Starland RAT & WLDR C2 Implant — UAT-11795

Trojanized software installers deliver a Python RAT, a bespoke in-memory PowerShell C2 agent, CastleStealer and Remcos RAT — credential and cryptocurrency theft against US and European targets.

Threat

UAT-11795 · Starland RAT · WLDR C2

Severity

ACTIVE CAMPAIGN

Type

Stealer / RAT / loader

Access

ClickFix → mshta → trojanized installer

Version

v0.2 · 2026-07-19

Author

HuntPack

Confidence

High (vendor-attributed, IOCs published)

Executive Summary

Cisco Talos disclosed UAT-11795 on 2026-07-16: a Russian-speaking, financially motivated actor active since at least June 2025, targeting users in the United States and Europe. The actor's objective is theft of browser credentials and cryptocurrency wallet assets, with persistent remote access retained for follow-on payload delivery.

Delivery is opportunistic and volume-driven rather than vertical-specific. The actor trojanizes installers for widely used legitimate software — MobaXterm, Cisco WebEx, Zoom, DBeaver and FaceIT — spanning developer tooling, IT administration utilities, enterprise collaboration and consumer gaming. Initial execution is likely a ClickFix social-engineering lure that runs mshta.exe against a remotely hosted weaponized HTA.

The infection chain is unusually well-suited to endpoint detection because it repeatedly crosses process-creation boundaries with distinctive artifacts: the HTA drops a batch file and writes a Run key named MyApp pointing back at mshta.exe; the NSIS installer ships a Python runtime plus a byte-compiled loader disguised as LICENSE.txt; and the RAT persists via a scheduled task named PythonLauncher-{3 random chars} plus a Startup-folder LNK. Post-compromise, Starland RAT can pull x64 shellcode (implanting CastleStealer), x32 shellcode (implanting Remcos RAT), or a Windows shell command that stages the WLDR PowerShell C2 framework, which runs entirely in memory with AES-256-CBC encrypted beaconing.

Two design choices materially raise the bar for network-only defenders. First, all C2 URLs embed a victim hardware identifier derived from the C: drive volume serial number, so C2 paths differ per host and static URL blocking degrades quickly. Second, if primary C2 registration fails, the RAT resolves a fallback domain from a Polygon smart contract via a public JSON-RPC call — infrastructure the actor can rotate without touching any DNS record you are watching. Endpoint behavioral detection is therefore the durable control, not the indicator list.

Defender priority: Hunt pythonw.exe (or python.exe) executing a command line containing LICENSE.txt. That single behavior is the campaign's most distinctive, lowest-false-positive artifact — a Python runtime being handed a licence text file as its script argument is not a legitimate pattern. Pair it with the PythonLauncher- scheduled-task name and the mshta.exe remote-HTA Run key for full initial-access-through-persistence coverage.

Source Review & Web Hunter Notes

Five sources were fetched and snapshotted verbatim to StarlandRAT-UAT11795-Hunt-sources/. Every atomic indicator shipped in this pack traces to one of those snapshots; nothing was inferred, reconstructed, or carried over from memory.

Tier	Source	Key finding	Carry forward
1 · Vendor	Cisco Talos — UAT-11795 technical report (2026-07-16)	Full infection chain, persistence mechanisms, recon commands, WLDR protocol internals, payload triage	Yes — primary basis for all queries
1 · Vendor	Cisco Talos official IOC repository (GitHub, 2026-07-16)	28 SHA256 hashes, 8 domains, 6 IPv4 addresses, 10 staging/C2 URLs	Yes — sole source of atomic indicators
2 · Press	BleepingComputer (2026-07-16)	Independent confirmation of trojanized WebEx/Zoom delivery and actor attribution	Partial — corroboration only
2 · Press	Security Affairs (2026-07-16)	Independent confirmation of campaign scope, WLDR agent, payload set	Partial — corroboration only
2 · Press	GBHackers (2026-07-16)	Confirms browser credential theft and 40+ cryptocurrency wallet targeting	Partial — corroboration only

