WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows

A malicious WhatsApp attachment is being used to deploy a Windows remote access trojan that can reach SYSTEM-level access, giving its operators deep control over infected machines.

The campaign begins with a ZIP archive carrying a financial-document lure and an executable named Statement.exe.

Once the recipient opens the file, the malware starts a long, hidden chain that moves from a user-level process into a Windows service running with LocalSystem rights.

The final payload, named VulcanRAT207.A, gives remote operators the ability to collect system data, run commands, manage files, capture screens, record keystrokes, create or change local accounts, and deploy more payloads.

The campaign also uses a signed driver to terminate selected security processes and creates a scheduled task that can restart the RAT with SYSTEM privileges after a reboot.

This makes the WhatsApp-delivered file a serious risk for organizations where staff receive invoices, statements, tax files, or payment-related documents through messaging apps.

Analysts at Morphisec identified the malware chain and described how it moves from a WhatsApp attachment to a full WebSocket-based RAT connection.

Their research shows that the actors split the activity into separate stages for unpacking, privilege elevation, code injection, payload download, security-tool disruption, persistence, and remote control.

WhatsApp Attachment Deploys Malware

This design reduces the amount of suspicious behavior visible from any single file and makes investigation harder. The first executable is heavily packed with NRV2E compression, which hides the real loader from basic static checks.

After it runs, the loader checks whether the machine looks like a real user system rather than an automated analysis environment.

It reviews disk space, display details, memory, CPU resources, event logs, Registry keys, virtual-machine markers, and security products. It also uses timing checks meant to stop execution in slow sandboxes or emulated systems.

Similar use of the PoolParty Variant 7 injection method was reported in Cyber Security News coverage of ValleyRAT LINE installer activity, showing why defenders should watch unusual Windows thread-pool and I/O completion behavior.

If the malware does not already have administrator permissions, it attempts elevation through COM objects and can fall back to the Windows runas function.

It then enables SeDebugPrivilege, restores a clean copy of ntdll.dll to remove user-mode security hooks, and injects downloader shellcode into the process hosting the Windows Task Scheduler service.

Instead of using the more common CreateRemoteThread method, it uses PoolParty Variant 7 and the Windows I/O completion system to run code inside the trusted service process.

Since the Task Scheduler runs as LocalSystem, later components inherit SYSTEM access rather than needing to elevate again. The injected shellcode contacts 61[.]18[.]208[.]27 over port 8888 and downloads a deployment bundle into memory.

The bundle includes a legitimate Intel-signed VulkanInfo utility, a malicious vulkan-1.dll, a vulkan-1.bin RAT container, and a deployment DLL.

The threat uses a technique known as DLL sideloading, where a legitimate application loads an attacker-controlled DLL placed beside it.

The same method has appeared in other WhatsApp-focused campaigns, including this report on WhatsApp Web session hijacking, where trusted Windows programs were also abused to load malware.

Before setting up persistence, the deployment DLL attempts to install GoFly64.sys, a legitimately signed Chinese network-filter driver. It creates a temporary driver file and service, then sends process IDs to the driver through the 0x12227A control code.

Malware act at kernel level

Morphisec found that this path targets bdservicehost.exe and bduserhost.exe, which are connected to Baidu security software. The use of a signed driver is important because it allows the malware to act at kernel level and end selected protection processes.

Security teams should treat unexpected driver-service creation, especially from temporary paths under the Windows drivers directory, as a high-priority event.

For persistence, the malware writes vulkaninfo-64.exe, vulkan-1.dll, and vulkan-1.bin into C:\Program Files\Common Files\.

It then creates a SYSTEM scheduled task named USOPrivate Kit or USOPrivate, using names that may look related to normal Microsoft update activity.

When the task starts the signed VulkanInfo utility, the application searches its local folder for vulkan-1.dll and loads the malicious file. The DLL reads the nearby .bin file, rebuilds the final RAT in memory, and keeps the trusted host process running.

Earlier Cyber Security News reporting on TA4922 malware delivery chains also documented the use of Vulkan-related files such as vulkan-1.dll and vulkan-1.bin in the wider malware ecosystem.

VulcanRAT207.A communicates with the same server through WebSocket version 13 after first using HTTP for stage retrieval.

The RAT can gather host details, user accounts, network connections, installed applications, running processes, services, event logs, and files selected by the operator.

It can also open remote command shells, capture the desktop, log keystrokes, control the mouse and keyboard, alter clipboard data, block network traffic through Windows Filtering Platform rules, and inject payloads into other processes.

Its command set can create a local administrator account, change passwords, download files, run executables, and even register additional drivers.

Organizations should block executable content received through WhatsApp and other messaging platforms, particularly ZIP files that claim to contain financial statements or tax documents.

Endpoint teams should hunt for Task Scheduler processes showing unusual memory activity, creation of the USOPrivate Kit task, unexpected files in C:\Program Files\Common Files\, and execution of vulkaninfo-64.exe from that directory.

Monitoring signed-driver installation and process termination attempts against endpoint-security products can also help stop this chain before the RAT becomes active.

Indicators of compromise (IoCs):-

Indicator type	Value	Context
SHA-256	0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb	Tax-202609078869.exe WhatsApp-delivered outer wrapper
SHA-256	be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9	Packed Statement.exe outer wrapper
SHA-256	6833b1946ac219cf6ddf6cfbde1f81352b12d9125c8735961b5256216c4fdc49	Unpacked Statement loader
SHA-256	cbf8ffe904a030c02b9def094f609b2c05a78fa5c7745d2d371d38dd460c58be	Downloaded deployment bundle
SHA-256	2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a	GoFly64.sys signed driver
SHA-256	facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116	Legitimate vulkaninfo-64.exe host
C2 server	61[.]18[.]208[.]27:8888	HTTP stage retrieval and final WebSocket RAT communication
Mutex	Global\Admindllhost!!!	Deployment DLL single-instance control
Mutex	analplug<config suffix>	VulcanRAT207.A single-instance control
Named pipe	\\.\pipe\<PID>_pipe	Local RAT inter-process communication
Scheduled task	USOPrivate Kit / USOPrivate	SYSTEM-level persistence task
File paths	C:\Program Files\Common Files\vulkaninfo-64.exe	Signed VulkanInfo persistence host
File paths	C:\Program Files\Common Files\vulkan-1.dll	Malicious side-loaded DLL
File paths	C:\Program Files\Common Files\vulkan-1.bin	VulcanRAT container
Driver path	%WINDIR%\System32\drivers\tp_<tick>.tmp	GoFly or operator-provided driver
Device / control code	\\.\GoFly / IOCTL 0x12227A	Process-termination path targeting Baidu processes
Targeted processes	bdservicehost.exe / bduserhost.exe	Processes targeted through the GoFly driver

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.