![Yusufcancakiir's tweet photo. Came across an exposed server at 176.97.218[.]79:8080 while looking through suspicious infrastructure and ended up finding what looks like a working Pulsar RAT setup.
The open directory contains Pulsar RAT 6.0 builds and source code, along with Donut, Xen-OFCrypt and a custom loader. What caught my attention was the exposed client configuration. It points directly back to 176.97.218[.]79:4782 and has persistence, keylogging, anti-debug and UAC bypass enabled.
There is also a client debug log from August 16 showing Pulsar running under DESKTOP-FIA5RHA, with repeated errors while trying to capture remote desktop frames.
That machine could just be the operator's test box, so I wouldn't call it confirmed victim activity yet. Still, this looks like more than someone simply hosting a copy of the Pulsar source. The server appears to have been set up and actually used as a working Pulsar RAT environment.](https://pbs.twimg.com/media/HQQmWnYWwAAQdfN.png)
![Yusufcancakiir's tweet photo. Found http://103.229.53[.]84:8443 through @Huntio during a C2 hunt. The host had directory listing enabled, which exposed several PowerShell loaders along with chromelevator_x64.exe, package[.]zip, data[.]cab, and a few encoded payload variants.
The loaders use more than one delivery method. One pulls the payload directly, another retrieves an XOR-encoded /bin object and decodes it with key 42, while other variants make use of certutil and different Windows process execution methods. The decoded PE is then launched with ChromElevator's output arguments and pointed at a local output directory.
From there, the scripts look for generated browser artifacts such as cookies, passwords and tokens. Cookie data is additionally transformed into a format that can be imported back into a browser session, after which the collected output is compressed and exfiltrated through Telegram.
The interesting part is that the Telegram bot token and destination are hardcoded across the chain, which provides a useful pivot into the operator's surrounding infrastructure.](https://pbs.twimg.com/media/HQBV6FhWkAAixtF.png)
![Yusufcancakiir's tweet photo. Found http://103.229.53[.]84:8443 through @Huntio during a C2 hunt. The host had directory listing enabled, which exposed several PowerShell loaders along with chromelevator_x64.exe, package[.]zip, data[.]cab, and a few encoded payload variants.
The loaders use more than one delivery method. One pulls the payload directly, another retrieves an XOR-encoded /bin object and decodes it with key 42, while other variants make use of certutil and different Windows process execution methods. The decoded PE is then launched with ChromElevator's output arguments and pointed at a local output directory.
From there, the scripts look for generated browser artifacts such as cookies, passwords and tokens. Cookie data is additionally transformed into a format that can be imported back into a browser session, after which the collected output is compressed and exfiltrated through Telegram.
The interesting part is that the Telegram bot token and destination are hardcoded across the chain, which provides a useful pivot into the operator's surrounding infrastructure.](https://pbs.twimg.com/media/HQBV6FHWEAApZbm.png)
![skocherhan's tweet photo. ssa00[.]lat https://t.co/pXCJOwPxMB](https://pbs.twimg.com/media/HPNP2EfX0AAefhS.jpg)
Olivia
Online
beta
@uxdsec
† Security Engineer †
Joined July 2024
38 Following
7 Followers
151 Posts
@efaav @Teach2Breach @0xocdsec Sorry bro, I thought I read an email alongside the post 2 days ago with $115k payment , I will delete my post
Do you spot the bug in this code ?
New subdomain lookup tool just dropped.
https://t.co/8lD04pCf4i
Came across an exposed server at 176.97.218[.]79:8080 while looking through suspicious infrastructure and ended up finding what looks like a working Pulsar RAT setup.
The open directory contains Pulsar RAT 6.0 builds and source code, along with Donut, Xen-OFCrypt and a custom loader. What caught my attention was the exposed client configuration. It points directly back to 176.97.218[.]79:4782 and has persistence, keylogging, anti-debug and UAC bypass enabled.
There is also a client debug log from August 16 showing Pulsar running under DESKTOP-FIA5RHA, with repeated errors while trying to capture remote desktop frames.
That machine could just be the operator's test box, so I wouldn't call it confirmed victim activity yet. Still, this looks like more than someone simply hosting a copy of the Pulsar source. The server appears to have been set up and actually used as a working Pulsar RAT environment.
![Yusufcancakiir's tweet photo. Came across an exposed server at 176.97.218[.]79:8080 while looking through suspicious infrastructure and ended up finding what looks like a working Pulsar RAT setup.
The open directory contains Pulsar RAT 6.0 builds and source code, along with Donut, Xen-OFCrypt and a custom loader. What caught my attention was the exposed client configuration. It points directly back to 176.97.218[.]79:4782 and has persistence, keylogging, anti-debug and UAC bypass enabled.
There is also a client debug log from August 16 showing Pulsar running under DESKTOP-FIA5RHA, with repeated errors while trying to capture remote desktop frames.
