How to remove AtlasCross RAT from infected devices

What kind of malware is AtlasCross?

AtlasCross is a Remote Access Trojan (RAT) that lets attackers secretly control a victim's computer. It is known that cybercriminals target mainly Chinese-speaking users and use fake download websites for popular apps to distribute the RAT. AtlasCross is also designed to avoid detection.

More about AtlasCross

Cybercriminals use a real tool called Setup Factory to make the malware installer look legitimate and safe. They hide AtlasCross inside several layers of legit-looking installers, making it look safe while secretly infecting the system. Threat actors also use anti-analysis techniques to avoid detection by security tools and researchers.

The AtlasCross RAT is the main malware that runs after infection. It connects to the attacker's server and takes control of the system. It hides itself in the Windows folder with a random name and runs multiple tasks, like blocking security tools and communicating with attackers.

It also secretly runs PowerShell within itself (without using the standard PowerShell program) and disables security protections, allowing attackers to execute commands without detection. The RAT communicates with its control server using strong encryption (ChaCha20).

AtlasCross RAT enables cybercriminals to manage remote sessions, giving them control over infected systems. It can view the screen and control mouse and keyboard input. The malware also supports process injection, allowing it to run malicious code inside other programs.

It can also download and execute additional files and includes a module management tool that allows cybercriminals to load or update different components of the malware. Additionally, it provides file access and shell commands, allowing threat actors to browse, modify files, and run system commands remotely.

Additional capabilities

AtlasCross disrupts security programs by blocking their network connections. This weakens their ability to protect the system without directly closing them. It also monitors common security tools and apps, such as WeChat and Telegram. The RAT can inject a malicious DLL into WeChat to take control of the app.

When it receives a command, it drops a DLL file, finds the running WeChat process, and forces it to load the malicious code inside its memory. This feature is likely used to access messages or steal session data.

Moreover, AtlasCross can place a hidden scheduled task in a Windows system folder, so it runs automatically when the user logs in with high privileges. It disguises its file path to avoid detection by security tools. When it needs to remove itself, it delays and adjusts process priorities so it can delete its own files without crashing or leaving traces.

Conclusion

AtlasCross is a sophisticated and stealthy RAT capable of taking control of infected systems, bypassing security protections, and remaining persistent. Victims of these attacks can encounter issues like identity theft, account hijacking, additional infections, financial loss, etc. If a system is infected with AtlasCross, the RAT should be removed immediately.

More examples of RATs are CrySome, CrystalX, and GHOSTFORM.

How did AtlasCross infiltrate my computer?

AtlasCross is distributed through fake installers downloaded from typosquatted websites (e.g., www-surfshark[.]com) that mimic legitimate software download sites. These sites offer tools such as Surfshark, Signal, Telegram, Zoom, Microsoft Teams, VPN clients, messengers, video conferencing apps, cryptocurrency trackers, and e-commerce applications.

They are designed to download a ZIP file that contains a multi-layered installer that appears legitimate and is signed with a stolen certificate. Once executed, it installs a decoy application (e.g., UltraViewer) alongside hidden malware components, then loads the RAT in memory through multiple stages.

More examples of fake sites used to deliver malicious installers: app-zoom[.]com, eyy-eyy[.]com, kefubao-pc[.]com, quickq-quickq[.]com, signal-signal[.]com, telegrtam.com[.]cn, trezor-trezor[.]com, ultraviewer-cn[.]com, wwtalk-app[.]com, www-surfshark[.]com, and www-teams[.]com.

How to avoid installation of malware?

Be careful with emails that seem unexpected or come from unfamiliar senders, especially if they contain links or attachments. If files or links in such messages appear suspicious, do not open them. Also, avoid interacting with pop-ups, ads, or prompts on untrusted websites, and do not allow notifications from shady pages.

Download software and files from official sources or verified app stores, and avoid cracked programs, pirated software, or key generators. Make sure your operating system and applications are kept up to date.

If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Fake websites distributing malicious installers containing AtlasCross (source: hexastrike.com):

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is AtlasCross?
• STEP 1. Manual removal of AtlasCross malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with AtlasCross malware, should I format my storage device to get rid of it?

Taking this step can eliminate AtlasCross, but it will also delete all files and data on the device. For that reason, it is often recommended to first try removing it with a reputable security solution, such as Combo Cleaner, before resorting to reformatting.

What are the biggest issues that malware can cause?

Malware can carry out a wide range of harmful actions, such as deleting or corrupting files, dropping additional malicious payloads, and gathering sensitive information. This can lead to serious outcomes like identity theft, financial loss, unauthorized account access, and irreversible loss of data.

What is the purpose of AtlasCross?

The purpose of AtlasCross is to act as a Remote Access Trojan that gives attackers control over infected computers. It is mainly used to spy on users, steal data, execute commands remotely, and maintain long-term access.

How did AtlasCross infiltrate my computer?

AtlasCross is spread through malicious installers on fake websites that imitate trusted software like Surfshark, Signal, Telegram, Zoom, Microsoft Teams, VPNs, and other popular apps. These sites deliver a ZIP file containing a seemingly legitimate installer signed with a stolen certificate. When run, it installs a decoy app (such as UltraViewer) while secretly loading the RAT.

Will Combo Cleaner protect me from malware?

Yes, Combo Cleaner can detect and remove most known malware infections. However, advanced threats often hide deeply within the system, so it is important to perform a full system scan to ensure nothing is missed.