Research notes and deliberate exclusions

Polygon contract address and Telegram bot IDs are not shipped as blockable indicators. They are published by Talos and are real, but a smart-contract address is not a Falcon-importable IOC type and the Telegram bot identifiers are actor-side artifacts. Both are carried in the Behavioral Signatures block for hunting context instead.
polygon-rpc.com and api64.ipify.org are deliberately excluded from the block list. Both are legitimate public services the malware abuses. Blocking them causes collateral damage; they are used only as weak contextual signals when paired with an unexpected parent process (Q11).
No MD5 or SHA1 values are shipped. Talos published SHA256 only. Rather than compute or infer alternative hash forms, the pack ships SHA256 exclusively — see the placeholder note in the IOC appendix.
Perishability: the six IPv4 addresses are rated medium confidence and given a shorter expiry than hashes and domains. Staging IPs in commodity hosting rotate fast and are the most likely source of future false positives.

Hunt Brief & Attack Chain

Hunt hypotheses (ordered by fidelity)

#	Hypothesis	MITRE	Telemetry	Conf
H1	A Python runtime is executing a byte-compiled loader disguised as `LICENSE.txt`	T1059.006, T1036	ProcessRollup2	HIGH
H2	A scheduled task matching `PythonLauncher-` was registered for logon persistence at highest run level	T1053.005	ScheduledTaskRegistered	HIGH
H3	An ASEP Run value points at `mshta.exe` with a remote URL argument	T1547.001, T1218.005	AsepValueUpdate	HIGH
H4	`mshta.exe` executed a remotely hosted HTA (ClickFix initial access)	T1218.005, T1204.004	ProcessRollup2	HIGH
H5	A software installer process spawned a Python runtime child	T1204.002	ProcessRollup2	HIGH
H6	A Startup-folder LNK was written targeting a Python runtime	T1547.001	FileCreateInfo	MED
H7	Chained host/domain reconnaissance ran from a single command line (`whoami`, `systeminfo`, `net user /dom`, `nltest /dclist`)	T1082, T1087.002, T1018	ProcessRollup2	HIGH
H8	AV product and physical memory enumeration via WMI/CIM immediately post-execution	T1518.001, T1082	ProcessRollup2	MED
H9	`curl.exe` retrieved a PowerShell stage from campaign infrastructure	T1105, T1059.001	ProcessRollup2	HIGH
H10	A host resolved or connected to published campaign C2 infrastructure	T1071.001	DnsRequest, NetworkConnectIP4	HIGH
H11	A non-browser process queried a public blockchain RPC endpoint (fallback C2 resolution)	T1102, T1568	DnsRequest	MED
H12	A known campaign payload hash executed or was written to disk	T1204.002	ProcessRollup2, PeFileWritten	HIGH

Attack chain

Step	Behavior	Telemetry	Hunt angle
1 · Initial access	ClickFix lure induces the user to run a command that fetches a remote HTA via `mshta.exe`	ProcessRollup2	Q1
2 · Execution	HTA runs embedded VBScript; drops a batch file into the user profile temp path	ProcessRollup2, FileCreateInfo	Q1, Q6
3 · Persistence A	`HKCU\Software\Microsoft\Windows\CurrentVersion\Run` value `MyApp` set to re-run the remote HTA at logon	AsepValueUpdate	Q2
4 · Delivery	Batch downloads and runs a trojanized NSIS installer from staging infrastructure; beacons success to a Telegram bot	ProcessRollup2, DnsRequest	Q4, Q10
5 · Loader	NSIS drops `pythonw.exe` plus a byte-compiled loader named `LICENSE.txt`; XOR key 198 decrypts Starland RAT into memory	ProcessRollup2	Q3
6 · Evasion	Username, hostname and Zone.Identifier checks against sandbox artefacts; execution aborts on match	—	GAP — no discrete event
7 · Persistence B	Scheduled task `PythonLauncher-{3 chars}`, AtLogOn, RunLevel Highest; UAC elevation attempted via runas verb	ScheduledTaskRegistered	Q5
8 · Persistence C	Startup-folder LNK created via WScript.Shell targeting `pythonw.exe LICENSE.txt`	FileCreateInfo	Q6
9 · Discovery	Memory, AV product, domain membership, DC list and privilege enumeration	ProcessRollup2	Q7, Q8
10 · Collection	Desktop screenshot staged then deleted; 40+ crypto wallets and browser stores enumerated	FileCreateInfo, FileDeleteInfo	Partial — Q12 hash sweep only
11 · C2	XOR (`helo1`) plus Base64 HTTP POST registration; GET beacon every 50–60 s with hardware-bound URL path	NetworkConnectIP4, DnsRequest	Q10
12 · Fallback C2	`eth_call` to a Polygon smart contract resolves an XOR-encrypted backup domain	DnsRequest	Q11
13 · Second stage	`curl` retrieves the WLDR PowerShell stager; agent runs in memory with AES-256-CBC beaconing	ProcessRollup2	Q9
14 · Payloads	x64 shellcode implants CastleStealer; x32 shellcode implants Remcos RAT; AMSI and ETW patched in memory	ProcessRollup2	Q12

