Malware

AtlasRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.012Hypervisor CLIEvidence1

The analyzed chain consists of a Delphi executable that is disguised as AGE Flash Player and loads an encrypted Stage 2 PE file, which then reconstructs the downloader shellcode from eight encrypted fragments.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

ultimately executes a 32-bit RAT named MainDll.Dll via ServiceRun.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

It targets WeChat.Exe to detect LoadLibraryW-based remote thread creation

T1543.003Windows ServiceEvidence1

ultimately executes a 32-bit RAT named MainDll.Dll via ServiceRun.

Stealth

2 techniques

T1055Process InjectionEvidence1

It targets WeChat.Exe to detect LoadLibraryW-based remote thread creation

T1620Reflective Code LoadingEvidence2

The chain operates entirely through memory execution throughout all stages, minimizing disk activity.

Defense Impairment

1 technique

T1553.002Code SigningEvidence1

The DLL contains a self-signed certificate with the subject CN=update.Microsoft.Com, O=Microsoft Corporation, C=US, which is used for TLS client initialization.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

The final payload features C2 communication encrypted with ChaCha20 over TLS, code execution for modular plugins, offline keylogging, collection of security product inventory for 33 executable files, and DLL injection targeting WeChat.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

collection of security product inventory for 33 executable files

T1083File and Directory DiscoveryEvidence1

Detects behavior attempting to enumerate security products for 33 EXE files.

Collection

1 technique

T1056.001KeyloggingEvidence1

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The downloader connects to 150.158.50.175:443 Using a BFuck\0\0\0 handshake to receive the next stage

T1105Ingress Tool TransferEvidence2

this report documents a four-stage loader chain and RAT capabilities not previously described

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app3 days ago

ip.v4●●●●●●●●●●●●View more in app3 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 15, 2026

Not Every Fox is Silver: Inside an AtlasRAT loader chain - Malware Analysis - Malware Analysis, News and Indicators

A remote access trojan described as using a four-stage loader chain with in-memory execution across all stages to minimize disk activity. The report also notes tracked C2 infrastructure associated with AtlasRAT.

ahnlab asec blogNews

Jul 12, 2026

Not Every Fox is Silver: Inside an AtlasRAT loader chain - ASEC

A remote access trojan delivered through a four-stage in-memory loader chain. It uses ChaCha20-encrypted C2 over TLS, supports modular plugin-based code execution, performs offline keylogging, enumerates security products, and injects a DLL into WeChat.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

AtlasRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.012Hypervisor CLIEvidence1

Persistence

1 technique

T1543.003Windows ServiceEvidence1

ultimately executes a 32-bit RAT named MainDll.Dll via ServiceRun.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

It targets WeChat.Exe to detect LoadLibraryW-based remote thread creation

T1543.003Windows ServiceEvidence1

ultimately executes a 32-bit RAT named MainDll.Dll via ServiceRun.

Stealth

2 techniques

T1055Process InjectionEvidence1

It targets WeChat.Exe to detect LoadLibraryW-based remote thread creation

T1620Reflective Code LoadingEvidence2

The chain operates entirely through memory execution throughout all stages, minimizing disk activity.

Defense Impairment

1 technique

T1553.002Code SigningEvidence1

The DLL contains a self-signed certificate with the subject CN=update.Microsoft.Com, O=Microsoft Corporation, C=US, which is used for TLS client initialization.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

collection of security product inventory for 33 executable files

T1083File and Directory DiscoveryEvidence1

Detects behavior attempting to enumerate security products for 33 EXE files.

Collection

1 technique

T1056.001KeyloggingEvidence1

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The downloader connects to 150.158.50.175:443 Using a BFuck\0\0\0 handshake to receive the next stage

T1105Ingress Tool TransferEvidence2

this report documents a four-stage loader chain and RAT capabilities not previously described

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app3 days ago

ip.v4●●●●●●●●●●●●View more in app3 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 15, 2026

Not Every Fox is Silver: Inside an AtlasRAT loader chain - Malware Analysis - Malware Analysis, News and Indicators

ahnlab asec blogNews

Jul 12, 2026

Not Every Fox is Silver: Inside an AtlasRAT loader chain - ASEC

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.