Pulsar RAT Attacking Windows Systems via Per-user Run Registry Key and Exfiltrates Sensitive Details

Pulsar RAT is a Windows-focused remote access trojan that deploys an obfuscated batch and PowerShell-based multi-stage loader, performs in-memory Donut shellcode injection into legitimate processes (e.g., explorer.exe), and establishes persistence via per-user Run registry keys and scheduled tasks. The malware implements extensive anti-analysis controls, steals credentials, wallets, and tokens, and exfiltrates collected data over Discord and Telegram channels; observed command-and-control infrastructure includes 185.132.53.17:7800.