AtlasRAT: Memory-Only Multi-Stage Loader Chain Disguised as AGE Flash Player — Threadlinqs Intelligence
As of 2026-07-14, AtlasRAT: Memory-Only Multi-Stage Loader Chain Disguised as AGE Flash Player is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1343 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
AhnLab ASEC identified AtlasRAT, a Delphi-compiled remote access trojan delivered through a four-stage, entirely in-memory loader chain disguised as an "AGE Flash Player" installer. The RAT uses
AtlasRAT is delivered as a Delphi-compiled executable masquerading as an "AGE Flash Player" installer (Stage 1). Once executed, Stage 1 loads an encrypted PE file (Stage 2) that reconstructs downloader shellcode from eight separately encrypted fragments, keeping the malware off disk throughout. Stage 2 hands off to a downloader (Stage 3) that connects out to attacker infrastructure and retrieves the final 32-bit RAT payload, a DLL internally named MainDll.Dll (Stage 4), which is launched via a technique ASEC labels ServiceRun. The entire chain executes in memory with no stage persisted to disk as a standalone file, an evasion property that materially degrades static, disk-based AV/EDR detection.
Command-and-control traffic is encrypted with ChaCha20 and wrapped inside a standard TLS session, with the initial handshake carrying an 8-byte protocol marker of "BFuck\0\0\0" used to identify legitimate C2 responses. The malware's TLS endpoint presents a self-signed certificate whose subject is deliberately crafted to impersonate Microsoft (CN=update.Microsoft.Com, O=Microsoft Corporation, C=US), a social-engineering-for-machines technique intended to blend into TLS inspection logs and cursory certificate review. ASEC observed a primary C2 server at 150.158.50.175 on port 443, plus secondary infrastructure at 108.187.7.84, 116.204.169.70, 143.92.32.49, 143.92.32.65, and 143.92.32.72, and states the operators have rotated across 43 distinct C2 servers since the campaign was first tracked on June 9, 2026.
Once established, AtlasRAT persists a small set of support files under the world-writable C:\Users\Public\Documents path (offline.Ini, MODIf.Html, AtlasPro.Ini, and Wxfun.DLL), names chosen to blend in with benign configuration/cache artifacts. Its capability set includes offline keylogging (buffering keystrokes for later exfiltration rather than streaming them live, reducing network signal), enumeration of an inventory of 33 known security-product executables to fingerprint the defensive posture of the host (ASEC's report does not enumerate the specific 33 product names), and targeted DLL injection into the WeChat process using a LoadLibraryW-based remote-thread-creation technique — consistent with the Wxfun.DLL artifact ASEC recovered, suggesting the injected module is used to hook or monitor WeChat activity on the host, a common targeting choice in campaigns aimed at Chinese-speaking or China-adjacent users and organizations.
ASEC's writeup notes overlap with a related but distinct campaign publicly documented by Hexastrike Cybersecurity: a Silver-Fox-attributed 'AtlasCross RAT' delivered via weaponized VPN installers, which shares the AtlasPro.ini artifact name and a near-identical 8-byte handshake structure ("SFuck\0\0\0" vs. AtlasRAT's "BFuck\0\0\0") and ChaCha20-with-per-packet-random-key C2 design, but differs materially in delivery lure (weaponized VPN installer vs. fake Flash Player), certificate strategy (stolen EV certificate issued to a Vietnamese entity vs. a self-signed Microsoft-impersonating certificate), and C2 infrastructure. These are treated in this record as related-but-distinct tooling/campaigns within a broader Chinese-speaking-actor RAT ecosystem targeting WeChat users, not as the same malware family, per both ASEC's and Hexastrike's own disambiguation.
No CVE is associated with this threat — delivery is via social engineering (a trojanized fake installer) rather than exploitation of a specific vulnerability. Note: a second, unrelated malware family also publicly referred to as "Atlas RAT" was reported by Proofpoint in connection with the financially motivated group TA4922 targeting Europe and East Asia — that family's TTPs (HR-themed phishing, GoFile-hosted ZIPs, DLL sideloading, audio recording, anti-sandbox checks against Microsoft Defender Application Guard/CExecSvc/OS UUID) are distinct from both ASEC's AtlasRAT and Hexastrike's AtlasCross RAT and are NOT conflated in this record; no attribution link
Target sectors: unknown - not specified in source reporting
Target regions: China-adjacent / Chinese-speaking users (inferred from WeChat targeting)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1204.002, T1106, T1543.003, T1036.005, T1027, T1140, T1620, T1055.001, T1553