starland_rat

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -1,8 +1,8 @@
 name: Detect MSHTA Url in Command Line
 id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
-version: 20
+version: 21
 creation_date: '2020-04-29'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -71,6 +71,7 @@ analytic_story:
     - XWorm
     - Cisco Network Visibility Module Analytics
     - NetSupport RMM Tool Abuse
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1218.005

detections/endpoint/domain_controller_discovery_with_nltest.yml

@@ -1,8 +1,8 @@
 name: Domain Controller Discovery with Nltest
 id: 41243735-89a7-4c83-bcdd-570aa78f00a1
-version: 13
+version: 14
 creation_date: '2021-09-01'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -57,6 +57,7 @@ analytic_story:
     - BlackSuit Ransomware
     - Rhysida Ransomware
     - NetSupport RMM Tool Abuse
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1018

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -1,8 +1,8 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
-version: 29
+version: 30
 creation_date: '2021-05-07'
-modification_date: '2026-06-25'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -139,6 +139,7 @@ analytic_story:
     - Axios Supply Chain Post Compromise
     - VIP Keylogger
     - Phantom Stealer
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1036

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -1,8 +1,8 @@
 name: Malicious PowerShell Process - Execution Policy Bypass
 id: 9be56c82-b1cc-4318-87eb-d138afaaca39
-version: 20
+version: 21
 creation_date: '2020-04-29'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Rico Valdez, Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -59,6 +59,7 @@ analytic_story:
     - APT37 Rustonotto and FadeStealer
     - BlankGrabber Stealer
     - MuddyWater
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1059.001

detections/endpoint/powershell_4104_hunting.yml

@@ -1,8 +1,8 @@
 name: PowerShell 4104 Hunting
 id: d6f2b006-0041-11ec-8885-acde48001122
-version: 27
+version: 28
 creation_date: '2021-08-19'
-modification_date: '2026-06-25'
+modification_date: '2026-07-20'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -86,6 +86,7 @@ analytic_story:
     - Axios Supply Chain Post Compromise
     - Salat Stealer
     - Phantom Stealer
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1059.001

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -1,8 +1,8 @@
 name: Recon AVProduct Through Pwh or WMI
 id: 28077620-c9f6-11eb-8785-acde48001122
-version: 15
+version: 16
 creation_date: '2021-06-14'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -62,6 +62,7 @@ analytic_story:
     - MoonPeak
     - Qakbot
     - Windows Post-Exploitation
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1592

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -1,8 +1,8 @@
 name: Registry Keys Used For Persistence
 id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
-version: 34
+version: 35
 creation_date: '2020-04-29'
-modification_date: '2026-06-25'
+modification_date: '2026-07-20'
 author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk
 status: production
 type: TTP
@@ -83,6 +83,7 @@ analytic_story:
     - Axios Supply Chain Post Compromise
     - Salat Stealer
     - Phantom Stealer
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1547.001

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -1,8 +1,8 @@
 name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
 id: c2590137-0b08-4985-9ec5-6ae23d92f63d
-version: 22
+version: 23
 creation_date: '2019-10-16'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Steven Dick, Patrick Bareiss, Splunk
 status: production
 type: TTP
@@ -40,6 +40,7 @@ analytic_story:
     - Data Destruction
     - DarkGate Malware
     - SystemBC
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1059.001

detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml

@@ -1,8 +1,8 @@
 name: Windows Boot or Logon Autostart Execution In Startup Folder
 id: 99d157cb-923f-4a00-aee9-1f385412146f
-version: 16
+version: 17
 creation_date: '2023-01-16'
-modification_date: '2026-06-25'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -50,6 +50,7 @@ analytic_story:
     - PromptFlux
     - BlankGrabber Stealer
     - Phantom Stealer
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1547.001

detections/endpoint/windows_curl_download_to_suspicious_path.yml

@@ -1,8 +1,8 @@
 name: Windows Curl Download to Suspicious Path
 id: c32f091e-30db-11ec-8738-acde48001122
-version: 21
+version: 22
 creation_date: '2021-10-19'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
@@ -103,6 +103,7 @@ analytic_story:
     - Ingress Tool Transfer
     - NPM Supply Chain Compromise
     - Salt Typhoon
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1105

detections/endpoint/windows_mshta_execution_in_registry.yml

@@ -1,8 +1,8 @@
 name: Windows Mshta Execution In Registry
 id: e13ceade-b673-4d34-adc4-4d9c01729753
-version: 12
+version: 13
 creation_date: '2022-10-14'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -52,6 +52,7 @@ intermediate_findings:
 analytic_story:
     - Suspicious Windows Registry Activities
     - Windows Persistence Techniques
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1218.005

detections/endpoint/windows_powershell_scheduletask.yml

@@ -1,8 +1,8 @@
 name: Windows PowerShell ScheduleTask
 id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc
-version: 13
+version: 14
 creation_date: '2023-06-12'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
@@ -48,6 +48,7 @@ intermediate_findings:
 analytic_story:
     - Scheduled Tasks
     - Scattered Spider
+    - Starland RAT Campaign
 asset_type: Endpoint
 atomic_guid:
     - af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd

