer.
The campaign abuses a familiar software name to lower a victim’s guard, then loads much of its malicious code directly into memory, where it is harder for traditional file-based checks to catch.
The threat highlights how old software brands still help criminals trick users into running harmful files.
Similar fake software installer campaigns have shown that attackers continue to disguise malware as trusted applications, updates, and downloads because the tactic remains effective.
Analysts at ASEC identified the malware as AtlasRAT, a Windows remote-access tool that uses a four-stage loader chain beginning with a Delphi application disguised as AGE Flash Player.
ASEC said in a report shared with Cyber Security News (CSN) that the malware can communicate with its operators through encrypted connections, run added modules, capture keystrokes, and inject code into WeChat processes.
The impact of a successful infection can extend well beyond the initial download. AtlasRAT gives an operator a foothold to inspect the system, fetch and run more files, identify active processes, and potentially maintain access after a user restarts the device.
Fake Flash Player Installer Uses Microsoft-Themed Certificate
The infection begins with FlashPlay.Exe, a program designed to look like a Flash Player installer.
Instead of installing legitimate software, it acts as a loader that rebuilds encrypted pieces of code and prepares a downloader to retrieve the next stage from attacker-controlled infrastructure.
That downloader is manually mapped into memory and calls ServiceRun, eventually leading to the final MainDll.Dll payload.
This approach reduces the visible traces normally left by a conventional installation and helps the operators keep the chain flexible as they update components.
The final payload contains a self-signed certificate carrying the name CN=update.Microsoft.Com, giving its encrypted connection a Microsoft-themed appearance.
It is not evidence of a Microsoft-issued certificate, but it may make suspicious traffic or artifacts seem less alarming during a quick review.
AtlasRAT uses TLS and ChaCha20 encryption for command-and-control traffic, while its plugins expand what an operator can do on a compromised system.
Readers tracking recent Atlas RAT phishing campaigns can see how the malware family has also appeared in other socially engineered delivery operations.
Persistence and Detection Opportunities
One AtlasRAT plugin, Persistence86.Dll, is built to help the malware survive beyond the first infection.
ASEC observed functions that can tamper with the Windows Background Intelligent Transfer Service database, use NTUSER.MAN for logon persistence, and attempt to bypass User Account Control through registry hijacking and CMSTPLUA.
The malware can also start or stop offline keylogging, download and execute files, check whether named processes are present, and inject a DLL into WeChat.Exe.
These functions could help an attacker collect information, prepare follow-on activity, or hide within a process that may appear normal to a user.
ASEC did not issue a specific mitigation list, but defenders can hunt the observed infrastructure, certificate fingerprints, file hashes, and unusual loader behavior.
Useful checks include 32-bit DLLs exporting ServiceRun, the By@V< marker alongside the identified handshake strings, and remote thread creation using LoadLibraryW against WeChat.
Organizations should also treat unexpected software installers as a warning sign, particularly when they arrive through untrusted links or downloads.
Previous social engineering toolkit activity shows why employees should verify download sources before opening installers and report suspicious files quickly.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