Consolidated IOC Table

52 atomic indicators — 28 SHA256, 8 domains, 6 IPv4, 10 URLs. All published by Cisco Talos in the official IOC repository and traced to the saved source snapshot. Confidence and action vocabulary follows the pipeline standard.

Type	Value	Conf	Action	Context
SHA256	`6ca7a458985350ac082a9c9820d7f8d39128a4c4bda2f5d32f169a45b7b22bc6`	HIGH	prevent	Trojanized installer MobaXterm_v26.1.exe
SHA256	`6ae334ce60d1a9b7fb96d1d0d0eda5ec7c2c31d3f0cf3e4d7e3056504d50043d`	HIGH	prevent	Trojanized installer WebEx_Client.exe
SHA256	`1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6`	HIGH	prevent	Trojanized installer FaceitInstaller_x64.exe
SHA256	`ddcf66ecc61dc6b8cd36748d284d8cb45a470201b5373dd2bfc47700c7da32e1`	HIGH	prevent	Trojanized installer dbeaver-ce-windows-x86_64.exe
SHA256	`603fd9724de346a06e00c1b8502c2ac1180812a18bbf30032dab8d469e5c18e1`	HIGH	prevent	Trojanized installer dbeaver_ce_windows_x86_64.exe
SHA256	`f4491736743a16f1278b8ba01649ee93343764e35ae5e1c0d5e0c0e1d7e32c14`	HIGH	prevent	Trojanized installer Zoom Installer
SHA256	`2c7a99f137efd718f89cf8b260379c99af89ea1939568df09314918f2c5999a3`	HIGH	prevent	Weaponized HTA downloader stager
SHA256	`5b9bf7957a9f8869c87ace1a6d76b48e2623073e72739ad0636b5dfa4bb2e0c3`	HIGH	prevent	Weaponized HTA downloader stager
SHA256	`7dc77a5abab119960fbe42b1535c957020cce1b8e0a3cf58d4eddc51b5bf9940`	HIGH	prevent	Weaponized HTA downloader stager
SHA256	`36e3838d07978f49ebe6546d57d2f311b8d6566558bcd58448e921c988cc346a`	HIGH	prevent	Weaponized HTA downloader stager
SHA256	`575ce92c473e6d47810321e309a4e29dd7f52f4152526b0bdca80f54b53aed2f`	HIGH	prevent	Weaponized HTA downloader stager
SHA256	`964256d3259b6e0c701ec04116c45cf0ec381c1c209dc29b09a7930cd7a4810b`	HIGH	prevent	Weaponized HTA downloader stager
SHA256	`a6821c7e9bfe2e6af0f690d906ec6a26161e2198c256fb60f3b4731c317f3ad9`	HIGH	prevent	Weaponized HTA downloader stager
SHA256	`a32ac345e39cb7606322e2155bd7b4d6941c1678619e48d1f14d9301ee53e6c0`	HIGH	prevent	Batch dropper staged by HTA VBScript
SHA256	`2751281d3800d82ecd3fad7c1d2293f3b947875a343b0672b4f4024a261165d2`	HIGH	prevent	Archived plugin bundle
SHA256	`47dedb08385449d48d8b6543030310317c92cddafa25e14ee0cb9a32d53ced5c`	HIGH	prevent	Byte-compiled Python loader disguised as LICENSE.txt
SHA256	`162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca`	HIGH	prevent	Starland RAT Python implant
SHA256	`451ac8ca34d5bcdfe476465f69eb517b2608f267c7e8d69f8ef36197a6f1d949`	HIGH	prevent	WLDR PowerShell Stage-1-obfuscated-1.ps1
SHA256	`365024336c7681ac0854321ac6c140a245b9593285da02d2a590124cdc592370`	HIGH	prevent	WLDR PowerShell Stage-1-obfuscated-2.ps1
SHA256	`a080b5380ccc8fc40b24c02151d305efc32d931dc547881e01a2e6f2b070c7dc`	HIGH	prevent	WLDR PowerShell Stage-1-obfuscated-3.ps1
SHA256	`17e41d66ebfd56edc960f58f4285697ceceaa812514bb15092672c747979896e`	HIGH	prevent	WLDR PowerShell Stage-1.ps1
