WhatsApp Malware Leverages SYSTEM Privileges for Deep System Compromise
A sophisticated attack chain begins with a malicious ZIP attachment distributed via WhatsApp, deploying the VulcanRAT207.A remote access trojan that escalates to SYSTEM-level privileges on Windows.
A complex malware campaign is leveraging WhatsApp attachments to deliver a potent remote access trojan (RAT) capable of achieving SYSTEM-level privileges on Windows systems. The attack begins with a seemingly innocuous ZIP archive, often disguised as a financial document like an invoice or statement, sent through WhatsApp. Once a user opens the executable file within the archive, named Statement.exe, a multi-stage process is initiated that stealthily elevates the malware's privileges from user-level to the highly privileged LocalSystem account.
The ultimate payload, identified as VulcanRAT207.A, grants attackers extensive control over infected machines. This includes the ability to exfiltrate sensitive system data, execute arbitrary commands, manage files, capture screenshots, log keystrokes, create or modify local user accounts, and deploy additional malicious payloads. The campaign also employs a signed kernel-level driver to disable security software and establishes persistence through a scheduled task, ensuring the RAT can restart with SYSTEM privileges even after a reboot.
Researchers at Morphisec detailed the intricate attack chain, highlighting how the threat actors meticulously divided the operation into distinct stages. These include unpacking, privilege escalation, code injection, payload download, security tool disruption, persistence establishment, and remote control. This modular approach minimizes suspicious activity at any single point, significantly complicating forensic analysis and detection efforts.
The initial executable is heavily obfuscated using NRV2E compression, a technique designed to evade basic static analysis. Upon execution, the loader performs a series of checks to determine if the environment is a genuine user system or an automated analysis sandbox. It scrutinizes factors such as disk space, display resolution, available memory, CPU resources, event logs, registry keys, virtual machine indicators, and the presence of security products. Timing checks are also implemented to hinder execution within slow-running sandboxes or emulated environments.
Privilege escalation is achieved through COM object manipulation, with a fallback to the Windows runas function if necessary. The malware then acquires the SeDebugPrivilege, restores a clean copy of the ntdll.dll library to remove user-mode security hooks, and injects shellcode into the process responsible for the Windows Task Scheduler service. Instead of conventional methods like CreateRemoteThread, the attackers utilize a technique known as PoolParty Variant 7, leveraging the Windows I/O completion system to execute code within the trusted Task Scheduler process, which inherently runs with LocalSystem privileges.
The injected shellcode establishes communication with a command-and-control (C2) server at 61[.]18[.]208[.]27 on port 8888, downloading a deployment bundle directly into memory. This bundle contains legitimate components, such as a signed Intel VulkanInfo utility, alongside malicious files like vulkan-1.dll and vulkan-1.bin, which together form the RAT container. The campaign also employs DLL sideloading, a common tactic where a legitimate application is tricked into loading a malicious DLL placed alongside it.
Before establishing persistence, the malware attempts to install GoFly64.sys, a legitimate signed driver from a Chinese vendor, often targeting security processes associated with Baidu. The use of a signed driver is critical, as it allows the malware to operate at the kernel level, enabling it to terminate security processes and bypass defenses. For persistence, the malware installs the VulkanInfo utility and its associated DLLs in a common program directory and creates a SYSTEM scheduled task, often named 'USOPrivate Kit' or 'USOPrivate', to mimic legitimate Windows update activity.
Organizations are strongly advised to implement strict policies regarding executable content received via WhatsApp and other messaging platforms, especially ZIP files purporting to be financial documents. Security teams should actively hunt for unusual Task Scheduler activity, the creation of suspicious scheduled tasks, and the presence of unexpected files in system directories, particularly those involving signed drivers or legitimate-looking executables loading malicious DLLs.