Malware

Pulsar RAT

According to Broadcom, Pulsar RAT is a derivation of Quasar RAT, which has miscellaneous functionality including keylogging, cryptocurrency wallet clipping, infostealing, file management, remote shell and command execution, among others. The data theft capabilities of this malware include collection and exfiltration of sensitive information such as credentials, cookies, cryptowallets, session files and data stored in the system web browsers, etc.

Indicators of Compromise 8

Domain luizestrelhashapr[.]online Domain volmira[.]site Domain zaviro[.]online Filename SentinelAgentCore.dll Filename SentinelMemoryScanner.exe GitHub Repo GhostChrome-X GitHub Repo Phantom Extension MD5 ndpbidppejfanjbhfgjlohfanbfbklff

MITRE ATT&CK TTPs 12

T1055
Process Injection
Defense Evasion
 T1055.012
Process Hollowing
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1071.003
Mail Protocols
Command And Control
 T1134
Access Token Manipulation
Defense Evasion
 T1134.001
Token Impersonation/Theft
Defense Evasion
 T1204
User Execution
Execution
 T1204.002
Malicious File
Execution
 T1497
Virtualization/Sandbox Evasion
Defense Evasion
 T1497.001
System Checks
Defense Evasion
 T1547
Boot or Logon Autostart Execution
Persistence
 T1547.001
Registry Run Keys / Startup Folder
Persistence

Source Articles

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
KREMLIN is a Brazilian banking malware operation active since May 2025 that targets Chromium-based browsers to steal credentials, session tokens, and sensitive data. It uses multi-stage JavaScript loaders, C++ installers, and malicious browser extensions, evading sandbox detection by checking hardware properties and process names. The malware leverages Ethereum smart contracts as dead drop resolvers to dynamically update C2 infrastructure and employs DLL sideloading via a legitimate SentinelOne binary. It installs a malicious extension named 'AVSync System Inc.' that exfiltrates browser data through WebSocket and HTTP-based polling mechanisms.
hacker-news ·2h ago