SHA256	`f8da52ff98e66b137b5d31908f0a5d0fa1eb446034337f8bba3d5bba60f586be`	HIGH	prevent	WLDR PowerShell Stage-2.ps1
SHA256	`d52540621dec5ed56cac8532f0e4fe10a7575c3e17e984f59646909fa587dd35`	HIGH	prevent	WLDR in-memory PowerShell C2 agent
SHA256	`a59742d3086924c5f511d248df01601bfbf723359590fb3f3ba355f2792cc455`	HIGH	prevent	WLDR PowerShell PS-Stage-3-JSON.json
SHA256	`2a27b3415114b874da295c19cce5227a8b8d9525cc2da331034a1f45528eecae`	HIGH	prevent	x64 shellcode loader for CastleStealer
SHA256	`1b46f761719dce44baa2d7b417c5214fc41c080f7f9ba485e7e489d949097f1f`	HIGH	prevent	x32 shellcode loader for Remcos RAT
SHA256	`896185a89bd7eb0520b03fdcfb8db0be98b43cf15f14041d73b23d3988c1bcab`	HIGH	prevent	CastleStealer .NET infostealer payload
SHA256	`a1835d333ac3db961a8ff1f4864e3c10a6f73a872c040599091390a009ac7804`	HIGH	prevent	Remcos RAT payload
Domain	`eorthopaedics.com`	HIGH	detect	PowerShell stage chain host and WLDR C2 under /feed/
Domain	`sastoro.com`	HIGH	detect	Parallel WLDR C2 under /alpha/
Domain	`zynaris.io`	HIGH	detect	HTA stager and trojanized installer lure host
Domain	`alphabitcapital.info`	HIGH	detect	Campaign infrastructure
Domain	`niggerdemon.in`	HIGH	detect	Campaign infrastructure
Domain	`web-devtools.com`	HIGH	detect	Raw shellcode payload staging
Domain	`aipythondevs.com`	HIGH	detect	Starland RAT primary C2
Domain	`windowscreenrepairnearme.com`	HIGH	detect	Starland RAT primary C2 (likely hijacked domain)
IPv4	`104.248.233.104`	MEDIUM	detect	Campaign C2 or staging node; re-validate before blocking
IPv4	`192.81.216.250`	MEDIUM	detect	Campaign C2 or staging node; re-validate before blocking
IPv4	`74.114.119.201`	MEDIUM	detect	Campaign C2 or staging node; re-validate before blocking
IPv4	`178.255.126.39`	MEDIUM	detect	Campaign C2 or staging node; re-validate before blocking
IPv4	`193.149.176.254`	MEDIUM	detect	Campaign C2 or staging node; re-validate before blocking
IPv4	`185.238.191.234`	MEDIUM	detect	Campaign C2 or staging node; re-validate before blocking
URL	`https://eorthopaedics.com/feed/note`	HIGH	detect	Staging or C2 URL path
URL	`https://web-devtools.com/starlandfox`	HIGH	detect	Staging or C2 URL path
URL	`https://web-devtools.com/x32remka`	HIGH	detect	Staging or C2 URL path
URL	`https://web-devtools.com/dopfile`	HIGH	detect	Staging or C2 URL path
URL	`https://web-devtools.com/file.zip`	HIGH	detect	Staging or C2 URL path
URL	`https://eorthopaedics.com/feed/cew78zwvd2/`	HIGH	detect	Staging or C2 URL path
URL	`https://eorthopaedics.com/feed/gnsmetadyx54/`	HIGH	detect	Staging or C2 URL path
URL	`https://sastoro.com/alpha/nrpilqjnut/`	HIGH	detect	Staging or C2 URL path
URL	`https://sastoro.com/alpha/dpyb8w3ycih8/`	HIGH	detect	Staging or C2 URL path
URL	`https://windowscreenrepairnearme.com/command`	HIGH	detect	Staging or C2 URL path

