Pulsar RAT
Pulsar RAT is a Windows-focused open-source .NET remote access trojan, widely described as a derivative of Quasar RAT and observed in active multi-stage malware campaigns and software supply-chain attacks. Reported delivery vectors include malicious npm packages such as buildrunner-dev, fake installer/MSI packages such as haunt.msi, obfuscated batch and PowerShell loader chains, and steganographic retrieval of payloads from PNG images. In multiple reports, the malware is executed primarily in memory using Donut-generated shellcode, reflective .NET loading, process injection into legitimate processes such as explorer.exe, and watchdog/process-migration logic to maintain execution while minimizing disk artifacts.
High-confidence capabilities described across the reporting include remote access and command execution, credential theft, keylogging, screen capture, webcam and microphone capture, browser credential and profile theft, file management, remote shell access, and data exfiltration. Specific theft targets mentioned include Chrome, Edge, Brave, Opera, and Firefox browser data; Firefox logins.json via PK11SDR_Decrypt; cryptocurrency wallets and clipboard hijacking for BTC, ETH, XMR, SOL, LTC, XRP, TRX, and BCH formats; VPN configurations; gaming accounts; messaging tokens; and developer-related secrets in supply-chain scenarios. Some reporting also describes hidden VNC/HVNC-style covert access, live chat interaction with victims, and use alongside Stealerv37.
Persistence and evasion features reported include HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries, scheduled tasks, UAC-bypass techniques including fodhelper.exe and ms-settings/computerdefaults-style abuse, anti-VM checks for VMware, VirtualBox, QEMU, Parallels, and Cuckoo artifacts, and anti-debugging against tools including x32dbg, x64dbg, WinDbg, OllyDbg, dnSpy, Immunity Debugger, and IDA. One detailed analysis of Pulsar RAT v2.4.5.0 described a loader masquerading as cfgmgr.dll that decoded GUID-encoded shellcode from its .rdata section, then patched AMSI, disabled ETW, bypassed WLDP, loaded .NET runtime v4.0.30319, and reflectively loaded the Pulsar payload from memory. The malware has also been reported to use TLS-encrypted and MessagePack-based communications.
Observed infrastructure and indicators include command-and-control relayed through host.fedmenigga.workers.dev via Cloudflare Workers to backend 31.57.147.207, victim geolocation via ipwho.is, and another reported C2 indicator of 185.132.53.17:7800. Exfiltration channels mentioned in reporting include Discord webhooks, Telegram bots, and cloud-based messaging services. Associated activity has been linked to financially motivated campaigns, including Elastic Security Labs reporting GitHub-hosted payload delivery tied to an operation tracked as REF1695, and Breakglass Intelligence assessing a sustained multi-tool campaign using Pulsar RAT MaaS since at least February 2026. Targeting described in the content is primarily Windows users, including developers via npm/package ecosystem abuse and organizations lacking mature endpoint detection.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
40 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
The decoded PowerShell script functions as an advanced in-memory loader... launches it using a hidden PowerShell instance with execution policy bypass enabled
Persistence
1 technique
Persistence
Privilege Escalation
4 techniques
Privilege Escalation
Stealth
15 techniques
Stealth
GUID-encoded shellcode — 973 KB of x64 shellcode stored as 60,820 Windows GUIDs in the PE .rdata section, evading signature-based detection
“extracts an embedded Base64-encoded PowerShell payload…” and “contains an encrypted byte array that is decrypted at runtime using a bitwise XOR routine”
Exports Name cfgmgr.dll (Windows Configuration Manager — DLL hijack masquerade)
...injects the decrypted shellcode into a legitimate process and spawns a remote thread to begin execution.
“Defense Evasion T1070.004 Indicator Removal: File Deletion” and “writes it temporarily to disk… and then deletes the script.”
T1140 Deobfuscate/Decode Files GUID-to-bytes decoding at runtime
Anti-VM CheckForVMwareAndVirtualBox , VMware/VirtualBox/QEMU/Parallels strings
Credential Access
3 techniques
Credential Access
Discovery
5 techniques
Discovery
Collection
6 techniques
Collection
Category Evidence Screen capture SharpDX , SharpDX.Direct3D11 , SharpDX.DXGI , SharpDX.D3DCompiler
Clipboard hijack : Monitors clipboard continuously; replaces any recognized crypto address with attacker's address
Category Evidence Audio NAudio.Core , NAudio.Wasapi , Error stopping audio
Command and Control
5 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A RAT family identified as one of the payloads hosted and delivered by the operator in this campaign cluster.
An open-source .NET remote access trojan delivered by haunt.msi. It supports keylogging, screen capture/streaming, webcam and audio capture, browser credential theft, browser profile cloning, remote chat, process injection, persistence, anti-VM/anti-debug checks, IP geolocation, and cryptocurrency clipboard hijacking. The sample uses a custom loader with GUID-encoded shellcode, in-memory CLR hosting, and AMSI/ETW/WLDP bypasses before reflectively loading the Pulsar RAT payload.
Open-source .NET remote access trojan delivered by the malicious npm package buildrunner-dev.
Remote access trojan delivered via malicious npm packages (including via steganographic payload retrieval) to compromise developer systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.