A new campaign has been identified that distributes the AtlasRAT remote access Trojan (RAT) through a deceptive installer masquerading as an "AGE Flash Player." This tactic exploits the continued search by some users for Flash Player, despite Adobe having ended support for the software on December 31, 2020, and actively blocking Flash content in its official player.
The infection chain begins with a Delphi executable named `FlashPlay.Exe`. This initial loader operates entirely in memory, reconstructing subsequent payloads without dropping files to disk, a technique often referred to as fileless malware.
The final payload, `MainDll.Dll`, establishes encrypted Command and Control (C2) communication using Transport Layer Security (TLS). It employs a self-signed certificate that spoofs `CN=update.Microsoft.Com`. While web browsers would typically reject such a certificate, custom malware can bypass operating system trust checks to facilitate encrypted C2 traffic.
Once AtlasRAT is installed, attackers gain persistent remote control over the compromised Windows system. Its capabilities include collecting credentials through offline keylogging, gathering system information, identifying installed security products, and exfiltrating data over encrypted channels. The RAT can also inject DLLs into applications such as WeChat, potentially enabling monitoring or manipulation of messaging, or concealing malware activity and connectivity.
Researchers suggest that AtlasRAT appears to be a reusable framework or a commercially available offering, rather than a custom tool developed for a single group. This assessment is based on historical data of the RAT's deployment.
Previous campaigns have shown AtlasRAT being distributed through other deceptive means, including fake VPN installers. Cybersecurity experts advise users to exercise caution when downloading software, especially from sponsored search results, which do not guarantee legitimacy.
To mitigate the risk of infection, users are encouraged to carefully verify the software they intend to install. Maintaining an up-to-date, real-time anti-malware solution is also recommended, as such software can detect and block remote access Trojans. For instance, Malwarebytes has been observed to detect AtlasRAT as `Malware.AI.1710771908`. Additionally, keeping operating systems, browsers, and security software updated is crucial for protection against such threats.
