Pulsar RAT Using Memory-Only Execution & HVNC to Gain Invisible Remote Access
Pulsar RAT, a derivative of the open-source Quasar RAT, has introduced advanced evasion techniques allowing attackers to maintain invisible remote access. This modular tool, focusing on Windows systems, signifies a major advancement in threat…
Pulsar RAT, a derivative of the open-source Quasar RAT, has introduced advanced evasion techniques allowing attackers to maintain invisible remote access. This modular tool, focusing on Windows systems, signifies a major advancement in threat sophistication. It combines memory-only execution with hidden virtual network computing (HVNC) capabilities, circumventing traditional detection methods.
Technical Architecture and Capabilities
Pulsar RAT operates using a client-server model with TLS-encrypted communication and the MessagePack binary protocol for efficient command transmission. The malware establishes persistence via UAC bypass and scheduled tasks at system logon with elevated privileges.
Keylogging: Records keystrokes to capture sensitive user input. Clipboard Hijacking: Replaces cryptocurrency wallet addresses in the clipboard. Credential Theft: Steals credentials using the integrated Kematian Grabber module. File Management: Allows attackers to browse, upload, and download files. Remote Shell: Enables execution of commands on infected systems. Data Exfiltration: Collects and sends stolen data to attacker-controlled servers.
The malware retrieves its command-and-control configuration from public pastebin sites, decrypting payloads using embedded cryptographic keys to obtain C2 server addresses, reducing direct infrastructure exposure.
Pulsar RAT, a derivative of the open-source Quasar RAT, has introduced advanced evasion techniques allowing attackers to maintain invisible remote access.
Recent samples show distribution through supply chain compromises. A notable 2025 npm package campaign involved malicious libraries with advanced obfuscation techniques. Post-install scripts delivered payloads to developers, achieving significant downloads before detection.
ANY.RUN sandbox analysis reveals typical deployment sequences involving malicious BAT files executing UAC bypass operations. The mechanism launches computerdefaults.exe with elevated privileges, creating scheduled tasks for persistence at every user logon.
Pulsar primarily targets Windows users and organizations lacking advanced endpoint detection and response (EDR) solutions, with a focus on developers through supply-chain mechanisms.
Organizations face substantial operational impact from Pulsar infections, with remediation requiring significant person-hours. The malware's sophisticated anti-analysis techniques and fileless execution methods demand layered defense controls, including EDR platforms, network segmentation, and user security awareness training.
Security teams should utilize integrated threat intelligence for detection, involving indicator searches, sandbox analysis, and network infrastructure correlation. Pulsar RAT's combination of stealth capabilities and supply chain attack vectors positions it as a critical threat requiring immediate attention.
Based on reporting by Cyber Security News.