Fake Flash Player Installer Uses Microsoft-Themed Certificate to Deploy AtlasRAT

AtlasRAT is being delivered through a fake Flash Player installer that looks harmless but can give attackers remote control of a Windows computer.

The campaign abuses a familiar software name to lower a victim’s guard, then loads much of its malicious code directly into memory, where it is harder for traditional file-based checks to catch.

The threat highlights how old software brands still help criminals trick users into running harmful files.

Similar fake software installer campaigns have shown that attackers continue to disguise malware as trusted applications, updates, and downloads because the tactic remains effective.

Analysts at ASEC identified the malware as AtlasRAT, a Windows remote-access tool that uses a four-stage loader chain beginning with a Delphi application disguised as AGE Flash Player.

ASEC said in a report shared with Cyber Security News (CSN) that the malware can communicate with its operators through encrypted connections, run added modules, capture keystrokes, and inject code into WeChat processes.

The impact of a successful infection can extend well beyond the initial download. AtlasRAT gives an operator a foothold to inspect the system, fetch and run more files, identify active processes, and potentially maintain access after a user restarts the device.

Fake Flash Player Installer Uses Microsoft-Themed Certificate

The infection begins with FlashPlay.Exe, a program designed to look like a Flash Player installer.

Instead of installing legitimate software, it acts as a loader that rebuilds encrypted pieces of code and prepares a downloader to retrieve the next stage from attacker-controlled infrastructure.

That downloader is manually mapped into memory and calls ServiceRun, eventually leading to the final MainDll.Dll payload.

This approach reduces the visible traces normally left by a conventional installation and helps the operators keep the chain flexible as they update components.

The final payload contains a self-signed certificate carrying the name CN=update.Microsoft.Com, giving its encrypted connection a Microsoft-themed appearance.

It is not evidence of a Microsoft-issued certificate, but it may make suspicious traffic or artifacts seem less alarming during a quick review.

AtlasRAT uses TLS and ChaCha20 encryption for command-and-control traffic, while its plugins expand what an operator can do on a compromised system.

Readers tracking recent Atlas RAT phishing campaigns can see how the malware family has also appeared in other socially engineered delivery operations.

Persistence and Detection Opportunities

One AtlasRAT plugin, Persistence86.Dll, is built to help the malware survive beyond the first infection.

ASEC observed functions that can tamper with the Windows Background Intelligent Transfer Service database, use NTUSER.MAN for logon persistence, and attempt to bypass User Account Control through registry hijacking and CMSTPLUA.

The malware can also start or stop offline keylogging, download and execute files, check whether named processes are present, and inject a DLL into WeChat.Exe.

These functions could help an attacker collect information, prepare follow-on activity, or hide within a process that may appear normal to a user.

ASEC did not issue a specific mitigation list, but defenders can hunt the observed infrastructure, certificate fingerprints, file hashes, and unusual loader behavior.

Useful checks include 32-bit DLLs exporting ServiceRun, the By@V< marker alongside the identified handshake strings, and remote thread creation using LoadLibraryW against WeChat.

Organizations should also treat unexpected software installers as a warning sign, particularly when they arrive through untrusted links or downloads.

Previous social engineering toolkit activity shows why employees should verify download sources before opening installers and report suspicious files quickly.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
File name	FlashPlay.Exe	First-stage fake Flash Player loader
File name	MainDll.Dll	Final AtlasRAT DLL payload
File name	Persistence86.Dll	Persistence-related plugin
PDB path	C:\Users\xxx857857\Desktop\atlasPro验证版2026.6.2\Release\Plugin\x86\MainDll.PDB	Main payload development path
PDB path	C:\Users\xxx857857\Desktop\atlasPro Trial Version 2026.6.2\Release\Extend\x86\persistence86.PDB	Persistence plugin development path
IP address	150[.]158[.]50[.]175:443	Observed command-and-control endpoint
IP address	116[.]204[.]169[.]70	Observed network indicator
Domain	bifa668[.]com	Observed command-and-control domain
IP address	23[.]226[.]57[.]50	Observed network indicator
IP address	27[.]124[.]20[.]172	Observed network indicator
IP address	38[.]46[.]13[.]82	Observed network indicator
IP address	82[.]23[.]246[.]175	Observed network indicator
IP address	192[.]163[.]162[.]30	Observed network indicator
IP address	206[.]119[.]191[.]242	Observed network indicator
IP address	101[.]43[.]53[.]116	Additional observed network indicator
IP address	108[.]187[.]7[.]84	Additional observed network indicator
IP address	143[.]92[.]32[.]49	Additional observed network indicator
IP address	143[.]92[.]32[.]65	Additional observed network indicator
Configuration marker	By@V<	AtlasRAT configuration marker
Handshake string	BFuck\0\0\0	Observed protocol-related string
Handshake string	SFuck\0\0\0	Observed protocol-related string
Certificate subject	CN=update.Microsoft.Com	Self-signed TLS certificate subject
Mutex	Global\NtuserManPayload	Observed AtlasRAT artifact
File path	C:\Users\Public\Documents\Wxfun.Dll	Observed related artifact
File path	C:\Users\Public\Documents\offline.Ini	Observed related artifact
File path	C:\Users\Public\Documents\MODIf.Html	Observed related artifact
SHA-256	03d93b56ac4219a8ac8a55fd4ba777618b5682cc84bec0efe8ea78e497dd3b3d	Observed sample hash
SHA-256	04bef2153417efeb408d8e027bd91bb6db5b957c43ceb7429a15cb76ef436af3	Observed sample hash
SHA-256	06abfcb1b253bb6722d01181dc4bf90f25d012ea585974e49a7bf839a20f0d24	Observed sample hash
SHA-256	06b06be9dfbc70557278ebd9622c6994b30be2642793d2fafec228240459fbb2	Observed sample hash
SHA-256	0941884daf94d347e4bdd793b2ecb8a0692ae8054ed7d62e0663a982af113a0e	Observed sample hash

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN