[joeflower]

no.. ok perhaps i tried on this client an older version without deinstalling. is there a chance to overwrite the old one?

[I_H8_KDot]

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.
************ Exception Text ************
System.IO.FileNotFoundException: Could not load file or assembly 'System.Runtime, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified.
File name: 'System.Runtime, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
at gngbtdakpqpkevhampq.AKFKwq5gAjwrDHB3gY5IU9Kv2G39R.OQX12JTD3MCZhyG9fg()
at gngbtdakpqpkevhampq.AKFKwq5gAjwrDHB3gY5IU9Kv2G39R.OnLoad(EventArgs e)
at System.Windows.Forms.Form.OnCreateControl()
at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)
at System.Windows.Forms.Control.CreateControl()
at System.Windows.Forms.Control.WmShowWindow(Message& m)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

WRN: Assembly binding logging is turned OFF.
To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
Note: There is some performance penalty associated with assembly bind failure logging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].


************ Loaded Assemblies ************
mscorlib
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9181.0 built by: NET481REL1LAST_C
CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v4.0.30319/mscorlib.dll
----------------------------------------
Client
Assembly Version: 1.7.4.0
Win32 Version: 1.7.4
CodeBase: file:///C:/Users/ADMIN/Desktop/Pulsar%20RAT%202.2.3/Pulsar-Client.exe
----------------------------------------
System
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9172.0 built by: NET481REL1LAST_C
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Windows.Forms
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9181.0 built by: NET481REL1LAST_C
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9037.0 built by: NET481REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System.Configuration
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9037.0 built by: NET481REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
----------------------------------------
System.Xml
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9037.0 built by: NET481REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll
----------------------------------------
Pulsar.Common
Assembly Version: 1.7.4.0
Win32 Version: 1.7.4
CodeBase: file:///C:/Users/ADMIN/Desktop/Pulsar%20RAT%202.2.3/Pulsar.Common.DLL
----------------------------------------
Accessibility
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9037.0 built by: NET481REL1
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/Accessibility/v4.0_4.0.0.0__b03f5f7f11d50a3a/Accessibility.dll
----------------------------------------
System.Core
Assembly Version: 4.0.0.0
Win32 Version: 4.8.9181.0 built by: NET481REL1LAST_C
CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
----------------------------------------
************ JIT Debugging ************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.


while running the stub.

you're running the client build in the same directory as the server. This makes it so that the client tries to use the .net core dll's which end up crashing the client. Move the client built file to it's own directory or one that doesn't have a bunch of bad dlls.

---

I tested V2.2.3 on a live Client. But this error came up:

Unbehandelte Ausnahme: System.BadImageFormatException: Die Datei oder Assembly "Pulsar.Common, Version=1.7.4.0, Culture=neutral, PublicKeyToken=null" oder eine Abhõngigkeit davon wurde nicht gefunden. Es wurde versucht, eine Datei mit einem falschen Format zu laden. ---> System.BadImageFormatException: Die Datei oder Assembly "170496 bytes loaded from Client, Version=1.7.4.0, Culture=neutral, PublicKeyToken=null" oder eine Abhõngigkeit davon wurde nicht gefunden. Es wurde versucht, eine Datei mit einem falschen Format zu laden. ---> System.BadImageFormatException: Der Vorgang konnte nicht erfolgreich abgeschlossen werden, da die Datei einen Virus oder m÷glicherweise unerw³nschte Software enthõlt. (Ausnahme von HRESULT: 0x800700E1)
--- Ende der internen Ausnahmestapel³berwachung ---
bei System.Reflection.RuntimeAssembly.nLoadImage(Byte[] rawAssembly, Byte[] rawSymbolStore, Evidence evidence, StackCrawlMark& stackMark, Boolean fIntrospection, Boolean fSkipIntegrityCheck, SecurityContextSource securityContextSource)
bei System.Reflection.Assembly.Load(Byte[] rawAssembly)
bei Costura.AssemblyLoader.ReadFromEmbeddedResources(Dictionary`2 assemblyNames, Dictionary`2 symbolNames, AssemblyName requestedAssemblyName)
bei Costura.AssemblyLoader.ResolveAssembly(Object sender, ResolveEventArgs e)
bei System.AppDomain.OnAssemblyResolveEvent(RuntimeAssembly assembly, String assemblyFullName)
--- Ende der internen Ausnahmestapel³berwachung ---
bei tsvrnwudjxvz.3ljAT5q4kzm..ctor()
bei tsvrnwudjxvz.XJ8XtTlB1Xdd1TjSQe0eJg.Main()

Why there is v1.7.4 in the log?

