chromeloader-pulsar-rat: 94682a96 — Pulsar.Common v2.4.5.0 stealer/RAT with MessagePack C2

Executive Summary A .NET Framework PE32 binary (~1.35 MB) mislabelled usfile by upstream triage. Static evidence overwhelmingly identifies it as a ChromeLoader / Pulsar variant — a modular .NET RAT/infostealer with embedded Pulsar.Common.dll v2.4.5.0, MessagePack-serialized C2, and a deep capability suite spanning browser credential theft, crypto-wallet draining, audio/video surveillance, process injection, and multi-channel exfiltration (Discord, Telegram, FTP). The usfile label is an OpenCTI artifact (us.file tag misread as a family name); no other sample in the corpus carries it.

What It Is

Family ascription: High-confidence chromeloader-pulsar-rat. Dominant class names include ChromeLoader.AesxorModule, ChromeLoader.Program, PulsarMessagePackSerializer, Pulsar.Common.Messages.*, and Pulsar.Common.Networking. ^[strings.txt:6537-6538,6720,8569-8571] The embedded assembly manifest lists Pulsar.Common, Version=2.4.5.0 ^[strings.txt:1302]. Twin sample ca687401 (ssdeep near-match) shares the identical build fingerprint.

How It Works

Build / RE Lens

Toolchain: Pure C# / .NET Framework 4.x, compiled with csc.exe or Visual Studio. No native compiler fingerprints in the PE — entirely IL. Debug build attributes are present (capa flags DebuggerNonUserCodeAttribute), but these are likely compiler artifacts rather than intentional evasion. ^[capa.txt]

Packing / embedding: Costura.Fody compresses nine dependency DLLs into .rsrc and extracts them at runtime: MessagePack.dll (v3.1.4.0), MessagePack.Annotations.dll, System.Buffers, System.Collections.Immutable, System.Memory, System.Numerics.Vectors, System.Runtime.CompilerServices.Unsafe, System.Threading.Tasks.Extensions, and Pulsar.Common.dll (v2.4.5.0). ^[strings.txt:1294-1302,3638-3646]

Anti-analysis: Capa identifies a broad anti-analysis surface:

• Debugger detection: CheckRemoteDebuggerPresent, NtQueryInformationProcess (ProcessDebugPort/ProcessDebugFlags), GetTickCount timing checks, WudfIsAnyDebuggerPresent. ^[capa.txt]
• VM detection: Strings referencing Parallels, QEMU, VMware, VirtualBox. ^[capa.txt]
• Parent PID spoofing (CreateProcess with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS). ^[capa.txt]
• Self-deletion via COMSPEC environment variable. ^[capa.txt]

Notable functions (from strings, static-only — no Ghidra decompile available):

• ChromeLoader.AesxorModule+<StartPipeServerAsync>d__35 — Starts a named-pipe C2 listener. ^[strings.txt:8569]
• ChromeLoader.AesxorModule+<ExtractAsync>d__37 — Async payload extraction/decryption. ^[strings.txt:8570]
• PulsarMessagePackSerializer — C2 serialization layer. ^[strings.txt:6720]
• StealthInjector — Process injection helper. ^[strings.txt:6830]
• ReflectiveLoader / FindReflectiveLoader / FindReflectiveLoaderOffset — Reflective DLL injection. ^[strings.txt:375,6538,7647]

Deploy / ATT&CK Lens

Crypto / traffic encryption: AesxorModule suggests AES + XOR layering. ChaCha20Poly1305 referenced in the HandleXoriumSteal async handler. ^[strings.txt:1983] EncryptTraffic / EncryptNonEnc toggles observed. ^[strings.txt:3398-3408] Base64 encoding/decoding (26 capa matches). ^[capa.txt]

Browser target scope: Chrome, Firefox (Gecko), Yandex, CryptoTab, and generic TokenRestore for Discord/Telegram session tokens. ^[strings.txt:7450-7451,1583,1548,3939,5632]

