UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

1. Executive summary

Cisco Talos has disclosed a financially motivated campaign by threat actor UAT-11795 distributing trojanized installers for widely used software (MobaXterm, WebEx, Zoom, DBeaver, FACEIT) to deliver a novel Python-based "Starland RAT" and a bespoke in-memory PowerShell C2 implant tracked as "WLDR." Attribution to UAT-11795 is unconfirmed — the actor has no MITRE ATT&CK profile; the Russian-speaking designation rests on a single Russian-language developer comment in the VBScript payload. The campaign is opportunistic and volume-driven, with infections predominantly in the US but also observed in Germany, Romania, and Venezuela, engaging EMEA exposure. The attack chain features AMSI/ETW bypasses, blockchain-anchored C2 fallback via a Polygon smart contract, and deployment of secondary payloads including CastleStealer (credential and crypto-wallet theft) and Remcos RAT, posing a direct risk to financial services staff who may download trojanized IT or collaboration tooling.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: UAT-11795 has no MITRE ATT&CK profile in the verified reference data; attribution is unconfirmed. The Russian-speaking actor designation is single-sourced from Talos, based on a Russian-language developer comment ("Добавление команды в автозапуск для текущего пользователя") in the VBScript payload. All technical detail below is single-sourced from Talos research.

Attack chain

1. Initial access (ClickFix social engineering): The victim is enticed via a ClickFix technique to execute a command that downloads and executes a remotely hosted weaponized HTA file. The HTA stager is hosted on zynaris[.]io.
2. HTA execution and dropper: The HTA runs an embedded VBScript via mshta.exe that drops a Windows batch file into the user profile's temporary folder. The batch file downloads a trojanized installer from an attacker-controlled staging domain (eorthopaedics[.]com, web-devtools[.]com, or zynaris[.]io).
3. Persistence (initial): The VBScript establishes a registry Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name MyApp, pointing to mshta.exe executing the remotely hosted HTA file at every logon.
4. Trojanized installer execution: The batch file sends a notification beacon to Telegram bot "8384531459" ("skuefq_bot") confirming successful execution. The trojanized installer is built with NSIS and bundles the legitimate Python runtime pythonw.exe with a compiled Python loader disguised as LICENSE.txt. The modified NSI script executes the compiled Python loader using pythonw.exe.
5. Python loader and Starland RAT deployment: The compiled Python loader is obfuscated with junk functions performing random arithmetic and printing random strings. The actual logic is six lines implementing XOR decryption with key 198 (0xC6) to decrypt and execute the embedded Starland RAT in memory.
6. Anti-analysis (Starland RAT): Before executing, the RAT checks the logged-on username against a hardcoded sandbox account list (including WDAGUtilityAccount) and the computer name against sandbox hostnames (Cuckoo, Any.Run, Joe Sandbox, Hybrid Analysis). It also checks for a Zone.Identifier alternate data stream on the trojanized installer in the Downloads folder, confirming browser-download origin.
7. Persistence (Starland RAT): Creates a scheduled task via PowerShell New-ScheduledTask with a randomized name pattern PythonLauncher-{3 random characters}. With admin privileges, the trigger is AtLogOn with RunLevel Highest. A secondary Startup folder LNK shortcut is created via WScript.Shell COM object, targeting pythonw.exe with LICENSE.txt as argument. If not elevated, attempts UAC elevation via ShellExecuteW with the runas verb.
8. Reconnaissance: The RAT collects HWID (via Get-CimInstance -Class Win32_ComputerSystemProduct.UUID), RAM size (via wmic memorychip get Capacity), and installed AV (via Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct). For AD-joined hosts, it executes whoami && systeminfo && net user {USERNAME} /dom && nltest /dclist; for workgroup hosts, whoami /all. It captures a desktop screenshot as PNG, Base64-encodes it in memory, and deletes the PNG from disk. It enumerates 40+ cryptocurrency wallets (desktop and browser extension).
9. Data staging and exfiltration: All collected data is consolidated into a JSON file, XOR-encrypted with 5-byte key helo1, Base64-encoded, and sent to the primary C2 via HTTP POST with User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36. Before C2 registration, a Telegram notification is sent to bot "8384531459" containing the victim's public IP (sourced from api64.ipify[.]org), build name, region locale, computer name (as "Crew ID"), OS platform/release, processor string, and the hardcoded label "Windows Defender" as the protection indicator. Crypto wallet detections are appended.
10. C2 communication: The RAT polls the C2 every 50–60 seconds with a GET request containing minimal JSON with two randomly named junk fields and the bot's unique identifier, XOR-encrypted with key helo1 and Base64-encoded. The C2 responds with one of five commands: shellexecute (runs arbitrary shell via cmd /c or PowerShell), x32 (downloads and executes 32-bit shellcode via APC injection), x64 (downloads and executes 64-bit shellcode via APC injection), download (downloads payload to %TEMP% and executes by extension — EXE, MSI, DLL, ZIP), or HTTP 403 (triggers self-deletion and process exit — kill switch).
11. Blockchain-anchored C2 fallback: If primary C2 registration fails, the RAT issues an eth_call via JSON-RPC to polygon-rpc[.]com, targeting smart contract 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba and function selector 0xc659f3b8 for the latest block. The returned encrypted hex string is XOR-decrypted with key $m7*rYpry3 to recover a fallback C2 domain.
12. WLDR C2 deployment: The actor can execute a curl command via Starland RAT to download and execute the WLDR C2 PowerShell stager from a separate C2. The stager is heavily obfuscated, establishes a loop counter and two boolean flags, and XOR-decrypts an embedded WLDR downloader using a dynamically computed key.
13. WLDR downloader: Derives HWID from the C: drive volume serial number (hexadecimal to decimal), appends it to two hardcoded C2 URLs, and issues HTTP GET. The C2 responds only to pre-registered HWIDs with an encrypted JSON envelope containing Base64-encoded salt, IV, encrypted data, and authentication tag. The downloader derives a 64-byte key from hardcoded password odg5t8mvssvh and the server-provided salt, decrypts the WLDR agent, and writes the C2 URL and password into the global PowerShell scope.
14. WLDR agent execution: The in-memory PowerShell agent checks for the globally scoped C2 URL and password, initializes a mutex f2j398fj239d8j23dkkskskkkkkkkkk to prevent duplicate instances, and establishes encrypted C2 communication using AES-256-CBC with HMAC-SHA256 (encrypt-then-MAC), with session keys derived via PBKDF2-SHA256 at 5,000 iterations. Protocol version tag WSv1 is bound to every MAC computation. Initial connection via HTTP POST includes victim profile, infection identifier, protocol version 2.0.0, and cryptographic session parameters. The agent polls every 10 seconds. C2 responses contain encrypted PowerShell commands/scripts executed via a RunspacePool (up to 10 concurrent threads) with real-time output streaming, or via PowerShell background jobs as fallback.
15. Secondary payload delivery (shellcode loader): The actor delivers CastleStealer via x64 shellcode and Remcos RAT via x32 shellcode. The custom shellcode loader resolves all Windows APIs at runtime via hash-based export enumeration, neutralizes AMSI (AmsiScanBuffer in amsi.dll) and ETW (EtwEventWrite in ntdll.dll) by patching their first bytes (with a VirtualProtect fallback), decrypts and LZX-decompresses the embedded payload, and dispatches it via reflective PE injection, .NET CLR loading through ICorRuntimeHost COM interface, or PowerShell Runspace.
16. CastleStealer capabilities: .NET infostealer targeting Chromium browser family and Firefox via direct SQLite database access (DPAPI and AES-GCM decryption), crypto wallet browser extensions, Discord and Telegram session files, Steam credentials, and targeted filesystem paths. Exfiltrates via TCP socket. Includes Russian locale exclusion check and hardcoded build expiry timestamp. Supports secondary payload delivery via process injection or PowerShell execution.

