Pulsar RAT Targets Windows Systems via Per-User Run Key, Exfiltrates Sensitive Data

A recent sophisticated malware campaign has been identified, targeting Windows systems using multi-stage attack methods. The attack utilizes Pulsar RAT, a remote access trojan with stealer capabilities, leveraging living-off-the-land techniques and in-memory payload delivery to bypass security measures.

The infection process begins with a batch file that establishes persistence in the registry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run. It creates a hidden folder in %APPDATA%\Microsoft\ with randomized names to avoid detection. This batch file ensures its execution at every user logon without elevated privileges, copying itself to a hidden location and employing a retry loop for robustness.

The batch file extracts a Base64-encoded payload, decodes it into a PowerShell script stored in the %TEMP% directory, and executes it with bypassed execution policy. The script contains a byte array that undergoes XOR decryption, revealing shellcode for position-independent execution.

The PowerShell loader uses CreateRemoteThread process injection, utilizing Win32 APIs. After an 80-second delay to evade monitoring, the shellcode is written into memory with execute permissions. The malware includes a watchdog mechanism for persistence, migrating to explorer.exe when needed.

The decrypted payload contains an obfuscated .NET assembly with anti-analysis protections. It checks for virtualization, sandbox, and emulation environments before execution. A background thread monitors for injected threads and debuggers, terminating upon detection.

The malware utilizes user-mode anti-debugging through window enumeration, scanning for reverse-engineering tools. It performs system reconnaissance, collecting OS, process, and runtime information.

Pulsar RAT supports real-time surveillance, including clipboard monitoring, webcam activation, and audio recording. Data exfiltration uses Discord webhooks and Telegram API, sending victim metadata. It aggregates stolen data into ZIP archives.

MD5 Hash Filename Description

648c0ba2bb1cde47fa8812f254821a72 0a1a98b5f9fc7c62.bat Batch script file

69392e0d2b877cb932ab709ebe758975 ps_7b948266.ps1 PowerShell script

666493877fb7328c3e8c313fbcfdfd1e Client.exe Executable client component

0020b06dc2018cc2b5bf98945a39cbd3 Pulsar.Common.dll Associated DLL module

3abcad7678dd78832a164349aceeaa59 Stealerv37.dll Potential stealer module

— 185[.]132[.]53[.]17:7800 Command & Control (C2) Domain

Based on reporting by GBHackers.