A malware campaign is using financial-document lures sent through WhatsApp to install a Windows remote access trojan with SYSTEM-level privileges. The infection begins when a recipient opens a ZIP archive and runs an executable presented as a statement or tax-related file. What follows is a layered chain designed to evade analysis, disable selected defenses and establish durable remote control.

Morphisec researchers identified the final payload as VulcanRAT207.A. Its operators can inventory a host, execute commands, manage files, capture screens, log keystrokes, manipulate accounts and deploy additional malware. For organizations that routinely exchange invoices or payment documents over messaging platforms, the campaign turns a familiar business workflow into a high-impact endpoint threat.

A staged loader tests the environment

The initial Statement.exe file is packed with NRV2E compression, obscuring the underlying loader from straightforward static inspection. Once launched, it checks whether the computer resembles a genuine user workstation rather than a sandbox. The checks cover disk size, memory, processors, display properties, event logs, Registry data, virtual-machine artifacts and installed security products.

Timing tests provide another way to abandon execution inside slow emulation environments. Splitting the intrusion across unpacking, privilege escalation, injection, downloading, driver installation and persistence also means that no single component displays the entire malicious behavior.

Injection turns Task Scheduler into a SYSTEM host

If the process lacks administrator rights, it attempts elevation through COM objects and can fall back to the Windows runas mechanism. It then enables SeDebugPrivilege and restores a clean copy of ntdll.dll, an effort intended to remove user-mode monitoring hooks installed by security software.

The loader injects downloader shellcode into the service process that hosts Windows Task Scheduler. Instead of the familiar CreateRemoteThread technique, it uses PoolParty Variant 7 and Windows I/O completion behavior. Because the target service runs as LocalSystem, the later stages inherit the operating system’s highest local privilege level.

The injected code contacts 61[.]18[.]208[.]27 on port 8888 to retrieve an in-memory deployment bundle. That package contains a legitimate Intel-signed VulkanInfo utility, a malicious vulkan-1.dll, an encoded RAT container named vulkan-1.bin and a deployment library.

Signed components help suppress defenses

The deployment stage attempts to install GoFly64.sys, a legitimately signed Chinese network-filter driver. By sending process identifiers to the driver through control code 0x12227A, the malware can terminate selected Baidu security processes at kernel level. Abuse of a valid signature does not make the activity benign; it instead lets the attacker bring a trusted component into a malicious chain.

The malware then writes its Vulkan-related files beneath C:\Program Files\Common Files\. When the legitimate vulkaninfo-64.exe runs, Windows searches the local directory and loads the attacker’s adjacent vulkan-1.dll. This DLL sideloading technique gives malicious code the appearance and execution context of a signed application.

Persistence hides behind update-like names

A scheduled task named USOPrivate Kit or USOPrivate restarts the signed VulkanInfo host with SYSTEM permissions. The naming resembles Windows Update terminology, which may reduce suspicion during a cursory review. The sideloaded DLL reconstructs VulcanRAT from the nearby binary container and keeps the trusted process active.

VulcanRAT uses HTTP for initial retrieval and WebSocket version 13 for command-and-control traffic. Its command set covers processes, services, applications, event logs, files, user accounts and network connections. Operators can open a shell, control the keyboard and mouse, alter clipboard content, inject into other processes, create local administrators and add Windows Filtering Platform rules.

Detection and containment priorities

• Block or quarantine executable files and password-protected archives received through WhatsApp and similar messaging services.
• Hunt for the USOPrivate task and Vulkan-related files in the Common Files directory.
• Alert on unexpected driver services or temporary files under the Windows drivers folder, especially activity involving a GoFly device.
• Investigate Task Scheduler service processes showing unusual memory injection or outbound connections.
• Block the reported command server at network controls and search historical telemetry for connections to port 8888.

Endpoints showing these indicators should be isolated before credentials are reset or evidence is collected. Because the RAT can log keystrokes and manipulate local accounts, responders should assume secrets used after infection may be exposed. Reimaging, credential rotation and a review of lateral movement are safer than simply deleting the visible files.