Because I stopped changing the assembly info versioning. Dm me on tele. t.me/KingKunta227

[asikan34]

The file manager problem has been solved with the new update. Congratulations, good luck.

[tianjack]

Guys, I want to know whose robot has an investment account? For example, Robin Hood

[DramaKing]

Guys, I want to know whose robot has an investment account? For example, Robin Hood

I could report you for attempting fraud. It's not worth it. Plus, Pulsar's stealer is broken.

[benio2]

I don't have too much time to add on code to this but since you're keeping up with it.

Feature suggestions:

-online keylogger like async rat
-clipboard updater that updates the clients clipboard either with text or a file selected
-offline clipboard logger that saves logs just like the offline keylogger
-sticky note and notepad monitor, you're able to read saved sticky note data, also find a way to grab current win11 notepad tabs and data inside them
-In Remote Execution, add remote shellcode injector using apc/process hollowing and add self injector executing in self process in new thread.
-Add option to print file with default printer in file manager
-Add preview text and images inside file manager without having to download files.
-Print capture\logger, intercepting recent prints
-Try to find things like VOIP or Cameras being hosted in the network, and list their addresses
-Add option to speak in mic, allowing the user to press a button and hold it clicked down, to talk to the Client. This was actually done in an old version of Quasar 3 or something. (https://github.com/quasar/Quasar/issues/556)
-Add active window monitor and notification just like on Async rat.
-Add file search just like Async.
-Add a universal dll injector
-Add open cd tray in fun options
-Add flip desktop upside down in fun options
-add assembly info cloner and time stomper to file manager, so server can send file info to client and update selected file assembly info on the fly
-Try to have all the code contained within c# in itself without having to call 3rd party libraries. Also don't assume the program is running from Application.Executablepath. It could be getting injected. So when its loaded with an advanced crypter, it has less vectors to get detected. With that being said, if you can create a pure c# crypto miner integrated in a new thread self process, then try to do that too.
-Add turn off/on monitor in fun options
-Add freeze monitor and use that as full screen mode.
-Add fake UAC popup to collect admin credentials(look on github there is something available)
-Disable\enabe keyboard in fun options
-Boot Record Killer in fun options
-Device State Monitoring: Tracks if the device is on battery or AC power
-Add injector to Task Manager, right click process and browse file to inject inside that process in a new thread
-Windows Phone Link monitor
-Send and play audio in background in fun options
-Add ddoser (https://github.com/liorpizman/CyberSquatting) (https://github.com/securec0ding/dotnet-d...of-service)

Bugs:
-There is a bug with the vnc, when you try to start something and it doesnt work, then all other rat features stop working, except the socket. Seems like a multi-threading issue. Eventually if the vnc resumes working, then the other features work again.
- VNC does not work with Firefox or Google Chrome.
-scroll wheel does not work on vnc.
- Explorer shows up but things are unclickable, such as right click and click an option, or clicking on any item in the taskbar
-Top of the browser/url bar is cut off, i have to readjust the size to see url bar. Also explorer buttons at the top are not there.

- the star next to account type does not star the client like its supposed to, it stays gray
-hovering over a client in the main form listview is blank, and doesnt provide any info from the bubble. would be good to add additional hardware info about the client.

[wolaikankan]

I hope to add a feature: support folder transfer, as currently only single file downloads are allowed.

[DeathPenalty666]

I hope to add a feature: support folder transfer, as currently only single file downloads are allowed.

you can silently install and run simple web server on the target pc, setup a directory specific folder to share files or the whole C: Drive and you can just open the target shared folder in your browser like http:ta.rg.e.t:1234 and you can access the whole c drive ;)

[I_H8_KDot]

I don't have too much time to add on code to this but since you're keeping up with it.

