Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects ChromElevator

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects encrypted or obfuscated .NET executables

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables manipulated with Fody

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

Quasar payload

detects Windows exceutables potentially bypassing UAC using eventvwr.exe