A sneaky malware campaign called Pulsar RAT that hits Windows machines hard. It uses “living off the land” tricks tools already on your PC to stay hidden.
The attack starts with a batch file tucked into a user’s Run registry key. This file pulls out a PowerShell loader, which then injects shellcode into legit processes like explorer.exe. No big files on disk means it’s tough for antivirus to spot.
The final payload is a .NET stealer and remote access tool (RAT). It grabs credentials, spies with webcam and mic, and sends loot via Discord or Telegram.
Attackers love its anti-detection moves, like checking for virtual machines or debuggers. This shows how modular .NET malware is rising, using free tools like Donut for in-memory loads.
How The Attack Unfolds
The chain has three stages. First, a hidden batch file drops into %APPDATA%\Microsoft[random][batfile].bat and sets a Run key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run[random] = “cmd.exe /c [bat path]”. At login, it runs quietly.
The batch reads its own Base64 blob (marked ::6bbd64163c24f552::), decodes it to a temp PS1 file like ps_7b948266.ps1 in %TEMP%, and launches it with execution policy bypassed. Then it cleans up.
PowerShell does the heavy lift: XOR-decrypts Donut shellcode, waits 80 seconds to dodge monitors, and injects into svchost.exe via CreateRemoteThread.
A watchdog loop respawns it in explorer.exe if needed, using APIs like VirtualAllocEx and WriteProcessMemory.
Donut decrypts (via Chaskey cipher) to Client.exe (MD5: 666493877fb7328c3e8c313fbcfdfd1e). This .NET file loads Pulsar.Common.dll and Stealer37.dll in memory.
| Stage | Key Artifacts | Technique |
|---|---|---|
| 1: Batch | %APPDATA%\Microsoft\9bd8233d8354\0a1a98b5f9fc7c62.bat HKCU\Run\bada287ebf | Persistence via Run key |
| 2: PS Loader | %TEMP%\ps_7b948266.ps1 XOR shellcode | Process injection, watchdog |
| 3: .NET RAT | Client.exe Pulsar.Common.dll, Stealer37.dll | In-memory load, Donut shellcode |
RAT Powers and Data Theft
Pulsar RAT packs RAT controls (remote shell, task manager disable, UAC toggle) and stealer modules.
Anti-analysis shines: background threads hunt debuggers (x64dbg, dnSpy), VMs, and injections. It profiles the host, hooks clipboard for crypto wallets, snaps screens, and streams webcam/audio.
Stealer37 targets 100+ apps:
| Category | Examples |
|---|---|
| Remote Tools | AnyDesk, TeamViewer, PuTTY |
| FTP Clients | FileZilla, WinSCP |
| VPNs | NordVPN, ExpressVPN |
| Browsers/Games | Chrome passwords, Steam |
| Messengers | Discord, Telegram |
According to Point Wild, loot goes into ZIPs with IntelIX.txt summary, exfiltrated to Discord webhooks or Telegram bots. C2 hits like 185.132.53.17:7800.
MITRE ATT&CK maps to T1055 (Process Injection), T1059.001 (PowerShell), T1562.001 (Disable Tools), T1027 (Obfuscation).
Reboot to Safe Mode, scan with UltraAV (detects as Trojan_210126_Donut_Client). It beats anti-VM tricks by watching behavior.
| MD5 | Filename |
|---|---|
| 648c0ba2bb1cde47fa8812f254821a72 | 0a1a98b5f9fc7c62.bat |
| 69392e0d2b877cb932ab709ebe758975 | ps_7b948266.ps1 |
| 666493877fb7328c3e8c313fbcfdfd1e | Client.exe |
| 0020b06dc2018cc2b5bf98945a39cbd3 | Pulsar.Common.dll |
| 3abcad7678dd78832a164349aceeaa59 | Stealer37.dll |
This campaign blends public tools and custom code for long-term theft. Patch Windows, watch Run keys, and use behavior-based defenses.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
