AtlasRAT Analysis Reveals Four-Stage In-Memory Loader and Modular RAT Capabilities

Jul 27, 2026 · Original article ↗

Summary

Researchers detail AtlasRAT’s four-stage Windows loader, modular RAT functions, persistence techniques, and hunting indicators. Evidence suggests a builder-based development system, but does not establish a conclusive link to Silver Fox.

Key points

AtlasRAT begins with a Delphi executable disguised as AGE Flash Player and uses a four-stage in-memory loading chain to deliver its final DLL payload.
The RAT uses TLS-based ChaCha20-encrypted C2 and supports plugins, file downloads and execution, offline keylogging, and DLL injection into WeChat.
A separate persistence plugin can tamper with the BITS database, establish logon persistence, and bypass UAC through several techniques.
A 180-day VirusTotal retrohunt identified 146 unique samples, six versioned PDB builds, and 27 heuristic lineages.
The analysis describes parallel x86 and x64 branches and iterative builds, suggesting a modular, builder-based malware framework.
A Silver Fox connection remains circumstantial and unconfirmed.
The report provides file, network, certificate, and configuration indicators, along with hunting guidance for identifying related samples and activity.

Article Details

Attack Vectors: Social-engineering-based distribution of a Delphi executable disguised as AGE Flash Player.
A four-stage in-memory loader reconstructs encrypted fragments using Base64, XOR, and AES-256-CBC, then executes shellcode and manually maps a loader delivered from C2.
AtlasRAT uses TLS-based, ChaCha20-encrypted C2 communications and can download and execute files.
The malware injects DLLs into WeChat.exe using remote LoadLibraryW.
The persistence plugin can tamper with the BITS database, establish logon persistence through NTUSER.MAN, and bypass UAC using CMSTPLUA and registry hijacking.
Defensive Notes: The report does not propose specific defensive measures.
Hunt for 32-bit DLLs with a ServiceRun export and for the By@V< marker alongside BFuck\0\0\0 or SFuck\0\0\0.
Investigate TLS client initialization using a self-signed certificate with CN=update.Microsoft.Com, and artifacts related to offline.Ini, MODIf.Html, Wxfun.DLL, and NTUSER.MAN.
Check for remote thread creation through LoadLibraryW targeting WeChat.exe and use the reported network indicators and file hashes for detection.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bifa668[.]com`	Domain listed as a network IOC for AtlasRAT.
IPV4	`101[.]43[.]53[.]116`	Defanged IP listed in the article's IP indicator section.
IPV4	`108[.]187[.]7[.]84`	Defanged IP listed in the article's IP indicator section.
IPV4	`116[.]204[.]169[.]70`	Network IOC listed as AtlasRAT infrastructure.
IPV4	`143[.]92[.]32[.]49`	Defanged IP listed in the article's IP indicator section.
IPV4	`143[.]92[.]32[.]65`	Defanged IP listed in the article's IP indicator section.
IPV4	`192[.]163[.]162[.]30`	Network IOC listed as AtlasRAT infrastructure.
IPV4	`206[.]119[.]191[.]242`	Network IOC listed as AtlasRAT infrastructure.
IPV4	`23[.]226[.]57[.]50`	Network IOC listed as AtlasRAT infrastructure.
IPV4	`27[.]124[.]20[.]172`	Network IOC listed as AtlasRAT infrastructure.
IPV4	`38[.]46[.]13[.]82`	Network IOC listed as AtlasRAT infrastructure.
IPV4	`82[.]23[.]246[.]175`	Network IOC listed as AtlasRAT infrastructure.
SHA256	`03d93b56ac4219a8ac8a55fd4ba777618b5682cc84bec0efe8ea78e497dd3b3d`	SHA2 file hash listed as an AtlasRAT indicator.
SHA256	`04bef2153417efeb408d8e027bd91bb6db5b957c43ceb7429a15cb76ef436af3`	SHA2 file hash listed as an AtlasRAT indicator.
SHA256	`06abfcb1b253bb6722d01181dc4bf90f25d012ea585974e49a7bf839a20f0d24`	SHA2 file hash listed as an AtlasRAT indicator.
SHA256	`06b06be9dfbc70557278ebd9622c6994b30be2642793d2fafec228240459fbb2`	SHA2 file hash listed as an AtlasRAT indicator.
SHA256	`0941884daf94d347e4bdd793b2ecb8a0692ae8054ed7d62e0663a982af113a0e`	SHA2 file hash listed as an AtlasRAT indicator.