detections/endpoint/windows_suspicious_process_file_path.yml

@@ -1,8 +1,8 @@
 name: Windows Suspicious Process File Path
 id: ecddae4e-3d4b-41e2-b3df-e46a88b38521
-version: 26
+version: 27
 creation_date: '2021-05-07'
-modification_date: '2026-06-25'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -96,6 +96,7 @@ analytic_story:
     - VIP Keylogger
     - RoguePlanet
     - Phantom Stealer
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1543

detections/endpoint/wscript_or_cscript_suspicious_child_process.yml

@@ -1,8 +1,8 @@
 name: Wscript Or Cscript Suspicious Child Process
 id: 1f35e1da-267b-11ec-90a9-acde48001122
-version: 16
+version: 17
 creation_date: '2021-10-06'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -49,6 +49,7 @@ analytic_story:
     - MuddyWater
     - Axios Supply Chain Post Compromise
     - VIP Keylogger
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1055

detections/network/windows_dns_query_request_by_telegram_bot_api.yml

@@ -1,8 +1,8 @@
 name: Windows DNS Query Request by Telegram Bot API
 id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e
-version: 11
+version: 12
 creation_date: '2021-08-03'
-modification_date: '2026-06-25'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -46,6 +46,7 @@ analytic_story:
     - BlankGrabber Stealer
     - VIP Keylogger
     - Phantom Stealer
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1071.004

detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml

@@ -1,8 +1,8 @@
 name: Windows Gather Victim Network Info Through Ip Check Web Services
 id: 70f7c952-0758-46d6-9148-d8969c4481d1
-version: 21
+version: 22
 creation_date: '2022-06-24'
-modification_date: '2026-05-13'
+modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -58,6 +58,7 @@ analytic_story:
     - Void Manticore
     - BlankGrabber Stealer
     - VIP Keylogger
+    - Starland RAT Campaign
 asset_type: Endpoint
 mitre_attack_id:
     - T1590.005

stories/starland_rat_campaign.yml

@@ -0,0 +1,18 @@
+name: Starland RAT Campaign
+id: 77049a4c-74f0-4ab3-bcb9-9995ad6c0c0f
+version: 1
+creation_date: '2026-07-20'
+modification_date: '2026-07-20'
+author: Teoderick Contreras, Splunk
+status: production
+description: UAT-11795 is a Russian-speaking, financially motivated threat actor active since at least June 2025 that deploys a novel Python-based remote access trojan named Starland RAT alongside a bespoke PowerShell C2 memory implant called WLDR Agent. The campaign uses ClickFix social engineering and trojanized software installers mimicking popular tools such as MobaXterm, WebEx, Zoom, and DBeaverCommunity to deliver a multi-stage infection chain. Starland RAT provides persistent remote access, cryptocurrency wallet enumeration, screenshot capture, and shellcode injection capabilities, while the WLDR Agent provides an encrypted, memory-resident beaconing capability with multi-threaded PowerShell execution. The actor further supports operations with CastleStealer, a .NET infostealer targeting credentials and crypto wallets, and Remcos RAT as supplemental tooling. C2 resilience is achieved through a blockchain-anchored fallback mechanism using a Polygon smart contract to store XOR-encrypted backup domains, and Telegram bots for victim notification.
+narrative: The infection chain begins when a victim is directed via ClickFix lures to execute a command that downloads and launches a weaponized HTA file through mshta.exe. The HTA file establishes an initial foothold by writing a Registry Run key for persistence and then fetches a trojanized NSIS installer from an actor-controlled staging domain. The installer drops a Python loader disguised as a LICENSE.txt file, which XOR-decrypts (key 0xC6) and reflectively executes Starland RAT entirely in memory to minimize on-disk artifacts. At startup, Starland RAT performs sandbox evasion by comparing system usernames and hostnames against known analysis environments such as WDAGUtilityAccount, Cuckoo, Any.Run, and Joe Sandbox, and verifies the presence of Zone.Identifier alternate data stream markers. It then collects extensive host reconnaissance including hardware ID derived from the C drive volume serial number, RAM capacity, installed antivirus products, Active Directory membership and domain privilege status, cryptocurrency wallet presence across more than 40 wallet types, and a Base64-encoded screenshot. This telemetry is transmitted via HTTP POST with XOR and Base64 encoding to primary C2 domains, with polling every 50 to 60 seconds. Should primary infrastructure become unavailable, the implant queries a Polygon smart contract to retrieve XOR-encrypted fallback C2 domains at runtime. Persistence is established through a randomized scheduled task named PythonLauncher followed by three characters with an AtLogOn trigger, a startup folder LNK shortcut, and the Registry Run key set during initial HTA execution. At the operator's discretion, Starland RAT deploys the WLDR Agent by executing an embedded PowerShell script that beacons to a separate set of staging domains over HTTPS using AES-256-CBC encryption with HMAC-SHA256 authentication and PBKDF2-SHA256 key derivation. WLDR runs a PowerShell RunspacePool of up to ten concurrent threads, enabling parallelized command execution with real-time output streaming and a mutex guard to prevent duplicate instances. Telegram bots are used to notify operators of new victim check-ins. The campaign primarily targets users in the United States and Europe through opportunistic, volume-driven distribution across developer tooling, IT administration, enterprise collaboration, and consumer gaming software categories, with the financial objective of credential and cryptocurrency asset theft.
+references:
+    - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
+category:
+    - Malware
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+usecase: Advanced Threat Detection