Fake Flash Player Installer Uses Microsoft Cert to Deploy AtlasRAT

Key Takeaways

• A new campaign is distributing AtlasRAT malware via a deceptive Flash Player installer.
• The installer uses a self-signed certificate mimicking “update.Microsoft.Com” to appear legitimate.
• AtlasRAT enables remote control, data exfiltration, and persistence on compromised Windows systems.
• The malware employs a multi-stage, memory-resident loading process to evade detection.
• Organizations should implement robust endpoint detection and user education against social engineering tactics.

Cybersecurity researchers have uncovered a new campaign leveraging a counterfeit Adobe Flash Player installer to deploy AtlasRAT, a potent remote access Trojan (RAT). This sophisticated attack vector exploits the lingering familiarity with the discontinued Flash Player software to trick users into compromising their Windows systems, granting attackers extensive control and data exfiltration capabilities.

The campaign’s effectiveness stems from its ability to masquerade as a benign software installation. By adopting the guise of a well-known, albeit obsolete, application, the malicious installer lowers a victim’s defenses. Furthermore, a significant portion of the attack chain loads directly into memory, a technique designed to bypass traditional file-based security solutions, making detection and analysis more challenging.

This incident underscores the enduring efficacy of social engineering tactics that exploit trusted brand names. Cybercriminals consistently repurpose familiar software updates and installers as lures, demonstrating that this method remains a highly successful avenue for malware distribution.

Analysts at ASEC identified the malware as AtlasRAT, a Windows-specific remote-access tool. The infection begins with a four-stage loader chain, initiated by a Delphi application falsely presented as “AGE Flash Player.” ASEC said in a report that AtlasRAT facilitates encrypted communication with its command-and-control (C2) servers, can execute additional modules, log keystrokes, and inject malicious code into processes like WeChat.

A successful infection with AtlasRAT can have severe consequences, extending far beyond the initial compromise. The RAT provides attackers with a persistent foothold, enabling them to conduct in-depth system reconnaissance, download and execute further malicious payloads, identify active processes, and maintain access even after system reboots.

Fake Flash Player Installer Uses Microsoft-Themed Certificate

The infection chain initiates with an executable named FlashPlay.Exe, meticulously crafted to resemble a legitimate Flash Player installer. Instead of deploying benign software, this executable functions as the first-stage loader. It reconstructs encrypted code segments and prepares a downloader component, which subsequently retrieves the next stage of the attack from attacker-controlled infrastructure.

This downloader is then manually mapped into memory, a technique that minimizes disk-based artifacts. It invokes a function named ServiceRun, ultimately leading to the execution of the final payload, MainDll.Dll. This memory-centric approach significantly reduces the digital footprints typically left by conventional installations, affording attackers greater flexibility to update and modify components without leaving easily detectable traces.

The final AtlasRAT payload incorporates a self-signed TLS certificate. This certificate bears the subject CN=update.Microsoft.Com, creating the misleading impression that its encrypted C2 traffic originates from a legitimate Microsoft source. While this is not an authentic Microsoft-issued certificate, its deceptive appearance could potentially reduce suspicion during a cursory review of network traffic or system artifacts.

AtlasRAT employs TLS and ChaCha20 encryption for its command-and-control communications, bolstering its stealth. Its modular architecture allows for the integration of various plugins, significantly expanding the range of actions an operator can perform on a compromised system. This family of malware has been observed in other social engineering campaigns, indicating its continued use in phishing operations.

Persistence and Detection Opportunities

A critical component of AtlasRAT is its persistence plugin, identified as Persistence86.Dll. This module is engineered to ensure the malware’s survival across system reboots and beyond the initial infection. ASEC researchers documented its capabilities, which include tampering with the Windows Background Intelligent Transfer Service (BITS) database, utilizing NTUSER.MAN for logon persistence, and attempting to bypass User Account Control (UAC) through registry hijacking and the CMSTPLUA vulnerability.

Beyond persistence, AtlasRAT offers extensive operational capabilities. It can initiate or halt offline keylogging, download and execute arbitrary files, ascertain the presence of specific processes, and inject a DLL into WeChat.Exe. These functions empower attackers to gather sensitive information, prepare for subsequent malicious activities, or conceal their presence within processes that might otherwise appear normal to a user or security tool.

While ASEC did not provide a specific list of mitigation strategies, organizations can bolster their defenses by actively hunting for indicators of compromise (IoCs). This includes monitoring for the identified C2 infrastructure, unique certificate fingerprints, file hashes, and anomalous loader behavior. Specific detection heuristics include searching for 32-bit DLLs exporting ServiceRun, the distinctive By@V< marker in conjunction with observed handshake strings, and remote thread creation targeting WeChat processes using LoadLibraryW.

What You Should Do

• Educate Users: Conduct regular training sessions to inform employees about the dangers of unexpected software installers, especially those originating from untrusted sources or unsolicited emails. Emphasize verifying download sources before execution.
• Implement Endpoint Detection and Response (EDR): Deploy and configure EDR solutions to monitor for suspicious in-memory activity, unusual process behavior, and atypical network connections, which can help detect multi-stage, fileless attacks like AtlasRAT.
• Network Segmentation and Filtering: Segment networks to limit lateral movement and implement robust egress filtering to block communication with known malicious IP addresses and domains, including the IoCs provided by ASEC.
• Patch and Update: Ensure all operating systems and applications are regularly patched and updated to mitigate vulnerabilities that malware, including persistence mechanisms, might exploit.
• Monitor for IoCs: Integrate the provided Indicators of Compromise (IoCs), including file hashes, IP addresses, domains, and specific configuration markers, into your Security Information and Event Management (SIEM) and threat intelligence platforms for proactive detection.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.