Feature suggestions:

-online keylogger like async rat
-clipboard updater that updates the clients clipboard either with text or a file selected
-offline clipboard logger that saves logs just like the offline keylogger
-sticky note and notepad monitor, you're able to read saved sticky note data, also find a way to grab current win11 notepad tabs and data inside them
-In Remote Execution, add remote shellcode injector using apc/process hollowing and add self injector executing in self process in new thread.
-Add option to print file with default printer in file manager
-Add preview text and images inside file manager without having to download files.
-Print capture\logger, intercepting recent prints
-Try to find things like VOIP or Cameras being hosted in the network, and list their addresses
-Add option to speak in mic, allowing the user to press a button and hold it clicked down, to talk to the Client. This was actually done in an old version of Quasar 3 or something. (https://github.com/quasar/Quasar/issues/556)
-Add active window monitor and notification just like on Async rat.
-Add file search just like Async.
-Add a universal dll injector
-Add open cd tray in fun options
-Add flip desktop upside down in fun options
-add assembly info cloner and time stomper to file manager, so server can send file info to client and update selected file assembly info on the fly
-Try to have all the code contained within c# in itself without having to call 3rd party libraries. Also don't assume the program is running from Application.Executablepath. It could be getting injected. So when its loaded with an advanced crypter, it has less vectors to get detected. With that being said, if you can create a pure c# crypto miner integrated in a new thread self process, then try to do that too.
-Add turn off/on monitor in fun options
-Add freeze monitor and use that as full screen mode.
-Add fake UAC popup to collect admin credentials(look on github there is something available)
-Disable\enabe keyboard in fun options
-Boot Record Killer in fun options
-Device State Monitoring: Tracks if the device is on battery or AC power
-Add injector to Task Manager, right click process and browse file to inject inside that process in a new thread
-Windows Phone Link monitor
-Send and play audio in background in fun options
-Add ddoser (https://github.com/liorpizman/CyberSquatting) (https://github.com/securec0ding/dotnet-d...of-service)

Bugs:
-There is a bug with the vnc, when you try to start something and it doesnt work, then all other rat features stop working, except the socket. Seems like a multi-threading issue. Eventually if the vnc resumes working, then the other features work again.
- VNC does not work with Firefox or Google Chrome.
-scroll wheel does not work on vnc.
- Explorer shows up but things are unclickable, such as right click and click an option, or clicking on any item in the taskbar
-Top of the browser/url bar is cut off, i have to readjust the size to see url bar. Also explorer buttons at the top are not there.

- the star next to account type does not star the client like its supposed to, it stays gray
-hovering over a client in the main form listview is blank, and doesnt provide any info from the bubble. would be good to add additional hardware info about the client.

A lot of the things you listed

1.) Online keylogger
2.) Speak in MIC
3.) Active window notifications

is already in the project and has been added. Many of your ideas I really like though and will look into.

---

I hope to add a feature: support folder transfer, as currently only single file downloads are allowed.

you can shrink the folder to a .zip and transfer that.

[starforce]

new version 2.7 is her ggo get it thenx to I_H8_KDot
https://github.com/Quasar-Continuation/Poopsar
regards starforce

[DramaKing]

new version 2.7 is her ggo get it thenx to I_H8_KDot
https://github.com/Quasar-Continuation/Poopsar
regards starforce

You mean 2.2.7.

[aerohacker]

Suggestions

- HRDP - Another Hidden Remote Desktop option
- Pivoting - Scan and infect all Windows devices connected on the same server's network

[l0verflow]

how I generate the shellcode in builder?

[benio2]

In shellcodebuilder.cs

change:
Bypass bypass = Bypass.Continue,

to:
Bypass bypass = Bypass.None,

and change:
Compress compression = Compress.None,
to
Compress compression = Compress.aPLib,

The donut amsi bypass is detected, this allows the user to generate shellcode in small size and allows them to use their own loader for bypasses

[tanyadmahoney]

I'm new to this, please i would like to learn how to use the RAT...