> Family · ChromeLoader / Pulsar RAT_

~/packetpursuit $ cat /intel/families/chromeloader-pulsar-rat.md

typeentityconfidencemediumcreated2026-07-15updated2026-07-15malware-familyratinfostealerloaderdotnetc2persistencedefense-evasioncode-injectionexfiltration

ChromeLoader / Pulsar RAT

A .NET Framework-based remote-access trojan and infostealer family built around the Pulsar.Common shared library (observed versions 2.4.5.0+) and the ChromeLoader staging module. It combines modular RAT surveillance (screen, audio, keylog, HVNC remote desktop) with dedicated stealer functionality (browser credentials, crypto wallets, Discord/Telegram tokens, FTP client passwords) and supports multiple exfiltration channels.

Overview

First observed in this corpus via sample 94682a961e8a (Jul 2026), though the PulsarMessagePackSerializer string also appears in sample ed94635a (earlier ingestion), suggesting the cluster predates the current analysis window. Distributed via the gcleaner dropper pipeline (OpenCTI tag dropped-by-gcleaner).

Build Stack

  • Language: C# / .NET Framework 4.x (IL-only, no native compilation)
  • Dependency embedding: Costura.Fody compresses DLLs into .rsrc:
    • MessagePack.dll (v3.1.4.0) — C2 serialization
    • Pulsar.Common.dll (v2.4.5.0) — core RAT framework
    • System.Collections.Immutable, System.Memory, System.Buffers, System.Numerics.Vectors, System.Runtime.CompilerServices.Unsafe, System.Threading.Tasks.Extensions — modern .NET runtime dependencies
  • No packing / no obfuscation on the outer PE; inner payload uses AesxorModule (AES + XOR layered decryption)
  • No Authenticode signature
  • Debug-build attributes present (capa false-positive risk for T1620, T1059)

Capabilities

  • credential-dumping-browser-storage — Chrome, Firefox (Gecko), Yandex, CryptoTab via chrome_decrypt.dll / chrome_decrypt_lite.dll
  • credential-dumping-ftp-clients — FTPRush, FTPCommander, FTPGetter, FTPNavigator, CoreFTP
  • token-grabber-discord-telegram — TokensGrabber, TokenRestore
  • wallet-theft-chrome-gecko — GetChromeWallets, GetGeckoWallets
  • password-manager-theft-keepass — KeeFarce-based KeePass extraction
  • audio-capture-wasapi — WasapiCapture, WasapiLoopbackCapture, NAudio.WinMM
  • video-capture-webcam — VideoCaptureDevice
  • screen-capture-desktop — Screenshot + HVNC remote desktop
  • keylogging-hook-polling — Application hook + polling keylogger
  • clipboard-hijack-monitoring — Pulsar.Common.Messages.Monitoring.Clipboard
  • reflective-dll-injection — ReflectiveLoader, FindReflectiveLoader
  • process-injection-createremotethread — StealthInjector, InjectDll, InjectCrossArch
  • process-hollowing-suspended-resume — CreateProcess suspended + ResumeThread
  • named-pipe-c2-local-ipc — NamedPipeServerStream, GenerateUniquePipeName
  • messagepack-serialized-tcp-c2 — PulsarMessagePackSerializer over TCP socket
  • http-user-agent-proxy — HTTP client with UA and proxy configuration
  • registry-run-persistence — DoStartupItemAdd, StartupInformation
  • scheduled-task-persistence — schtasks via capa match
  • file-association-persistence — Default file association hijack
  • self-deletion-comspec — Post-execution cleanup
  • anti-debug-vm-evasion — CheckRemoteDebuggerPresent, NtQueryInformationProcess, VM string checks (Parallels/QEMU/VMware/VBox)
  • parent-pid-spoofing — PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
  • traffic-encryption-aes-xor-chacha — AesxorModule + ChaCha20Poly1305 + EncryptTraffic toggle
  • dpapi-key-unwrap — BCryptDecrypt, encrypt data using DPAPI
  • registry-remote-management — Full CRUD on remote registry
  • funstuff-prank-dos — Pulsar.Common.Messages.FunStuff (mouse swap, CD-ROM, wallpaper, monitor power-down)

TTP Summary

ATT&CK Tactic Techniques
Persistence T1547.001, T1053.005, T1546.001
Credential Access T1555.005, T1555.003, T1555
Collection T1115, T1056.001, T1113, T1123, T1213
Defense Evasion T1620, T1055.001, T1055.003, T1134.004, T1622, T1497, T1070.004, T1562.001
Discovery T1082, T1016, T1083, T1087, T1010, T1057, T1012, T1518, T1614, T1033
Execution T1129, T1047
C2 T1071 (named pipes), T1095 (MessagePack/TCP)
Exfiltration T1041 (Discord, Telegram, FTP)
Impact T1496, T1529, T1499

Variants / Aliases

  • ChromeLoader — staging/decryption module name
  • Pulsar — core RAT framework name (shared library)
  • Xorium — possibly a campaign or sub-variant name (HandleXoriumSteal, XoriumCounterData)
  • Mislabel: usfile (triage artifact from OpenCTI tag us.file)

Confirmed Siblings

SHA-256 Prefix Relationship Notes
94682a96 Primary Full analysis available
ca687401 Twin ssdeep near-match (differs by 1 char); identical build fingerprint
ed94635a Cluster Contains PulsarMessagePackSerializer; earlier ingestion

Related Entities

  • gcleaner — Distribution pipeline (OpenCTI tag dropped-by-gcleaner)
  • asyncrat — Different .NET RAT also using MessagePack; compare to avoid false clustering
  • nanocore — Another .NET RAT with similar modular architecture
  • quasar — Open-source .NET RAT with protobuf-net C2; different serialization layer

Notable Analyses

  • /intel/analyses/94682a961e8a61b5a4b34e689de98f0a89b5e8c75bdfc493ed796c29a6b03536.html — Primary deep-dive