Executive Summary
Security researchers have identified a distinct execution chain for VulcanRAT207.B, a sophisticated Remote Access Trojan (RAT) that shares infrastructure with the previously documented VulcanRAT207.A. The attack utilizes a legitimate, signed Intel VulkanInfo executable to side-load a malicious DLL, which subsequently executes the RomulusLoader shellcode. This loader is responsible for establishing persistence via scheduled tasks and deploying the final VulcanRAT207.B payload over TCP port 1234.
Technically, the malware demonstrates high complexity, employing custom-modified RC4 encryption to protect its configuration and communications. It features extensive anti-analysis checks, in-memory reflective loading, and the ability to restore a clean copy of ntdll.dll to bypass security hooks. Notably, VulcanRAT207.B includes dual kernel-driver evasion paths, utilizing PoisonX and TrueSight drivers to terminate security software and hide its presence.
This threat is significant due to its ability to operate with SYSTEM privileges and its comprehensive suite of operator tools, including remote desktop, file manipulation, and process concealment. While shared artifacts suggest a link to Chinese-language development, specific attribution remains linked to suspected cybercriminal groups like TA4922. Organizations should prioritize monitoring for the specific persistence artifacts and driver interfaces mentioned in the technical findings.