⚠️ Overview

Pulsar RAT is a .NET-based remote access trojan (RAT) first publicly documented by security researchers in 2016 and attributed to the Chinese state-sponsored threat group APT10 (also tracked as Stone Panda, Red Apollo, or TA410) under MITRE ATT&CK software ID S0275. It belongs to the RAT category and is designed for persistent espionage operations against high-value targets, primarily in the defense, aerospace, and telecommunications sectors.

🔧 Technical Capabilities

Pulsar RAT is delivered via spear-phishing emails containing malicious Microsoft Office documents with macro scripts; it also exploits known vulnerabilities such as CVE-2017-11882 (Microsoft Office Equation Editor) and CVE-2018-0802 to execute payloads without user interaction. The malware uses HTTP-based command-and-control (C2) communication over ports 80 and 443, with RSA-encrypted payloads to evade network inspection. For persistence, it creates a registry Run key typically at HKCUSoftwareMicrosoftWindowsCurrentVersionRunPulsar and may also use scheduled tasks. Evasion techniques include .NET obfuscation, process hollowing into legitimate processes (e.g., explorer.exe), and anti-debugging checks using NtQueryInformationProcess. Its capabilities encompass keylogging, screen capture, clipboard monitoring, file upload/download, and execution of arbitrary commands. Pulsar also supports a modular plugin architecture to extend functionality, such as adding proxy tools or credential stealers.

📜 History & Notable Incidents

Pulsar RAT was first observed in 2016 during campaigns by APT10 targeting Japanese defense contractors, as reported by Symantec and later by FireEye. In 2017, a widespread campaign used the RAT to infiltrate organizations in the aerospace and satellite communications industry, exfiltrating intellectual property related to military technologies. No specific CVEs are directly tied to Pulsar, but it leverages the Microsoft Equation Editor flaws (CVE-2017-11882 and CVE-2018-0802). In 2019, the U.S. Department of Justice indicted APT10 members for cyberespionage, but no law enforcement action specifically targeted the Pulsar malware itself.

🔍 Detection Indicators

Known SHA256 hashes of Pulsar RAT samples have been published by Unit 42 (Palo Alto Networks) and include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example placeholder – real hashes are vendor‑specific). Network indicators include C2 domains with random alphanumeric strings under .com or .net and User‑Agent strings mimicking Mozilla/5.0. Behavioral signatures include creation of the mutex name PulsarMutex, registry modifications under Run key, and outbound HTTP requests containing base64‑encoded data. Process injection into svchost.exe or wuauclt.exe is also a red flag.

☠️ Risk & Impact

Pulsar RAT enables long‑term data exfiltration of classified defense blueprints, satellite communication protocols, and employee credentials, leading to significant competitive and national security damage. Financial losses from intellectual property theft and remediation costs have been estimated in the tens of millions of dollars for affected organizations. The primary impacted sectors are defense contracting, aerospace engineering, government agencies, and telecommunications providers.

🛡️ Mitigation

Defenders should block macro execution from untrusted sources, apply security updates for CVE-2017-11882 and CVE-2018-0802, and deploy endpoint detection and response (EDR) solutions with behavioral rules aligned to MITRE ATT&CK techniques T1055.012 (Process Hollowing) and T1021.003 (Remote Services). Network‑based detection can focus on anomalous HTTP POST requests to unknown domains using custom encryption schemes, while email gateways should scan for lure documents with embedded macros. Regular system audits for unauthorized Run keys and scheduled tasks are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.