Infrastructure summary

• Staging domains: eorthopaedics[.]com (likely hijacked), web-devtools[.]com, zynaris[.]io
• Starland RAT primary C2: windowscreenrepairnearme[.]com (likely hijacked), aipythondevs[.]com
• WLDR C2 / parallel infrastructure: eorthopaedics[.]com (path /feed/), sastoro[.]com (path /alpha/)
• Shellcode payload hosting: web-devtools[.]com (paths /starlandfox, /x32remka, /dopfile)
• Polygon smart contract: 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba
• Telegram bots: 8384531459 ("skuefq_bot"), 7993597060 ("komandastuk_bot")
• Telegram channel: "stuk komanda" (created June 5, 2025; 3 subscribers; structured as C2 with binary filename messages)

4. Mitigation & containment

P1 — within 24 hours

• Block the following domains at DNS/proxy/firewall: eorthopaedics[.]com, web-devtools[.]com, zynaris[.]io, sastoro[.]com, windowscreenrepairnearme[.]com, aipythondevs[.]com, polygon-rpc[.]com (assess business impact before blocking — legitimate Polygon RPC traffic may exist), api64.ipify[.]org (assess operational impact).
• Deploy EDR detection rules for: mshta.exe executing remote URLs; pythonw.exe executing with LICENSE.txt as argument; scheduled task creation matching pattern PythonLauncher-*; registry persistence at HKCU\Software\Microsoft\Windows\CurrentVersion\Run value MyApp; PowerShell New-ScheduledTask with PythonLauncher- prefix.
• Block Telegram bot API traffic to bot IDs 8384531459 and 7993597060 if egress filtering to api.telegram.org is feasible.
• Hunt for the WLDR agent mutex f2j398fj239d8j23dkkskskkkkkkkkk across endpoint memory.
• Deploy the provided ClamAV signatures (listed in §6) and Snort SIDs 66787–66790 and 301580.

