# AtlasRAT: Memory-Only Multi-Stage Loader Chain Disguised as AGE Flash Player

> AhnLab ASEC identified AtlasRAT, a Delphi-compiled remote access trojan delivered through a four-stage, entirely in-memory loader chain disguised as an "AGE Flash Player" installer. The RAT uses ChaCha20-encrypted C2 traffic over TLS with a self-signed certificate spoofing Microsoft, performs offline keylogging, enumerates 33 security-product executables, and injects a DLL into WeChat. ASEC has tracked an active campaign with 43 distinct C2 servers since June 9, 2026.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1343
- **ID:** TL-2026-1343
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AtlasRAT is delivered as a Delphi-compiled executable masquerading as an "AGE Flash Player" installer (Stage 1). Once executed, Stage 1 loads an encrypted PE file (Stage 2) that reconstructs downloader shellcode from eight separately encrypted fragments, keeping the malware off disk throughout. Stage 2 hands off to a downloader (Stage 3) that connects out to attacker infrastructure and retrieves the final 32-bit RAT payload, a DLL internally named MainDll.Dll (Stage 4), which is launched via a technique ASEC labels ServiceRun. The entire chain executes in memory with no stage persisted to disk as a standalone file, an evasion property that materially degrades static, disk-based AV/EDR detection.

Command-and-control traffic is encrypted with ChaCha20 and wrapped inside a standard TLS session, with the initial handshake carrying an 8-byte protocol marker of "BFuck\0\0\0" used to identify legitimate C2 responses. The malware's TLS endpoint presents a self-signed certificate whose subject is deliberately crafted to impersonate Microsoft (CN=update.Microsoft.Com, O=Microsoft Corporation, C=US), a social-engineering-for-machines technique intended to blend into TLS inspection logs and cursory certificate review. ASEC observed a primary C2 server at 150.158.50.175 on port 443, plus secondary infrastructure at 108.187.7.84, 116.204.169.70, 143.92.32.49, 143.92.32.65, and 143.92.32.72, and states the operators have rotated across 43 distinct C2 servers since the campaign was first tracked on June 9, 2026.

Once established, AtlasRAT persists a small set of support files under the world-writable C:\Users\Public\Documents path (offline.Ini, MODIf.Html, AtlasPro.Ini, and Wxfun.DLL), names chosen to blend in with benign configuration/cache artifacts. Its capability set includes offline keylogging (buffering keystrokes for later exfiltration rather than streaming them live, reducing network signal), enumeration of an inventory of 33 known security-product executables to fingerprint the defensive posture of the host (ASEC's report does not enumerate the specific 33 product names), and targeted DLL injection into the WeChat process using a LoadLibraryW-based remote-thread-creation technique — consistent with the Wxfun.DLL artifact ASEC recovered, suggesting the injected module is used to hook or monitor WeChat activity on the host, a common targeting choice in campaigns aimed at Chinese-speaking or China-adjacent users and organizations.

ASEC's writeup notes overlap with a related but distinct campaign publicly documented by Hexastrike Cybersecurity: a Silver-Fox-attributed 'AtlasCross RAT' delivered via weaponized VPN installers, which shares the AtlasPro.ini artifact name and a near-identical 8-byte handshake structure ("SFuck\0\0\0" vs. AtlasRAT's "BFuck\0\0\0") and ChaCha20-with-per-packet-random-key C2 design, but differs materially in delivery lure (weaponized VPN installer vs. fake Flash Player), certificate strategy (stolen EV certificate issued to a Vietnamese entity vs. a self-signed Microsoft-impersonating certificate), and C2 infrastructure. These are treated in this record as related-but-distinct tooling/campaigns within a broader Chinese-speaking-actor RAT ecosystem targeting WeChat users, not as the same malware family, per both ASEC's and Hexastrike's own disambiguation.

No CVE is associated with this threat — delivery is via social engineering (a trojanized fake installer) rather than exploitation of a specific vulnerability. Note: a second, unrelated malware family also publicly referred to as "Atlas RAT" was reported by Proofpoint in connection with the financially motivated group TA4922 targeting Europe and East Asia — that family's TTPs (HR-themed phishing, GoFile-hosted ZIPs, DLL sideloading, audio recording, anti-sandbox checks against Microsoft Defender Application Guard/CExecSvc/OS UUID) are distinct from both ASEC's AtlasRAT and Hexastrike's AtlasCross RAT and are NOT conflated in this record; no attribution link between TA4922's Atlas RAT and ASEC's AtlasRAT has been established from available sources.

## MITRE ATT&CK

- T1566 Phishing
- T1204.002 Malicious File
- T1106 Native API
- T1543.003 Windows Service
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1055.001 Dynamic-link Library Injection
- T1553 Subvert Trust Controls
- T1518.001 Security Software Discovery
- T1057 Process Discovery
- T1056.001 Keylogging
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer

## Sources

- [AtlasRAT: A New Type of Malware Distributed via Memory-Only Multi-Stage Loader](https://asec.ahnlab.com/en/94479/)
- [Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers](https://hexastrike.com/resources/blog/threat-intelligence/trust-the-tunnel-get-the-trojan-silver-fox-delivers-atlas-rat-via-weaponized-vpn-installers/)
- [MITRE ATT&CK - T1620: Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK - T1573.001: Encrypted Channel - Symmetric Cryptography](https://attack.mitre.org/techniques/T1573/001/)
- [MITRE ATT&CK - T1518.001: Security Software Discovery](https://attack.mitre.org/techniques/T1518/001/)
- [Adobe Flash Player End of Life](https://helpx.adobe.com/flash-player/end-of-life.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1343