WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows
A WhatsApp ZIP lure deploys VulcanRAT207.A, a Windows RAT that escalates to SYSTEM and sideloads via VulkanInfo.
Morphisec analyzed a campaign that delivers VulcanRAT207.A through a WhatsApp ZIP containing Statement.exe, disguised as a financial document. The packed loader checks for sandboxes, elevates privileges, and injects into the Windows Task Scheduler service using PoolParty Variant 7 so later stages run as LocalSystem. It downloads a bundle from 61.18.208.27 on port 8888 and sideloads a malicious vulkan-1.dll through a signed Intel VulkanInfo binary. A signed GoFly64.sys driver can kill Baidu security processes, and a SYSTEM task named USOPrivate or USOPrivate Kit restores the WebSocket RAT, which supports shells, screen capture, keylogging, and account changes.