From 880bf0b0a9c966b91a2f3bab6be4aa78cb082c6d Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Mon, 20 Jul 2026 14:01:51 +0200 Subject: [PATCH] starland_rat --- .../detect_mshta_url_in_command_line.yml | 5 +++-- ...domain_controller_discovery_with_nltest.yml | 5 +++-- ...s_or_script_creation_in_suspicious_path.yml | 5 +++-- ...shell_process___execution_policy_bypass.yml | 5 +++-- .../endpoint/powershell_4104_hunting.yml | 5 +++-- .../recon_avproduct_through_pwh_or_wmi.yml | 5 +++-- .../registry_keys_used_for_persistence.yml | 5 +++-- ...cution_policy_to_unrestricted_or_bypass.yml | 5 +++-- ...n_autostart_execution_in_startup_folder.yml | 5 +++-- ...indows_curl_download_to_suspicious_path.yml | 5 +++-- .../windows_mshta_execution_in_registry.yml | 5 +++-- .../windows_powershell_scheduletask.yml | 5 +++-- .../windows_suspicious_process_file_path.yml | 5 +++-- ...ipt_or_cscript_suspicious_child_process.yml | 5 +++-- ...s_dns_query_request_by_telegram_bot_api.yml | 5 +++-- ...work_info_through_ip_check_web_services.yml | 5 +++-- stories/starland_rat_campaign.yml | 18 ++++++++++++++++++ 17 files changed, 66 insertions(+), 32 deletions(-) create mode 100644 stories/starland_rat_campaign.yml diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 7c6cbdb918..f497bd613a 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -1,8 +1,8 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 20 +version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: TTP @@ -71,6 +71,7 @@ analytic_story: - XWorm - Cisco Network Visibility Module Analytics - NetSupport RMM Tool Abuse + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1218.005 diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 01306e275d..5e561e1f26 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -1,8 +1,8 @@ name: Domain Controller Discovery with Nltest id: 41243735-89a7-4c83-bcdd-570aa78f00a1 -version: 13 +version: 14 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Mauricio Velazco, Splunk status: production type: TTP @@ -57,6 +57,7 @@ analytic_story: - BlackSuit Ransomware - Rhysida Ransomware - NetSupport RMM Tool Abuse + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1018 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index c14be99c02..e3e6d3cee1 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 29 +version: 30 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -139,6 +139,7 @@ analytic_story: - Axios Supply Chain Post Compromise - VIP Keylogger - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index fe19745236..2e86d5d3ab 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,8 +1,8 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: 20 +version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: Anomaly @@ -59,6 +59,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - BlankGrabber Stealer - MuddyWater + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 8428f645ad..d8fb84f944 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 27 +version: 28 creation_date: '2021-08-19' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: Hunting @@ -86,6 +86,7 @@ analytic_story: - Axios Supply Chain Post Compromise - Salat Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index f6900a54eb..ca0a2fe969 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -1,8 +1,8 @@ name: Recon AVProduct Through Pwh or WMI id: 28077620-c9f6-11eb-8785-acde48001122 -version: 15 +version: 16 creation_date: '2021-06-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -62,6 +62,7 @@ analytic_story: - MoonPeak - Qakbot - Windows Post-Exploitation + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1592 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index af50fd3916..a01367e425 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 34 +version: 35 creation_date: '2020-04-29' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -83,6 +83,7 @@ analytic_story: - Axios Supply Chain Post Compromise - Salat Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 7e197e0a76..41fe0969e9 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,8 +1,8 @@ name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 22 +version: 23 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Steven Dick, Patrick Bareiss, Splunk status: production type: TTP @@ -40,6 +40,7 @@ analytic_story: - Data Destruction - DarkGate Malware - SystemBC + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 6b3f2e9d5f..48b6050197 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 16 +version: 17 creation_date: '2023-01-16' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -50,6 +50,7 @@ analytic_story: - PromptFlux - BlankGrabber Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 1c539a33de..1a9ee0ad8d 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,8 +1,8 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: 21 +version: 22 creation_date: '2021-10-19' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -103,6 +103,7 @@ analytic_story: - Ingress Tool Transfer - NPM Supply Chain Compromise - Salt Typhoon + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index 8ccfe64198..02e4c1ad72 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -1,8 +1,8 @@ name: Windows Mshta Execution In Registry id: e13ceade-b673-4d34-adc4-4d9c01729753 -version: 12 +version: 13 creation_date: '2022-10-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -52,6 +52,7 @@ intermediate_findings: analytic_story: - Suspicious Windows Registry Activities - Windows Persistence Techniques + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1218.005 diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index edd80ba30d..dc161addef 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -1,8 +1,8 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc -version: 13 +version: 14 creation_date: '2023-06-12' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ intermediate_findings: analytic_story: - Scheduled Tasks - Scattered Spider + - Starland RAT Campaign asset_type: Endpoint atomic_guid: - af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 76832167a1..48ec64c62e 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 26 +version: 27 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -96,6 +96,7 @@ analytic_story: - VIP Keylogger - RoguePlanet - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 760f524d5f..f9153f7e79 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -1,8 +1,8 @@ name: Wscript Or Cscript Suspicious Child Process id: 1f35e1da-267b-11ec-90a9-acde48001122 -version: 16 +version: 17 creation_date: '2021-10-06' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - MuddyWater - Axios Supply Chain Post Compromise - VIP Keylogger + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1055 diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index e4a251deab..dc87224238 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 11 +version: 12 creation_date: '2021-08-03' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -46,6 +46,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1071.004 diff --git a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml index c950356414..620ecb56d8 100644 --- a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -1,8 +1,8 @@ name: Windows Gather Victim Network Info Through Ip Check Web Services id: 70f7c952-0758-46d6-9148-d8969c4481d1 -version: 21 +version: 22 creation_date: '2022-06-24' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ analytic_story: - Void Manticore - BlankGrabber Stealer - VIP Keylogger + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1590.005 diff --git a/stories/starland_rat_campaign.yml b/stories/starland_rat_campaign.yml new file mode 100644 index 0000000000..071b8eb527 --- /dev/null +++ b/stories/starland_rat_campaign.yml @@ -0,0 +1,18 @@ +name: Starland RAT Campaign +id: 77049a4c-74f0-4ab3-bcb9-9995ad6c0c0f +version: 1 +creation_date: '2026-07-20' +modification_date: '2026-07-20' +author: Teoderick Contreras, Splunk +status: production +description: UAT-11795 is a Russian-speaking, financially motivated threat actor active since at least June 2025 that deploys a novel Python-based remote access trojan named Starland RAT alongside a bespoke PowerShell C2 memory implant called WLDR Agent. The campaign uses ClickFix social engineering and trojanized software installers mimicking popular tools such as MobaXterm, WebEx, Zoom, and DBeaverCommunity to deliver a multi-stage infection chain. Starland RAT provides persistent remote access, cryptocurrency wallet enumeration, screenshot capture, and shellcode injection capabilities, while the WLDR Agent provides an encrypted, memory-resident beaconing capability with multi-threaded PowerShell execution. The actor further supports operations with CastleStealer, a .NET infostealer targeting credentials and crypto wallets, and Remcos RAT as supplemental tooling. C2 resilience is achieved through a blockchain-anchored fallback mechanism using a Polygon smart contract to store XOR-encrypted backup domains, and Telegram bots for victim notification. +narrative: The infection chain begins when a victim is directed via ClickFix lures to execute a command that downloads and launches a weaponized HTA file through mshta.exe. The HTA file establishes an initial foothold by writing a Registry Run key for persistence and then fetches a trojanized NSIS installer from an actor-controlled staging domain. The installer drops a Python loader disguised as a LICENSE.txt file, which XOR-decrypts (key 0xC6) and reflectively executes Starland RAT entirely in memory to minimize on-disk artifacts. At startup, Starland RAT performs sandbox evasion by comparing system usernames and hostnames against known analysis environments such as WDAGUtilityAccount, Cuckoo, Any.Run, and Joe Sandbox, and verifies the presence of Zone.Identifier alternate data stream markers. It then collects extensive host reconnaissance including hardware ID derived from the C drive volume serial number, RAM capacity, installed antivirus products, Active Directory membership and domain privilege status, cryptocurrency wallet presence across more than 40 wallet types, and a Base64-encoded screenshot. This telemetry is transmitted via HTTP POST with XOR and Base64 encoding to primary C2 domains, with polling every 50 to 60 seconds. Should primary infrastructure become unavailable, the implant queries a Polygon smart contract to retrieve XOR-encrypted fallback C2 domains at runtime. Persistence is established through a randomized scheduled task named PythonLauncher followed by three characters with an AtLogOn trigger, a startup folder LNK shortcut, and the Registry Run key set during initial HTA execution. At the operator's discretion, Starland RAT deploys the WLDR Agent by executing an embedded PowerShell script that beacons to a separate set of staging domains over HTTPS using AES-256-CBC encryption with HMAC-SHA256 authentication and PBKDF2-SHA256 key derivation. WLDR runs a PowerShell RunspacePool of up to ten concurrent threads, enabling parallelized command execution with real-time output streaming and a mutex guard to prevent duplicate instances. Telegram bots are used to notify operators of new victim check-ins. The campaign primarily targets users in the United States and Europe through opportunistic, volume-driven distribution across developer tooling, IT administration, enterprise collaboration, and consumer gaming software categories, with the financial objective of credential and cryptocurrency asset theft. +references: + - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection