UAT-11795 and the Starland RAT

Full narration

1. Where the record starts

   This is UAT-11795 Starland RAT, told strictly from what the published record says — and stopping where the record stops.

   Before it starts, one thing the record does not settle. The blog names ClamAV and Snort signatures and points to a GitHub IOC repository, but no file hashes for the HTA, trojanized installers, Python loader, shellcode, CastleStealer or WLDR scripts are given in the text itself.

2. initial access

   Initial access was likely gained through a ClickFix social engineering technique that tricked the user into running a command that downloaded and executed a remotely hosted weaponized HTA file.

3. execution

   On the victim's machine, the booby-trapped HTA file is handed to Microsoft HTML Application Host — mshta.exe, a built-in Windows program that runs HTML applications as trusted code.

   That single step executes the downloader, using a tool already present on the system rather than one the attacker had to install.

4. execution

   Inside that HTA file sat a small VBScript program, and opening it set that script running.

   The script wrote a Windows batch file into the temporary folder under the user's own profile, and that batch file reached back to the staging domain to pull down and install a tampered installer.

5. execution

   The bait is an installer for real software, rebuilt with a hidden payload. Inside the package sit two extra pieces: pythonw.exe, a copy of the Python interpreter that runs without a window, and a compiled Python loader renamed LICENSE.txt so it reads as a harmless text file.

   The installer's own script was edited, so once the victim runs the setup, it quietly hands that fake license file to Python and the loader executes.

6. execution

   The loader was Python code compiled into an executable, and it carried the Starland remote access trojan hidden inside itself.

   To reveal the payload, it XOR'd every byte against a single key — the number 198 — then ran the decrypted trojan straight in the victim machine's memory.

7. execution

   Inside the victim's machine, the actor used Starland RAT — the remote access tool already installed — to run a plain Windows shell command.

   That command was curl, a built-in downloader, and it pulled PowerShell payloads for the WLDR command-and-control framework from a second control server, then ran them.

8. execution

   The x32 shellcode variant implanted a variant of Remcos RAT, a commercial remote access tool providing keylogging, screen and webcam capture, audio recording and shell execution over an encrypted channel.

9. persistence

   To survive a reboot, the script writes a value named "MyApp" into the current user's Run key in the registry — the list of programs Windows starts automatically at logon.

   That value points to mshta.exe, so every time the user signs in, Windows reaches back out and runs the remotely hosted HTA file all over again.

10. persistence

    To survive a reboot, the malware sets up two ways back in. It registers a scheduled task — a job Windows runs automatically — named PythonLauncher followed by three random characters, created through the New-ScheduledTask command.

    As a backup, it drops a shortcut file in the Startup folder, so Windows launches it at login. That shortcut points at pythonw.exe, the silent Python interpreter, and hands it LICENSE.txt as its argument.

11. privilege escalation

    If it wasn't already running with high privileges, the remote access tool asked Windows for them outright. It called the system's ShellExecuteW function with the "runas" verb — the same mechanism behind the User Account Control prompt that asks you to approve an action as administrator.

    With that elevation in hand, it upgraded its scheduled task to a higher-privilege logon trigger, so the malware would come back with more power every time the user signed in.

12. defense evasion

    Before doing anything else, the remote access tool checked who was logged on and what the machine was called.

    It matched those against built-in lists of usernames and hostnames known to belong to analysis sandboxes — and if it found itself on one, it shut down on the spot.

13. defense evasion

    The remote access trojan checked in with its command-and-control server, and the server answered with an HTTP 403 — the web code for "forbidden."

    That single response acted as a kill switch: the malware deleted its own file from disk and shut down its process.

14. defense evasion

    Two of the commands, x32 and x64, each arrived with a URL pointing to shellcode — a small block of raw executable instructions.

    The shellcode was then run inside another process using asynchronous procedure call injection, or APC injection, which queues the code to execute in a thread that already belongs to that process.

15. defense evasion

    The custom shellcode loader neutralized AMSI and ETW by patching the first bytes of AmsiScanBuffer in amsi.dll and EtwEventWrite in ntdll.dll in memory, with a VirtualProtect-based fallback.

16. credential access

    The x64 shellcode delivered a .NET infostealer called CastleStealer, whose whole job was collecting logins. It read Chromium and Firefox credentials straight out of their SQLite databases — the small local files where those browsers keep saved passwords.

    It also went after crypto wallet browser extensions, the session files that keep Discord and Telegram logged in, and Steam credentials, then pushed everything out over a plain TCP socket.

17. discovery

    Once running, Starland RAT — a remote access tool, meaning malware that gives an operator control of the machine — starts sizing up its new host.

    It queries the system with Get-CimInstance and wmic commands to pull the hardware ID, the total amount of RAM, and which antivirus product is installed.

18. discovery

    Once inside, the malware checked whether the machine belonged to a company domain — a central directory that manages user accounts and permissions across the network.

    If it did, it ran a series of built-in Windows commands to learn who the current user was, how the host was configured, which accounts existed in the domain, and which servers acted as its controllers — mapping the structure it would need to move through.

19. discovery

    Once running, the agent starts asking the machine about itself. It uses WMI — Windows Management Instrumentation, the built-in system for querying a computer's own configuration.

    The queries cover which antivirus products are installed, the network adapters, the operating system version and build, whether the machine belongs to a domain, its CPU and RAM, whether the current account has admin rights, and how User Account Control is configured.

20. collection

    The remote access tool — a program that lets an attacker operate the machine from afar — snapped a picture of the desktop and wrote it out as a PNG image file.

    It then encoded that image in memory as Base64 text, bundled with the reconnaissance data it had already gathered, and erased the PNG from disk.

21. collection

    Once inside, the remote access trojan went hunting for money. It walked the machine looking for cryptocurrency wallets — both the desktop applications and the wallet add-ons installed in browsers.

    It checked for more than forty different wallets, cataloguing whatever crypto assets the victim held.

22. command and control

    Once the tampered installer ran, the batch file — a small script of Windows commands — phoned home.

    It sent a short notification to an attacker-controlled Telegram bot, "8384531459", confirming the installation had succeeded.

23. command and control

    The remote access tool, or RAT, bundled everything it collected into a single JSON file, scrambled it with a five-byte XOR key — the word "helo1" — then wrapped the result in Base64 text so it would survive an ordinary web request.

    It pushed that bundle to its primary command-and-control server over an HTTP POST, labeling itself with a fake Chrome User-Agent so the upload looked like a browser.

24. command and control

    If the remote access trojan couldn't check in with its primary command-and-control server, it had a backup plan.

    It sent an eth_call — a read-only query in Ethereum's JSON-RPC interface — to polygon-rpc dot com, asking a smart contract for a fallback command-and-control domain, stored XOR-encrypted so it wouldn't be obvious on the blockchain.

25. command and control

    Once the malware had checked in, it settled into a rhythm: every fifty to sixty seconds it sent an encoded GET request to its command-and-control server — a routine web page request, with the real message hidden in the encoding.

    Each reply carried one of four supported commands: shellexecute, x32, x64, or download.

26. command and control

    The downloader first builds a hardware ID from the serial number of the C: drive volume, then tacks that ID onto command-and-control URLs baked into its own code.

    What comes back is a JSON envelope encrypted with AES; the downloader derives the key from a hardcoded password, "odg5t8mvssvh", unwraps it, and pulls out the WLDR agent.

27. command and control

    The WLDR agent is an in-memory PowerShell C2 client using AES-256-CBC with HMAC-SHA256 encrypted HTTPS beaconing every 10 seconds, a mutex to prevent duplicate instances, and a Runspace pool task execution engine.

28. exfiltration

    Everything the stealer collected went out over a raw TCP socket — a direct network connection opened straight to the attackers' own infrastructure.

    No staging, no waiting. The whole haul was pushed across that connection to machines the attackers controlled.

29. Where the record goes quiet

    That is the attack as the sources describe it. What they do not describe is worth saying out loud, because a confident story is easy to mistake for a complete one.

    ClickFix delivery specifics: Initial access is described only as 'potentially' or 'likely' via ClickFix; the record does not document the lure pages, ads, spam, or exact command text that led users to run mshta.exe.

    Fallback C2 domain value: The evidence states the Polygon smart contract stores an XOR-encrypted fallback C2 domain but does not disclose the recovered domain.

    WLDR C2 URLs and Remcos C2: The WLDR downloader's two hardcoded C2 URLs and the Remcos RAT's configurable C2 server address are referenced but never listed.

    Post-compromise outcome and monetization: Although the actor is described as financially motivated and targeting wallets, the record does not describe confirmed theft, victim losses, or any impact-stage activity.

    Lateral movement: Active Directory reconnaissance, domain controller listing and domain privilege enumeration are documented, but the evidence does not state that the actor moved laterally to other hosts.

    Attribution basis: Attribution to a Russian-speaking actor rests on a Russian-language developer comment and a Russian locale exclusion check; no further attribution evidence or links to named groups is provided.

30. The same map, from the defence

    Same attack, same evidence, replayed for where a modern Cisco estate would have had a shot at it. Every product named here is read from a reviewed table, and where there is no honest claim to make, that is said rather than skipped.

31. clickfix-hta · prevent

    Cisco Secure Access would have stopped this outright. The pasted command has to resolve the name hosting the weaponised HTA before it can fetch anything. A refused answer for that attacker-registered staging host means the script host gets no file to run, and the resolution attempt itself — a lookup for a freshly seen host made by a non-browser process chain seconds after a user paste — is the first record that anything happened.

32. mshta-hta-exec · prevent

    Cisco Secure Endpoint would have stopped this outright. mshta.exe starting with an http(s) URL on its command line, parented by the shell rather than by a browser or an installer. That launch shape can be blocked outright and the command line captured verbatim, giving the staging URL before the batch file is ever written.

33. trojanized-installer · mitigate

    Cisco Secure Endpoint would have caught or contained this. A packaged pythonw.exe being executed with LICENSE.txt passed as its script argument, from an installer's own extraction directory in the user profile. A file named as a licence text being handed to an interpreter as code is the observable; the process can be killed and the installer path quarantined.

34. run-key-persistence · mitigate

    Cisco Secure Endpoint would have caught or contained this. A write to HKCU\...\Run creating the value "MyApp" whose data is mshta.exe followed by a remote URL, performed by a script host rather than by an installer. The value can be removed and the writing process stopped, and the URL in the value data is a hunt indicator for other hosts.

35. telegram-beacon · no-coverage

    Here, no coverage claimed. The execution notice goes to a bot hosted on a mainstream messaging platform's API, a name that resolves for ordinary business use across the estate; refusing it would be a broad functional break, not a targeted block. The only attacker- specific detail — the bot identifier — lives in the request path, which is never visible at the name-resolution layer.

36. sandbox-checks · no-coverage

    Here, no coverage claimed. Reading the logged-on username and the computer name are ordinary API calls that thousands of benign processes make, so there is no distinguishable action to alert on or block. The termination that follows a match is the malware halting itself, not a control containing it, and claiming it as a save would credit a defence for the attacker's own logic.

37. scheduled-task-persistence · mitigate

    Cisco Secure Endpoint would have caught or contained this. Registration of a scheduled task named PythonLauncher- plus three random characters whose action is pythonw.exe with LICENSE.txt as argument, alongside a Startup-folder LNK created with the same target. Both artefacts can be deleted and the creating process isolated; the random-suffix naming pattern also generalises to other hosts.