Email client targets: Outlook, FoxMail. ^[strings.txt:5411,5504]

Mutex / gating: CreateMutexA, MutexControl. ^[strings.txt:2253,5569,8246]

Registry abuse: Full remote-registry capability — create, rename, delete, change values; DoChangeRegistryValue, DoDeleteRegistryValue, etc. ^[strings.txt:4844-4847,4684-4686]

C2 Infrastructure

No hardcoded URLs, IPs, or webhook endpoints recovered in static strings. C2 configuration is likely:

1. Runtime-decrypted from an embedded resource or overlay by AesxorModule, or
2. Passed via the named-pipe bootstrap (StartPipeServerAsync → GenerateUniquePipeName).

Static artifacts that point to C2 shape:

• PulsarMessagePackSerializer — MessagePack-framed commands. ^[strings.txt:6720]
• NamedPipeServerStream + PipeStream + PipeOptions — inter-process / inter-host pipe transport. ^[strings.txt:5619,5612,7270]
• System.Net.Sockets.TcpClient implied by capa TCP socket matches. ^[capa.txt]
• HTTP client surface: set HTTP User-Agent, set web proxy, create HTTP request, receive HTTP response. ^[capa.txt]

Interesting Tidbits

• "usfile" is a ghost: The only sample in the entire corpus tagged usfile. The OpenCTI label us.file (a geographic tag) was misinterpreted by the triage pipeline as a family name. ^[metadata.json]
• Twin sample: ca687401049c4fae9fc3d278008361f470f79dcdc20fda5e9e4c482d2a9c7df7 has an ssdeep hash differing by only the first character (0fedx... vs 8fedx...), indicating a near-identical build — likely same source, different build configuration or recompilation.
• Related sample: ed94635a2348ca2e8c9c53a46336b14be509ce0a19c2521d50f9976470096ab1 also contains PulsarMessagePackSerializer, confirming a broader cluster.
• HVNC / Remote Desktop: Pulsar.Common.Messages.Monitoring.HVNC and RemoteDesktop classes suggest hidden-VNC remote control. ^[strings.txt:2303,6422]
• "FunStuff" module: Pulsar.Common.Messages.FunStuff — possibly prank/denial-of-service features (mouse swap, CD-ROM manipulation, wallpaper change, monitor power-down). ^[strings.txt:4952, capa.txt]
• BCrypt usage: BCryptDecrypt for DPAPI-like key unwrap, plus encrypt data using DPAPI (4 capa matches). ^[capa.txt, strings.txt:386]
• No CAPE detonation: No Windows guest available at time of triage; all TTPs inferred from static strings + capa.

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2022, .NET Framework 4.8, C# console/WinForms app. Pattern: Build a C# RAT with:

1. Costura.Fody NuGet package to embed MessagePack.dll and custom Pulsar.Common.dll.
2. NamedPipeServerStream for local IPC.
3. TcpClient + MessagePackSerializer for remote C2.
4. System.Diagnostics.Process with CreateProcess + PROC_THREAD_ATTRIBUTE_PARENT_PROCESS for PID spoofing.
5. DllImport on kernel32.dll for VirtualAllocEx, WriteProcessMemory, CreateRemoteThread.
6. Browser credential theft via System.Data.SQLite on Chrome Login Data + CryptUnprotectData P/Invoke.
7. Clipboard hook via AddClipboardFormatListener.

Verification: Compile and run capa — should hit communication/named-pipe/create, communication/socket/tcp, collection/screenshot, collection/keylog, defense-evasion/process-injection, and discovery/system-information.

What you'll learn: How commodity .NET RATs blend legitimate .NET networking primitives with trivial P/Invoke to achieve full surveillance and injection — and why EDR needs to monitor .NET runtime behavior, not just native imports.