That machine could just be the operator's test box, so I wouldn't call it confirmed victim activity yet. Still, this looks like more than someone simply hosting a copy of the Pulsar source. The server appears to have been set up and actually used as a working Pulsar RAT environment.](https://pbs.twimg.com/media/HQQmWoQXEAEz9SA.jpg)
@CharlieRAnimaMX @ivillasenor Phone numbers ain’t actually useless because people barely change numbers
Back-to-school season is here and starting today, eligible college students can get a full year of Gemini on us:
- US students: 1 year of Google AI Pro at no cost
- 140+ countries: 1 year of Google AI Plus at no cost
Here’s what’s new for students �Back-to-school season is here and starting today, eligible college students can get a full year of Gemini on us:
- US students: 1 year of Google AI Pro at no cost
- 140+ countries: 1 year of Google AI Plus at no cost
Here’s what’s new for students �Back-to-school season is here and starting today, eligible college students can get a full year of Gemini on us:
- US students: 1 year of Google AI Pro at no cost
- 140+ countries: 1 year of Google AI Plus at no cost
Here’s what’s new for students �Back-to-school season is here and starting today, eligible college students can get a full year of Gemini on us:
- US students: 1 year of Google AI Pro at no cost
- 140+ countries: 1 year of Google AI Plus at no cost
Here’s what’s new for students �Back-to-school season is here and starting today, eligible college students can get a full year of Gemini on us:
- US students: 1 year of Google AI Pro at no cost
- 140+ countries: 1 year of Google AI Plus at no cost
Here’s what’s new for students �Back-to-school season is here and starting today, eligible college students can get a full year of Gemini on us:
- US students: 1 year of Google AI Pro at no cost
- 140+ countries: 1 year of Google AI Plus at no cost
Here’s what’s new for students 👇
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.
Now you can. Enjoy!
https://t.co/WmBlShAnLr
I WAITED 8 YEARS TO RETWEET THIS
TODAY IS THE DAY
Trying to learn security research and getting overwhelmed by all the details?
I just published a guide showing my process for step-by-step analysis of a security feature: https://t.co/7k87w8DhFh
Found http://103.229.53[.]84:8443 through @Huntio during a C2 hunt. The host had directory listing enabled, which exposed several PowerShell loaders along with chromelevator_x64.exe, package[.]zip, data[.]cab, and a few encoded payload variants.
The loaders use more than one delivery method. One pulls the payload directly, another retrieves an XOR-encoded /bin object and decodes it with key 42, while other variants make use of certutil and different Windows process execution methods. The decoded PE is then launched with ChromElevator's output arguments and pointed at a local output directory.
From there, the scripts look for generated browser artifacts such as cookies, passwords and tokens. Cookie data is additionally transformed into a format that can be imported back into a browser session, after which the collected output is compressed and exfiltrated through Telegram.
The interesting part is that the Telegram bot token and destination are hardcoded across the chain, which provides a useful pivot into the operator's surrounding infrastructure.
![Yusufcancakiir's tweet photo. Found http://103.229.53[.]84:8443 through @Huntio during a C2 hunt. The host had directory listing enabled, which exposed several PowerShell loaders along with chromelevator_x64.exe, package[.]zip, data[.]cab, and a few encoded payload variants.
The loaders use more than one delivery method. One pulls the payload directly, another retrieves an XOR-encoded /bin object and decodes it with key 42, while other variants make use of certutil and different Windows process execution methods. The decoded PE is then launched with ChromElevator's output arguments and pointed at a local output directory.
From there, the scripts look for generated browser artifacts such as cookies, passwords and tokens. Cookie data is additionally transformed into a format that can be imported back into a browser session, after which the collected output is compressed and exfiltrated through Telegram.
The interesting part is that the Telegram bot token and destination are hardcoded across the chain, which provides a useful pivot into the operator's surrounding infrastructure.](https://pbs.twimg.com/media/HQBV6F5WQAAq2Wr.jpg)
This might be the most insane C Compiler I've ever seen in my life.
It turns C Code into Turing-complete single instruction assembly code with MOV only. It would be a nightmare to sift through malware compiled with this thing. @xoreaxeaxeax is so cracked.
https://t.co/y02eyiEUOn
Why all the white folks choosing G ?
You have to stay in one circle for the rest of your life. Which one are you picking?
@dammiedammie35 Call in your wife boboyiiiii 😂😂😂
they were friends before getting married.
@JoenOwek @skocherhan @OpcodeIntel @malwrhunterteam @smica83 You a security researcher and you left your server wide open to the public ?
Why not use cloudflare tunnel to hide it ?
Share it locally expose it with cloudflare to the public only who know the domain can access it
ssa00[.]lat
![skocherhan's tweet photo. ssa00[.]lat https://t.co/pXCJOwPxMB](https://pbs.twimg.com/media/HPNQB_IWoAAp4z-.jpg)
Last Seen Users on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
241.7M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.4M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.4M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers