Fake Flash Player Installer Deploys AtlasRAT Malware with Microsoft-Themed Certificate
A campaign distributing a fake Flash Player installer is delivering the sophisticated AtlasRAT malware, which uses a Microsoft-themed certificate to mask its command-and-control traffic.
A new threat campaign is leveraging the enduring familiarity of the Flash Player brand to distribute the potent AtlasRAT malware. Threat actors are distributing a fake Flash Player installer, disguised as a legitimate update, which ultimately grants them remote control over compromised Windows systems. This tactic exploits user trust in well-known software names, a strategy that continues to prove effective for malicious actors seeking to bypass initial security defenses.
The infection chain begins with an executable named FlashPlay.Exe, designed to mimic a genuine Flash Player installer. Instead of performing its advertised function, this installer acts as a multi-stage loader. It meticulously reconstructs encrypted malicious code segments and then downloads the subsequent stage from infrastructure controlled by the attackers. This downloader is then injected directly into the system's memory, a technique known as "fileless" execution, which significantly hinders detection by traditional antivirus solutions that rely on scanning files on disk.
The final payload, identified as AtlasRAT, is a sophisticated remote-access tool. Analysts at ASEC observed that the malware employs a four-stage loader, with the initial stage being a Delphi application. The final stage, MainDll.Dll, communicates with its command-and-control (C2) servers using encrypted connections. Notably, this C2 traffic is secured with a self-signed certificate that bears the subject name CN=update.Microsoft.Com. While not an official Microsoft certificate, this deceptive naming can potentially mislead security analysts during incident response, making malicious traffic appear less suspicious at first glance.
AtlasRAT's capabilities extend far beyond simple remote access. Once a system is compromised, the malware can inspect system details, download and execute additional files, identify active processes, and establish persistence to maintain access even after a system reboot. This allows attackers to conduct further reconnaissance, deploy additional malware, or exfiltrate sensitive data.
Persistence is a key feature of this campaign, facilitated by a plugin named Persistence86.Dll. This module includes functions designed to tamper with the Windows Background Intelligent Transfer Service database, establish logon persistence via NTUSER.MAN, and attempt to bypass User Account Control (UAC) through registry hijacking and the CMSTPLUA COM interface. The malware can also initiate or halt offline keylogging, download and execute arbitrary files, check for the presence of specific processes, and inject its code into legitimate processes like WeChat.Exe to further evade detection.
While ASEC did not provide a comprehensive mitigation list, defenders can hunt for indicators of compromise (IoCs) such as the observed C2 infrastructure, specific file hashes, unusual loader behaviors, and the unique certificate subject. Specific detection opportunities include looking for 32-bit DLLs exporting the ServiceRun function, the presence of the By@V< marker alongside specific handshake strings (BFuck and SFuck), and remote thread creation targeting WeChat.Exe using LoadLibraryW.
This campaign underscores the persistent effectiveness of social engineering tactics, particularly the abuse of well-known software brands. Users are strongly advised to exercise caution when downloading software from untrusted sources and to verify the legitimacy of installers before execution. Organizations should also implement robust endpoint detection and response (EDR) solutions and regularly hunt for suspicious activity based on emerging threat intelligence.