Deployable Signatures

YARA Rule

rule ChromeloaderPulsar_RAT
{
    meta:
        description = "ChromeLoader / Pulsar .NET RAT with Pulsar.Common v2.4.5.0"
        author      = "PacketPursuit"
        date        = "2026-07-15"
        hash        = "94682a961e8a61b5a4b34e689de98f0a89b5e8c75bdfc493ed796c29a6b03536"
        family      = "chromeloader-pulsar-rat"

    strings:
        $pulsar_common = "Pulsar.Common" ascii wide
        $pulsar_msgpack = "PulsarMessagePackSerializer" ascii wide
        $chrome_loader  = "ChromeLoader" ascii wide
        $aesxor_module  = "AesxorModule" ascii wide
        $start_pipe     = "StartPipeServerAsync" ascii wide
        $stealth_inject = "StealthInjector" ascii wide
        $reflective     = "ReflectiveLoader" ascii wide
        $msgpack_v      = "costura.messagepack.dll.compressed" ascii wide
        $pulsar_dll     = "costura.pulsar.common.dll.compressed" ascii wide
        $tokens_grab    = "TokensGrabber" ascii wide
        $files_grab     = "FilesGrabber" ascii wide
        $chrome_wallet  = "GetChromeWallets" ascii wide
        $gecko_wallet   = "GetGeckoWallets" ascii wide
        $chrome_decrypt = "chrome_decrypt.dll" ascii wide

    condition:
        uint16(0) == 0x5a4d and
        ( $pulsar_common or $chrome_loader ) and
        ( $reflective or $stealth_inject or $start_pipe ) and
        ( $tokens_grab or $files_grab or $chrome_wallet )
}

Behavioral Hunt Query (Sigma-like)

title: ChromeLoader Pulsar Named Pipe C2 and Injection
logsource:
  product: windows
detection:
  selection_pipe:
    - Image|endswith: '\ChromeLoader.exe'
    - CommandLine|contains:
      - 'NamedPipeServerStream'
      - 'GenerateUniquePipeName'
  selection_inject:
    - CallTrace|contains:
      - 'VirtualAllocEx'
      - 'WriteProcessMemory'
      - 'CreateRemoteThread'
    - TargetImage|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\RuntimeBroker.exe'
  selection_registry:
    - EventType: SetValue
    - TargetObject|contains:
      - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
    - Details|contains:
      - 'ChromeLoader'
      - 'Pulsar'
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high

IOC List

Detection Signatures (capa → ATT&CK)

See capa.txt for 330+ capability matches. Key mappings summarized in the Deploy / ATT&CK table above. Notable dense clusters:

• Communication: 6× receive data, 6× send data, TCP socket, named-pipe creation, HTTP request/response. ^[capa.txt]
• Process injection: DLL injection, thread hijacking, reflective loading, VirtualAllocEx + WriteProcessMemory + CreateRemoteThread. ^[capa.txt]
• Collection: Screenshot (2), keylog (3), clipboard (4), password manager (KeeFarce), audio/video capture. ^[capa.txt]
• Anti-analysis: Debugger checks (5), VM checks (4), parent-PID spoofing, self-deletion. ^[capa.txt]

References

• Sample source: OpenCTI / MalwareBazaar (artifact 417ddd89-deff-4da7-98e3-a0eb5ed78baf)
• Twin sample: ca687401049c4fae9fc3d278008361f470f79dcdc20fda5e9e4c482d2a9c7df7
• Related sample: ed94635a2348ca2e8c9c53a46336b14be509ce0a19c2521d50f9976470096ab1
• Entity page: chromeloader-pulsar-rat
• Distribution label: gcleaner

Provenance

• file.txt — file type and header
• pefile.txt — PE structure, imports, sections
• strings.txt — .NET metadata strings, class names, method names
• floss.txt — decoded stacked strings (minimal additional findings)
• capa.txt — Mandiant capa v7 static capability detection
• binwalk.txt — embedded file signatures
• rabin2-info.txt — radare2 binary header
• metadata.json — OpenCTI labels and provenance
• triage.json — original (incorrect) usfile family label

Report generated 2026-07-15. Static-only analysis; no dynamic execution data available.