AtlasRAT Uses Four-Stage In-Memory Loader to Keylog and Inject Malware Into WeChat

AtlasRAT is a modular Windows remote access trojan that uses a four-stage, fully in-memory loader chain to quietly establish TLS‑ and ChaCha20‑protected command-and-control, log keystrokes offline.

If inject malicious DLLs into WeChat, effectively turning the chat client into a long‑lived surveillance and control foothold on compromised hosts.

Once launched, this first stage decrypts and loads an encrypted second-stage PE without writing traditional artifacts to disk, immediately increasing the difficulty of static AV detection.

Stage 2 then reconstructs a 1,374-byte x86 downloader shellcode from multiple encrypted fragments using Base64, XOR, and AES-256-CBC, assembling the next step of the chain entirely in memory.

The downloader shellcode reaches out to a hard-coded C2 endpoint, identified in public reporting as IPs clustered around Hong Kong and South Korea. It performs manual mapping of the next loader into memory.

From there, the chain calls a ServiceRun export that ultimately hands execution to MainDll.dll, the final AtlasRAT payload.

Throughout all stages, disk activity is minimized; each component focuses on unpacking, decrypting, and transferring control in RAM, a design explicitly tuned to evade conventional, file-centric detection.

MainDll.dll is a 32-bit RAT core that anchors AtlasRAT’s post-compromise capabilities. It initializes a TLS client session using an embedded, self-signed certificate that impersonates CN=update.microsoft.com, O=Microsoft Corporation, wrapped with ChaCha20 encryption to obfuscate traffic from network inspection tools further.

Over this encrypted channel, the malware implements a modular plugin architecture: operators can remotely load and execute plugins, download and run arbitrary files, inventory processes, and perform termination actions.

ASEC Researchers said that, the analyzed AtlasRAT chain begins with a Delphi executable masquerading as an AGE Flash Player installer (FlashPlay.exe), designed to appear benign while acting as an in-memory PE loader.

The payload supports offline keylogging, persisting keystrokes locally even when the host is disconnected, and enumerates 33 security-related executables to profile the defensive posture of the victim system.

AtlasRAT Uses Four-Stage In-Memory

Notably, AtlasRAT performs remote LoadLibraryW-based DLL injection into WeChat.exe, using CreateRemoteThread to hijack the popular messaging client and piggyback on its long-lived sessions for covert monitoring and possible data theft.

A dedicated persistence plugin, persistence86.dll, can tamper with the Windows BITS database, abuse NTUSER.MAN for logon persistence, and bypass UAC through CMSTPLUA and registry hijacking, reinforcing its foothold against standard remediation efforts.

Public analysis of AtlasRAT remains limited, with confirmed technical reporting primarily from AhnLab’s ASEC team, Hexastrike, and Proofpoint, alongside atlas family tracking by Mallory.ai and regional threat intelligence blogs.

A 180-day VirusTotal retrohunt uncovered 146 unique samples, six versioned PDB builds, two development-environment usernames, and 27 heuristic lineages, revealing an ecosystem more consistent with a builder-backed, commercially developed or privately distributed malware framework than a one-off, single-operator toolset.

Proofpoint attributes Atlas RAT usage to TA4922, a Chinese-speaking cybercrime cluster that deploys HR and finance-themed lures, and connects it with loaders such as RomulusLoader and SilentRunLoader.

Hexastrike, meanwhile, has linked AtlasRAT-like tradecraft to the Silver Fox crime cluster via weaponized VPN installers and related AtlasCross/AtlasCR campaigns.

Though current evidence is circumstantial and insufficient to definitively conclude that Silver Fox and the operators behind the four-stage loader chain are identical.

Although the referenced report does not prescribe explicit defensive playbooks, it exposes a rich set of hunting hooks: TLS sessions bearing the BFuck or SFuck 8-byte handshake markers, connections to AtlasRAT C2 nodes such as 150.158.50.175:443.

The embedded Microsoft-themed self-signed certificate fingerprint, and file-system artifacts including offline.ini, MODIf.html, AtlasPro.ini, Wxfun.dll, and paths tied to persistence86.dll.

Endpoint telemetry should be tuned to catch remote LoadLibraryW injection into WeChat.exe, CreateRemoteThread activity from untrusted processes, and suspicious manipulation of BITS and NTUSER.MAN.

AtlasRAT should therefore be understood not as a single payload but as a modular, builder-based framework, featuring parallel x86/x64 branches, iterative recompilation, dedicated persistence modules, and phased certificate introduction across versions.

In this context, mapping its development and distribution infrastructure and its intersection with TA4922 and possible Silver Fox-linked campaigns is more strategically valuable than rushing to narrow attribution, especially as the framework continues to evolve and proliferate across East Asian and European targeting.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide