Detecting AtlasRAT C2

Erik Hjelmvik

Monday, 12 October 2026 14:30:00 (UTC/GMT)

Detecting AtlasRAT C2

Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol. Earlier versions started with a distinctive byte sequence:

53 46 75 63 6b 00 00 00

In ASCII, that is “SFuck” followed by three null bytes. The newer traffic starts with “BFuck”, also followed by three null bytes:

42 46 75 63 6b 00 00 00

Image: CapLoader transcript of AtlasRAT traffic in PCAP from Triage

Attribution

Atlas RAT has been linked to Silver Fox (银狐), a Chinese-nexus threat group also tracked as Void Arachne, TA4922, SwimSnake and UTG-Q-1000. The group has been associated with trojanized software and malware including ValleyRAT (Winos4.0) and Gh0st RAT.

The Atlas RAT link remains circumstantial. However, we have observed ValleyRAT and AtlasRAT using the same C2 servers on different ports, suggesting a shared operator.

The New C2 Variant

We found that FlowCarp could detect the new BFuck variant even though its Atlas RAT detection model had originally been built using examples of the older “SFuck” traffic.

Alert on win.atlas_rat malware from FlowCarp

Image: FlowCarp win.atlas_rat alert for Atlas RAT PCAP from ANY.RUN

The updated model now includes examples of both variants. Because FlowCarp analyzes more than just the initial check-in sequence, we expect it to reliably detect Atlas RAT traffic even if that sequence changes again.

The initial check-in also reveals a change in the C2 server’s port. The older variant was primarily seen on TCP ports 886 and 9899. The new variant was observed on TCP port 443.

Stage 1 Loader

The initial “BFuck” or “SFuck” check-in comes from a loader. The loader retrieves 300 to 500 kB of shellcode containing a DLL with the full Atlas RAT backdoor. Atlas RAT then opens another connection to the same C2 server, this time using a different protocol.

For more details on the loader, backdoor and C2 traffic structure, see the Trust the Tunnel, Get the Trojan write-up by Maurice Fielenbach

Changes to the Legacy C2 Traffic

Maurice determines that Atlas RAT’s C2 protocol uses ChaCha20 encryption. Each encrypted packet also carries a 56-byte header in cleartext:

4 bytes: sequence number
4 bytes: compressed size
4 bytes: original size
4 bytes: padding or flags
32 bytes: ChaCha20 key
8 bytes: ChaCha20 nonce

CapLoader transcript of Atlas RAT C2 traffic

Image: Atlas RAT C2 traffic in PCAP from Triage

By the end of March 2026, just a few days after HexaStrike’s publication, we observed the actors change their approach. They began XOR-encrypting the transmitted data with a fixed key that starts with a7 3b f1 8c.

CapLoader transcript of Atlas RAT C2 trafficw with XOR encryption

Image: Atlas RAT XOR-encrypted C2 header in PCAP from Triage

I won’t go into more detail about this XOR-encrypted variant here. The actors abandoned it in July 2026 in favor of a new approach.

TLS becomes the new Atlas RAT C2

In July 2026, Atlas RAT began using TLS for C2 communication. After the initial “BFuck” check-in, the backdoor established a new TLS-encrypted session with the C2 server.

The TLS client and server handshakes have distinctive JA3 fingerprints:

JA3: e26606c572e55d499b0676e9095e3df8
JA3S: f98a4985f829b6513fbeccf5b751b458

The C2 server typically presents a self-signed X.509 certificate that impersonates update.microsoft.com.

Self-signed certificate for update.microsoft.com

The certificate thumbprint is:

a66308a1fb09c8345228ca00335e633b2dabde53

Suricata Signatures

If you’re not ready to deploy FlowCarp for C2 detection, these Suricata rules can detect the SFuck and BFuck check-ins:

		alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"Atlas RAT loader SFuck checkin"; flow:to_server; content:"|53 46 75 63 6b 00 00 00|"; startswith; metadata: malware_family win.atlas_rat; classtype:trojan-activity; reference:url,https://netresec.com/?b=26A6cc8; sid:1471105; rev:1;)

		alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"Atlas RAT loader BFuck checkin"; flow:to_server; content:"|42 46 75 63 6b 00 00 00|"; startswith; metadata: malware_family win.atlas_rat; classtype:trojan-activity; reference:url,https://netresec.com/?b=26A6cc8; sid:1471106; rev:1;)

This rules alerts on Atlas RAT’s C2 TLS handshake:

		alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET 443 (msg:"Atlas RAT TLS handshake"; flow:established,to_server; content:"|00 00 0c 00 3d 00 35 00 9c 00 3c 00 2f 00 ff 01 00 00 10 00 0d 00 04 00 02 04 01 00 16 00 00 00 17 00 00|"; offset:43; metadata: malware_family win.atlas_rat; classtype:trojan-activity; reference:url,https://netresec.com/?b=26A6cc8; sid:1471107; rev:1;)
	  

And this one on the self-signed X.509 certificate:

		alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"Atlas RAT fake Microsoft certificate"; flow:established,to_client; content:"|03 7d 30 82 03 79 30 82 02 61 a0 03 02 01 02 02 14 64 72 4e 8c f1 71 88 bc ff e5 19 0b 69 e0 cb 52 6d 38 9a df 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4c 31 1d 30 1b 06 03 55 04 03 0c 14 75 70 64 61 74 65 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d|"; offset:12; depth:107; classtype:trojan-activity; reference:url,https://netresec.com/?b=26A6cc8; sid:1471108; rev:1;)
	  

These suricata rules are also available for download from our Suricata GitHub repo:
https://github.com/Netresec/Suricata

Further Reading

More information about Atlas RAT is available in write-ups from Proofpoint and Hexastrike.

IOC Lists

IP-port:

23.226.57.50:443
38.76.177.46:443
43.99.101.175:443
45.142.152.180:443
116.204.169.70:443
150.158.50.175:443
156.234.7.48:443
192.252.180.45:443

Domains:

laicaishuli[.]com
yilufafafa[.]club
zixungongsi[.]top

Other:

JA3: e26606c572e55d499b0676e9095e3df8
JA3S: f98a4985f829b6513fbeccf5b751b458
Cert SHA-1: a66308a1fb09c8345228ca00335e633b2dabde53

Posted by Erik Hjelmvik on Monday, 12 October 2026 14:30:00 (UTC/GMT)

Tags: #Silver Fox #JA3 #Suricata #FlowCarp