P2 — within 72 hours

• Audit all software download sources for MobaXterm, WebEx, Zoom, DBeaver Community Edition, and FACEIT across the estate — verify hashes against vendor-published values and remove any installers sourced from non-official domains.
• Enable AMSI tamper detection in EDR; alert on memory patching of AmsiScanBuffer and EtwEventWrite.
• Monitor for outbound HTTP POST requests with User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 to the listed C2 domains.
• Monitor for JSON-RPC calls to Polygon RPC endpoints targeting function selector 0xc659f3b8 at contract 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba.
• Review scheduled tasks across endpoints for names matching PythonLauncher-{3 chars} and LNK files in user Startup folders targeting pythonw.exe.

P3 — within 7 days

• Implement application allow-listing for mshta.exe and restrict execution to approved paths/signers.
• Enforce software download policy: all installer executables must be sourced from vendor-verified portals with hash verification; block execution of installers from user-writable directories.
• Conduct user awareness training on ClickFix social engineering tactics (fake verification prompts enticing users to run pasted commands).
• Review and tighten egress filtering for PowerShell-based beaconing patterns: regular 10-second and 50–60 second HTTP polling intervals with encrypted payloads.
• Deploy the YARA and Sigma rules in §6 to SIEM and EDR.

5. Indicators of compromise

domain  eorthopaedics[.]com
domain  web-devtools[.]com
domain  zynaris[.]io
domain  sastoro[.]com
domain  windowscreenrepairnearme[.]com
domain  aipythondevs[.]com
domain  polygon-rpc[.]com
domain  api64.ipify[.]org
smart-contract  0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba
telegram-bot  8384531459
telegram-bot  7993597060
mutex  f2j398fj239d8j23dkkskskkkkkkkkk
registry-key  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp
filepath  LICENSE.txt
user-agent  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
url-path  /starlandfox
url-path  /x32remka
url-path  /dopfile
url-path  /feed/
url-path  /alpha/
xor-key  0xC6
xor-key  helo1
xor-key  $m7*rYpry3
password  odg5t8mvssvh
function-selector  0xc659f3b8
protocol-tag  WSv1
protocol-version  2.0.0
scheduled-task-pattern  PythonLauncher-
clamav-sig  Txt.Downloader.Agent-10060312-0
clamav-sig  Html.Downloader.Agent-10060313-0
clamav-sig  Html.Downloader.Agent-10060314-0
clamav-sig  Py.Loader.Agent-10060315-0
clamav-sig  Py.Loader.Agent-10060316-0
clamav-sig  Ps1.Trojan.Agent-10060317-0
clamav-sig  Ps1.Trojan.Agent-10060318-0
clamav-sig  Ps1.Trojan.WLDRAgent-10060319-0
clamav-sig  Ps1.Downloader.Agent-10060320-0
clamav-sig  Win.Trojan.CastleStealer-10060341-0
clamav-sig  Win.Trojan.Starland_Installer-10060342-0
clamav-sig  Win.Malware.Starland-10060343-0
clamav-sig  Win.Malware.Remka-10060344-0
snort-sid  66787
snort-sid  66788
snort-sid  66789
snort-sid  66790
snort-sid  301580

6. Detection

rule Starland_RAT_Python_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-17"
    reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/"
    description = "Detects Starland RAT Python loader disguised as LICENSE.txt"
  strings:
    $filename = "LICENSE.txt" ascii
    $runtime = "pythonw.exe" ascii
    $xor_key = { C6 }
    $api1 = "VirtualAllocEx" ascii
    $api2 = "WriteProcessMemory" ascii
    $api3 = "CreateRemoteThread" ascii
    $api4 = "VirtualProtectEx" ascii
    $api5 = "CreateProcessA" ascii
    $api6 = "QueueUserAPC" ascii
    $api7 = "ResumeThread" ascii
    $dll = "kernel32.dll" ascii
    $sandbox1 = "WDAGUtilityAccount" ascii
    $sandbox2 = "Cuckoo" ascii
    $sandbox3 = "Any.Run" ascii
    $sandbox4 = "Joe Sandbox" ascii
    $sandbox5 = "Hybrid Analysis" ascii
    $xor_data_key = "helo1" ascii
    $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" ascii
    $contract = "0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba" ascii
    $func_selector = "0xc659f3b8" ascii
    $fallback_key = "$m7*rYpry3" ascii
    $ipify = "api64.ipify" ascii
    $label = "Windows Defender" ascii
    $crew = "Crew ID" ascii
  condition:
    $filename and $runtime and ($api1 or $api2 or $api3 or $api4 or $api5 or $api6 or $api7) and $dll and ($sandbox1 or $sandbox2 or $sandbox3 or $sandbox4 or $sandbox5) and $xor_data_key
}