38. uac-elevation · no-coverage

    Here, no coverage claimed. The elevation here is a local consent prompt raised by ShellExecuteW with the runas verb in the session of a user who is already logged on — there is no authentication event to step up or refuse. The record also never establishes a login performed with any harvested credential, so there is no sign-in for this capability to challenge anywhere in the map.

39. ad-recon · mitigate

    Cisco Secure Endpoint would have caught or contained this. A burst of whoami, systeminfo, net user /dom and nltest /dclist executed within seconds of each other by children of an interpreter running from a user profile directory. That command sequence with that parentage is a high-confidence signal, and the host can be isolated before the enumeration output reaches the C2.

40. c2-registration · mitigate

    Cisco Secure Access would have caught or contained this. The HTTP POST cannot leave until the primary C2 hostname resolves; refusing the answer for an attacker-controlled host keeps the encoded reconnaissance JSON on the box and leaves a dated lookup record naming the infected client. It is mitigate rather than prevent because the block depends on the host already being known bad or newly-observed under policy.

41. polygon-fallback · no-coverage

    Here, no coverage claimed. The fallback lookup is a well-formed JSON-RPC eth_call over HTTPS to a public blockchain RPC endpoint used by legitimate software, matching no exploit signature at the boundary. The fallback domain comes back XOR-encrypted inside an ordinary contract-read response, so there is nothing in the payload a boundary signature could key on.

42. amsi-etw-bypass · mitigate

    Cisco Secure Endpoint would have caught or contained this. A process remapping the first bytes of AmsiScanBuffer in amsi.dll and EtwEventWrite in ntdll.dll as writable and overwriting them, including the VirtualProtect fallback path. A sensor observing this below the patched interfaces can alert on the protection change and terminate the process, though telemetry generated after a successful patch is degraded by design.

43. castlestealer · remediate

    Cisco XDR helps clean up after this. Ties the loader, the injected .NET stealer, the SQLite reads against browser credential stores, the wallet-extension and session-file access and the outbound socket into a single incident per host instead of separate alerts. That gives responders the concrete list of which credential stores were opened, so resets can be scoped to those accounts, and per-host response actions to clean the affected machines.

44. castlestealer-exfil · mitigate

    Cisco Secure Workload would have caught or contained this. A workstation opening a raw outbound TCP session to an external address on a port that no business application uses. Policy can turn that egress path from allowed to blocked so bulk exfiltration has no route off the segment, and the attempted connection is recorded with source host and destination port.

45. curl-wldr-stager · mitigate

    Cisco Secure Endpoint would have caught or contained this. curl.exe spawned by the implant's interpreter process to fetch a remote payload, immediately followed by PowerShell executing the downloaded content. The full command line with the second C2 URL is captured, and the chain can be blocked at the curl launch before the PowerShell stage runs.

46. wldr-downloader · mitigate

    Cisco Secure Access would have caught or contained this. The downloader appends its volume-serial-derived HWID to hardcoded C2 URLs, so it must resolve those fixed hostnames; refusing them means the AES envelope containing the agent is never retrieved. The lookups also fingerprint the campaign, since the same hardcoded hosts appear on every affected machine.

47. self-delete-killswitch · no-coverage

    Here, no coverage claimed. What removed this implant was a 403 sent by the attacker's own server, reached over a connection that had to succeed. Refusing the C2 name would have withheld that response and left the RAT resident and persistent instead of deleting itself, so there is no save to claim here — blocking this path is a loss for this specific stage, even where it is right for the others.

48. What the defence pass does not claim

    The map establishes no exploited software flaw at any stage: access came from a user running a pasted command, execution used the built-in script host and a packaged interpreter, and escalation used an ordinary consent prompt. There is no missing patch anywhere in the record for this capability to rank or drive. It is the surface where policy is configured and audited, not a control that engages a stage of an attack. The script-host, run-key and scheduled-task policy it would administer is credited to the capability that actually observes and blocks those actions on the host.

    No coverage shown for a stage means this table has no reviewed claim on it — not that no defence exists.