WhatsApp attachment deploys VulcanRAT207.A to gain SYSTEM access on Windows
Attackers use a malicious ZIP file sent via WhatsApp to install a remote access trojan that achieves deep system control and evades detection.
Key points
- The campaign uses a ZIP archive containing Statement.exe to deploy the VulcanRAT207.A remote access trojan.
- The malware elevates privileges to LocalSystem rights, granting operators extensive control over infected Windows machines.
- Morphisec analysts identified the threat chain, noting its use of packing and anti-analysis techniques to hide from security tools.
Analysts at Morphisec identified a malicious campaign delivering the VulcanRAT207.A remote access trojan through WhatsApp attachments. The attack begins when recipients open a ZIP archive that contains a financial document lure and an executable file named Statement.exe, initiating a complex infection chain on Windows systems.
According to Cyber Security News, this malware executes a hidden sequence that transitions from a standard user-level process into a Windows service running with LocalSystem rights. This privilege escalation allows remote operators to gain deep control over the infected machine, bypassing standard user restrictions and enabling persistent access to critical system functions.
Technical Mechanics and Evasion
The final payload, VulcanRAT207.A, provides attackers with extensive capabilities including data collection, command execution, file management, screen capture, and keystroke recording. Operators can also create or modify local accounts and deploy additional payloads. The campaign utilizes a signed driver to terminate specific security processes and establishes a scheduled task to restart the RAT with SYSTEM privileges after a system reboot.
Morphisec researchers noted that the actors split the activity into distinct stages for unpacking, privilege elevation, code injection, and payload download. This modular design reduces the suspicious behavior visible in any single file, complicating investigation efforts. The initial executable is heavily packed with NRV2E compression, which obscures the real loader from basic static analysis checks.
Detection Challenges and Indicators
After execution, the loader performs environment checks to determine if the machine is a real user system or an automated analysis environment. It reviews disk space, display details, memory, CPU resources, event logs, Registry keys, and virtual-machine markers. The malware also employs timing checks designed to halt execution in slow sandboxes or emulated systems, further hindering detection.
If the malware lacks administrator permissions, it attempts elevation through COM objects or falls back to the Windows runas function. Cyber Security News reported similar use of the PoolParty Variant 7 injection method in coverage of ValleyRAT LINE installer activity. This suggests defenders should monitor for unusual Windows thread-pool and I/O completion behavior associated with such injection techniques.
Affected Systems and Risk Profile
This campaign poses a significant risk to organizations where staff receive invoices, statements, tax files, or payment-related documents through messaging apps. The use of financial document lures targets users who may be expecting such files, increasing the likelihood of interaction. The ability to reach SYSTEM-level access means that compromised machines can be fully controlled by remote operators.
The threat is particularly dangerous because it leverages a trusted communication channel like WhatsApp to deliver the initial payload. Once the Statement.exe file is opened, the subsequent stages operate silently, making it difficult for users to notice the compromise. The persistence mechanisms ensure that the malware remains active even after system reboots.
What should you do?
Organizations should monitor for unauthorized scheduled tasks and services running with SYSTEM privileges. Security teams should watch for unusual process injections, particularly those involving thread-pool or I/O completion ports. Users should be trained to verify the source of unexpected attachments, especially those labeled as financial documents.
What to do and how to stay safe: VulcanRAT207.A
- Inspect incoming ZIP archives from messaging apps for unexpected executables before opening them.
- Monitor system logs for new services or scheduled tasks that run with high-level privileges.
- Check for unusual network connections that may indicate a WebSocket-based remote access channel.
- Ensure endpoint detection tools are configured to alert on anti-analysis behaviors and packing techniques.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the name of the malware delivered via WhatsApp?
The malware is named VulcanRAT207.A, which is a remote access trojan deployed through a malicious ZIP attachment.
How does the malware gain SYSTEM-level access?
It moves from a user-level process into a Windows service running with LocalSystem rights, often using a signed driver to bypass security.
What techniques does the malware use to evade detection?
The malware uses NRV2E compression, environment checks for sandboxes, and splits its activity into separate stages to hide its behavior.