rule WLDR_Agent_PowerShell {
  meta:
    author = "Adverse Trace"
    date = "2026-07-17"
    reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/"
    description = "Detects WLDR C2 PowerShell agent strings"
  strings:
    $mutex = "f2j398fj239d8j23dkkskskkkkkkkkk" ascii
    $password = "odg5t8mvssvh" ascii
    $proto_tag = "WSv1" ascii
    $proto_ver = "2.0.0" ascii
    $wldr = "WLDR" ascii
  condition:
    $mutex and ($password or $proto_tag or $proto_ver) and $wldr
}

rule CastleStealer_DotNet {
  meta:
    author = "Adverse Trace"
    date = "2026-07-17"
    reference = "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/"
    description = "Detects CastleStealer .NET implant indicators"
  strings:
    $amsi = "AmsiScanBuffer" ascii
    $etw = "EtwEventWrite" ascii
    $amsi_dll = "amsi.dll" ascii
    $ntdll = "ntdll.dll" ascii
    $clr = "ICorRuntimeHost" ascii
  condition:
    ($amsi and $amsi_dll) and ($etw and $ntdll) and $clr
}

title: UAT-11795 Starland RAT Persistence and Execution
id: 7a3c1f2e-4b5d-4a8e-9c1f-0a6b3d5e8f12
status: experimental
description: Detects Starland RAT persistence mechanisms and WLDR agent mutex
author: Adverse Trace
date: 2026/07/17
references:

  - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
logsource:
  product: windows
  category: process_creation
detection:
  selection_mshta_run_key:
    EventID: 1
    Image|endswith: '\mshta.exe'
    CommandLine|contains:

      - 'http'
      - '.hta'
  selection_pythonw_license:
    EventID: 1
    Image|endswith: '\pythonw.exe'
    CommandLine|contains: 'LICENSE.txt'
  selection_scheduled_task:
    EventID: 1
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:

      - 'New-ScheduledTask'
      - 'PythonLauncher-'
  selection_run_key_myapp:
    EventID: 13
    TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyApp'
  selection_curl_wldr:
    EventID: 1
    Image|endswith: '\curl.exe'
    CommandLine|contains:

      - 'powershell'
      - '.ps1'
  condition: selection_mshta_run_key or selection_pythonw_license or selection_scheduled_task or selection_run_key_myapp or selection_curl_wldr
falsepositives:

  - Legitimate use of mshta.exe for internal HTA applications (unlikely in enterprise)
  - Python projects with a LICENSE.txt argument (rare)
level: high

title: UAT-11795 WLDR Agent Mutex Created
id: 8b4d2g3f-5c6e-4b9f-0d2g-1b7c4e6f9a23
status: experimental
description: Detects WLDR agent mutex creation indicating in-memory PowerShell C2 implant
author: Adverse Trace
date: 2026/07/17
references:

  - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
logsource:
  product: windows
  category: create_mutex
detection:
  selection:
    EventID: 17
    TargetFilename: 'f2j398fj239d8j23dkkskskkkkkkkkk'
  condition: selection
falsepositives:

  - Unknown
level: critical

7. Sources

• Cisco Talos, "UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign," https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/, 2026-07-16
• BleepingComputer, "Russian hackers trojanize WebEx, Zoom apps to push Starland malware," https://www.bleepingcomputer.com/news/security/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware/, 2026-07-16
• Cisco Talos, "Begun, the Patch Wars have," https://blog.talosintelligence.com/begun-the-patch-wars-have/, 2026-07-16

8. Adverse Trace position

This is a high-severity opportunistic campaign with direct relevance to EMEA financial services organisations. The attack chain does not require exploitation of a specific CVE — it relies on social engineering (ClickFix) and trojanized legitimate software, making patch posture irrelevant to initial compromise. The in-memory execution of both Starland RAT (Python) and WLDR agent (PowerShell), combined with AMSI/ETW bypasses and blockchain-anchored C2 fallback, makes detection challenging for signature-based controls. The targeting of IT administration utilities (MobaXterm) and database tools (DBeaver) increases the likelihood of compromise reaching privileged users with access to sensitive financial systems. Attribution to UAT-11795 is unconfirmed (no MITRE ATT&CK profile); all technical detail is single-sourced from Talos — verify IOCs before enforcement at scale. We will monitor for additional IOCs from Talos's GitHub repository, assess whether any EMEA financial services clients have observed DNS resolution of the listed C2 domains, and update this advisory if the campaign expands beyond the currently observed victimology.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.