> Family · ChromeLoader / Pulsar RAT_

~/packetpursuit $ cat /intel/families/chromeloader-pulsar-rat.md

typeentityconfidencehighcreated2026-07-15updated2026-08-04malware-familyratinfostealerloaderdotnetc2persistencedefense-evasioncode-injectionexfiltration

ChromeLoader / Pulsar RAT

A .NET Framework-based remote-access trojan and infostealer family built around the Pulsar.Common shared library (observed versions 2.4.5.0+) and the ChromeLoader staging module. It combines modular RAT surveillance (screen, audio, keylog, HVNC remote desktop) with dedicated stealer functionality (browser credentials, crypto wallets, Discord/Telegram tokens, FTP client passwords) and supports multiple exfiltration channels.

Overview

First observed in this corpus via sample 94682a961e8a (Jul 2026), though the PulsarMessagePackSerializer string also appears in sample ed94635a (earlier ingestion), suggesting the cluster predates the current analysis window. Distributed via the gcleaner dropper pipeline (OpenCTI tag dropped-by-gcleaner).

Fourth confirmed sibling (c65fd4c2, Jul 2026) upgrades to Pulsar.Client / Pulsar.Common v1.6.6.0, adds embedded ZIP payload containing the open-source defendnot Windows Defender disabler (x64 PE + DLL) and R77 rootkit stager, and switches C2 serialization to protobuf-net v3.0.0.0. Distributed under "Lulsec Roblox" game-hack masquerade. ^[/intel/analyses/c65fd4c218ee4f11072c79af6e6663c9694cf746fae75641b6b75db0ce7d555c.html]

Build Stack

  • Language: C# / .NET Framework 4.x (IL-only, no native compilation)
  • Dependency embedding: Costura.Fody compresses DLLs into .rsrc:
    • MessagePack.dll (v3.1.4.0) — C2 serialization
    • Pulsar.Common.dll (v2.4.5.0) — core RAT framework
    • System.Collections.Immutable, System.Memory, System.Buffers, System.Numerics.Vectors, System.Runtime.CompilerServices.Unsafe, System.Threading.Tasks.Extensions — modern .NET runtime dependencies
  • No packing / no obfuscation on the outer PE; inner payload uses AesxorModule (AES + XOR layered decryption)
  • No Authenticode signature
  • Debug-build attributes present (capa false-positive risk for T1620, T1059)

Capabilities

  • credential-dumping-browser-storage — Chrome, Firefox (Gecko), Yandex, CryptoTab via chrome_decrypt.dll / chrome_decrypt_lite.dll
  • credential-dumping-ftp-clients — FTPRush, FTPCommander, FTPGetter, FTPNavigator, CoreFTP
  • token-grabber-discord-telegram — TokensGrabber, TokenRestore
  • wallet-theft-chrome-gecko — GetChromeWallets, GetGeckoWallets
  • password-manager-theft-keepass — KeeFarce-based KeePass extraction
  • audio-capture-wasapi — WasapiCapture, WasapiLoopbackCapture, NAudio.WinMM
  • video-capture-webcam — VideoCaptureDevice
  • screen-capture-desktop — Screenshot + HVNC remote desktop
  • keylogging-hook-polling — Application hook + polling keylogger
  • clipboard-hijack-monitoring — Pulsar.Common.Messages.Monitoring.Clipboard
  • reflective-dll-injection — ReflectiveLoader, FindReflectiveLoader
  • process-injection-createremotethread — StealthInjector, InjectDll, InjectCrossArch
  • process-hollowing-suspended-resume — CreateProcess suspended + ResumeThread
  • named-pipe-c2-local-ipc — NamedPipeServerStream, GenerateUniquePipeName
  • messagepack-serialized-tcp-c2 — PulsarMessagePackSerializer over TCP socket
  • protobuf-net-v3-serialized-tcp-c2 — protobuf-net v3.0.0.0 serialization (observed in sibling c65fd4c2)
  • http-user-agent-proxy — HTTP client with UA and proxy configuration
  • registry-run-persistence — DoStartupItemAdd, StartupInformation
  • scheduled-task-persistence — schtasks via capa match
  • file-association-persistence — Default file association hijack
  • self-deletion-comspec — Post-execution cleanup
  • anti-debug-vm-evasion — CheckRemoteDebuggerPresent, NtQueryInformationProcess, VM string checks (Parallels/QEMU/VMware/VBox)
  • parent-pid-spoofing — PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
  • traffic-encryption-aes-xor-chacha — AesxorModule + ChaCha20Poly1305 + EncryptTraffic toggle
  • dpapi-key-unwrap — BCryptDecrypt, encrypt data using DPAPI
  • registry-remote-management — Full CRUD on remote registry
  • funstuff-prank-dos — Pulsar.Common.Messages.FunStuff (mouse swap, CD-ROM, wallpaper, monitor power-down)
  • defender-disabler-defendnot — Embedded open-source defendnot WSC manipulation (observed in sibling c65fd4c2)
  • rootkit-r77-stager — R77 (Bytecode-77) ring-3 rootkit stager with HidePrefix file/process/registry hiding (observed in sibling c65fd4c2)

TTP Summary

ATT&CK Tactic Techniques
Persistence T1547.001, T1053.005, T1546.001
Credential Access T1555.005, T1555.003, T1555
Collection T1115, T1056.001, T1113, T1123, T1213
Defense Evasion T1620, T1055.001, T1055.003, T1134.004, T1622, T1497, T1070.004, T1562.001
Discovery T1082, T1016, T1083, T1087, T1010, T1057, T1012, T1518, T1614, T1033
Execution T1129, T1047
C2 T1071 (named pipes), T1095 (MessagePack/TCP)
Exfiltration T1041 (Discord, Telegram, FTP)
Impact T1496, T1529, T1499

Variants / Aliases

  • ChromeLoader — staging/decryption module name
  • Pulsar — core RAT framework name (shared library)
  • Xorium — possibly a campaign or sub-variant name (HandleXoriumSteal, XoriumCounterData)
  • Mislabel: usfile (triage artifact from OpenCTI tag us.file)

Confirmed Siblings

SHA-256 Prefix Relationship Notes
94682a96 Primary Full analysis available
ca687401 Twin ssdeep near-match (differs by 1 char); identical build fingerprint; masquerades as wmplayer.exe (Microsoft Corporation)
ed94635a Cluster Contains PulsarMessagePackSerializer; earlier ingestion
c65fd4c2 Fourth sibling Pulsar v1.6.6.0; defendnot+R77 embedded; protobuf-net v3; Lulsec Roblox masquerade

Related Entities

  • gcleaner — Distribution pipeline (OpenCTI tag dropped-by-gcleaner)
  • asyncrat — Different .NET RAT also using MessagePack; compare to avoid false clustering
  • nanocore — Another .NET RAT with similar modular architecture
  • quasar — Open-source .NET RAT with protobuf-net C2; different serialization layer

Notable Analyses

  • /intel/analyses/94682a961e8a61b5a4b34e689de98f0a89b5e8c75bdfc493ed796c29a6b03536.html — Primary deep-dive (Adobe Acrobat masquerade)
  • /intel/analyses/ca687401049c4fae9fc3d278008361f470f79dcdc20fda5e9e4c482d2a9c7df7.html — Twin analysis (Windows Media Player masquerade)