Not Every Fox is Silver: Inside an AtlasRAT loader chain

AtlasRAT is a Windows-based modular remote access trojan delivered via a four-stage in-memory loader that begins with a Delphi executable disguised as Flash Player; the final payload supports TLS-based ChaCha20-encrypted C2, plugin execution, offline keylogging, DLL injection (targeting WeChat), and persistence via BITS and NTUSER.MAN. Analysis of VirusTotal samples indicates a builder-style production with multiple builds and diverse infrastructure; the report provides file and network IOCs, certificate markers, MITRE ATT&CK mappings, and threat-hunting rules but stops short of firm actor attribution.