Windows machines are under a new threat: a WhatsApp file attachment distributing a remote-access trojan (RAT), VulcanRAT207.A, capable of gaining full SYSTEM privileges. The campaign infiltrates systems via a seemingly innocent ZIP file that claims to contain financial documents. Concealed within is an executable named “Statement.exe” that begins executing a multi-stage malware chain upon opening.
From the moment the user runs the file, the payload secretly elevates its privileges. It begins in a regular user process, then orchestrates a transition into a Windows service running with the LocalSystem level rights. Once that jump occurs, the malware becomes far more dangerous—and far harder to detect.
Deep Privilege Escalation and Evasion Techniques
The campaign employs a variety of evasion and obfuscation tactics. The initial loader is packed using NRV2E compression, which makes static analysis ineffective. It also conducts environmental checks—looking at Registry keys, available memory, CPU load, whether it’s inside a virtual machine or sandbox, display settings, event logs—to avoid execution in controlled analysis environments.
If it lacks admin privileges, the malware tries using COM interfaces or the standard Windows runas utility. Once it gains higher access, it activates the SeDebugPrivilege, replaces a clean copy of ntdll.dll to neutralize user-mode security hooks, and injects shellcode into the Task Scheduler service using advanced techniques like PoolParty Variant 7 and I/O completion ports. Because Task Scheduler operates under the LocalSystem account, any payloads launched from it inherit SYSTEM access.
Payload, Persistence, and Capabilities
The RAT deploys a bundle including a legitimate Intel-signed executable (“VulkanInfo”) alongside attacker-controlled modules: a malicious DLL, a RAT container in binary form, a deployment DLL, and a signed driver known as GoFly64.sys. It abuses DLL sideloading—letting the trusted host program load malicious components placed alongside it—and uses the driver to terminate certain anti-malware processes at the kernel level.
For persistence, it installs components under “C:\Program Files\Common Files\”, creating files such as vulkaninfo-64.exe, vulkan-1.dll, and vulkan-1.bin. It then creates a scheduled task named USOPrivate Kit or USOPrivate—both names that suggest legitimacy—to relaunch the RAT with SYSTEM-level access even after reboot.
Once in control, the attacker gains a broad and dangerous feature set: extracting system data, reading user accounts, network information, installed apps, files, running processes, and log files. It can also capture keystrokes and screens, control input devices, execute remote commands, change local accounts or credentials, install drivers, and load additional payloads.
Detection Advice & Indicators of Compromise
Organizations are urged to block executable-bearing ZIP files received via messaging platforms—especially when they claim to be invoices or tax-related documents. Endpoint security teams should monitor for signs like scheduled tasks with unusual names, atypical memory activity in Task Scheduler, and suspicious driver installations from temp paths. Key file paths to watch include the common shared folder in Program Files, especially for vulkaninfo-64.exe and its associated DLL and binary modules.
The threat’s command & control (C2) server is given, along with several file hashes (SHA-256) that match modules involved in the attack chain. These IoCs enable analysts to identify compromised systems for remediation.
What this means: This attack showcases an elevated level of sophistication—abusing signed legitimate software, stealthy execution pathways, and powerful privilege escalation. The use of SYSTEM-level access allows attackers complete control, and makes detection and removal far more difficult. Defenders will need heightened vigilance, especially around everyday tools and file flows that might otherwise seem benign.
