AtlasRAT Malware Exploits Flash Installer
Cybersecurity experts have identified that the AtlasRAT malware is being distributed through a deceptive Flash Player installer, which appears legitimate but enables attackers to remotely control Windows systems. This strategy exploits familiar software names to bypass users’ defenses, embedding its malicious content directly into memory to evade conventional file-based security checks.
Old Software Brands in Modern Attacks
The reliance on outdated software brands like Flash Player continues to assist cybercriminals in disguising malware as trusted applications. This tactic demonstrates the ongoing effectiveness of social engineering in malware distribution. The AtlasRAT, identified by ASEC analysts, employs a four-stage loader beginning with a Delphi application masquerading as an AGE Flash Player.
ASEC’s report, shared with Cyber Security News, outlines how AtlasRAT can communicate via encrypted channels, execute additional modules, log keystrokes, and inject code into WeChat processes. Such capabilities highlight the significant risk posed by a successful infection, which can extend beyond the initial breach, compromising system integrity and user data.
Infection Through Microsoft-Themed Certificates
The infection process starts with a fraudulent installer, FlashPlay.Exe, which instead of installing legitimate software, acts as a loader for encrypted code components. This loader prepares a downloader that fetches subsequent stages from an attacker-controlled server, culminating in the MainDll.Dll payload. This method minimizes visible traces, complicating detection and allowing attackers to update components as needed.
The final payload uses a self-signed certificate labeled CN=update.Microsoft.Com, lending a false sense of legitimacy to its encrypted connections. Though not an actual Microsoft certificate, this tactic can mislead quick reviews of suspicious network traffic.
Advanced Features and Persistence Mechanisms
AtlasRAT employs TLS and ChaCha20 encryption for its command-and-control operations, with plugins enhancing its functionality on compromised systems. Notably, the Persistence86.Dll plugin ensures the malware’s longevity post-infection, leveraging techniques like Windows Background Intelligent Transfer Service manipulation and registry hijacking for persistence.
Additional functionalities include offline keylogging, file execution, process verification, and DLL injection into WeChat.Exe, enabling attackers to gather intelligence and conduct further malicious activities. While specific mitigation strategies were not detailed by ASEC, defenders are advised to monitor for identified infrastructure, file hashes, and unusual loader behavior.
Organizations should treat unexpected software installers with caution, especially those from untrusted sources, reinforcing the importance of verifying download origins and promptly reporting suspicious files to IT security teams.
Indicators of Compromise (IoCs):
- File Names: FlashPlay.Exe, MainDll.Dll, Persistence86.Dll
- IP Addresses: 150.158.50.175:443, 116.204.169.70
- Domain: bifa668.com
For further analysis and resilience building against phishing and malware, utilize secure environments and tools like ANY.RUN to bolster your Security Operations Center (SOC).
