Pulsar RAT Abuses Memory-Only Execution and HVNC for Stealthy Remote Takeover
Pulsar RAT, an advanced variant of the open-source Quasar RAT, is currently targeting Windows systems with enhanced stealth features and fileless execution methods.
Pulsar RAT, an advanced variant of the open-source Quasar RAT, is currently targeting Windows systems with enhanced stealth features and fileless execution methods.
This modular remote access trojan utilizes memory-only loading, hidden virtual network computing (HVNC), and cryptocurrency wallet clipping to maintain persistent backdoor access while avoiding traditional security measures.
The malware employs sophisticated anti-analysis mechanisms to bypass conventional detection methods. Anti-virtualization checks are used to identify sandbox environments by inspecting disk labels for specific strings. If virtual machine indicators are detected, execution is terminated to prevent analysis.
Pulsar RAT utilizes .NET reflection for loading payloads directly into memory, thus avoiding disk writes and employing a fileless approach that circumvents disk-based security monitoring. Code injection capabilities enable execution within legitimate processes, rendering process-name-based detection ineffective. Network communications use TLS encryption, with configuration data retrieved from public Pastebin sites.
The malware employs sophisticated anti-analysis mechanisms to bypass conventional detection methods.
Pulsar RAT primarily spreads through supply-chain compromises and social engineering. Initial access is typically gained through phishing emails with malicious attachments, cracked software distributions, or compromised third-party libraries. Upon execution, the malware establishes persistence through startup entries or scheduled tasks configured with elevated privileges.
The malware's modular plugin architecture supports extensive functionality, including keylogging, webcam and microphone access, credential harvesting, and cryptocurrency clipboard hijacking. Hidden virtual network computing enables attackers to control infected systems remotely without alerting users.
Additional modules provide a range of features, including reverse proxy support and remote shell execution, facilitating lateral movement across compromised networks.
Organizations face risks of intellectual property theft, regulatory violations, and operational disruptions, necessitating significant personnel resources for remediation. Effective defense requires layered security controls, including EDR platforms, network segmentation, and user security awareness training to mitigate the impact of social engineering attacks targeting this threat.
Based on reporting by GBHackers.