Perishability: C2 URL paths embed a per-victim hardware identifier, so the published URLs match only the hosts Talos observed. Treat the URL rows as pattern evidence and proxy-block the domain plus path prefix rather than the literal string. The IPv4 rows carry the shortest expiry in this pack.

Affected Surface & Telemetry Matrix

Surface	Required telemetry	Priority	Gap risk
Windows workstations (all users who install their own tooling)	ProcessRollup2, SyntheticProcessRollup2	CRITICAL	Low — standard Falcon sensor coverage
Developer and IT-admin endpoints (MobaXterm, DBeaver, WinSCP-class tooling)	ProcessRollup2, PeFileWritten	CRITICAL	Low — but these users often hold privileged credentials
Registry ASEP persistence	AsepValueUpdate, RegGenericValueUpdate	HIGH	Low
Scheduled task registration	ScheduledTaskRegistered	HIGH	Medium — verify this event is enabled in your sensor policy
Startup folder file writes	FileCreateInfo	MEDIUM	Medium — LNK writes are high volume; needs tuning
DNS and outbound network	DnsRequest, SuspiciousDnsRequest, NetworkConnectIP4	HIGH	Low
PowerShell in-memory execution (WLDR agent)	ProcessRollup2 + Script Block Logging	HIGH	HIGH — agent never touches disk; without script block logging only the `curl` stage is visible
Crypto wallet and browser credential stores	FileCreateInfo on wallet paths	MEDIUM	High — read access to browser stores is not reliably evented

ATT&CK Mapping

Tactic	Technique	Observed behavior	Query / control
Initial Access	T1204.004 — Malicious Copy and Paste	ClickFix lure induces user to run an mshta command	Q1 · user training
Execution	T1218.005 — Mshta	Remote HTA executed by `mshta.exe`	Q1 · ASR rule
Execution	T1059.005 — VBScript	HTA-embedded VBScript drops batch file	Q1, Q6
Execution	T1059.006 — Python	Byte-compiled loader run by `pythonw.exe`	Q3
Execution	T1059.001 — PowerShell	WLDR stager, downloader and in-memory agent	Q9
Execution	T1204.002 — Malicious File	Trojanized NSIS installers for legitimate software	Q4, Q12
Persistence	T1547.001 — Registry Run Keys / Startup Folder	`MyApp` Run value plus Startup LNK	Q2, Q6
Persistence	T1053.005 — Scheduled Task	`PythonLauncher-{3 chars}`, AtLogOn, RunLevel Highest	Q5
Privilege Escalation	T1548.002 — Bypass User Account Control	ShellExecuteW with the runas verb	Q5 · UAC hardening
Defense Evasion	T1036.005 — Match Legitimate Name or Location	Python loader named `LICENSE.txt`	Q3
Defense Evasion	T1562.001 — Disable or Modify Tools	AmsiScanBuffer and EtwEventWrite patched in memory	GAP · Falcon prevention policy
Defense Evasion	T1497 — Virtualization / Sandbox Evasion	Username, hostname and Zone.Identifier checks	GAP
Defense Evasion	T1055.004 — Asynchronous Procedure Call	Shellcode staged via APC injection	GAP · Falcon prevention policy
Discovery	T1082 — System Information Discovery	`systeminfo`, `wmic memorychip get Capacity`	Q7, Q8
Discovery	T1518.001 — Security Software Discovery	CIM query against root/SecurityCenter2	Q8
Discovery	T1087.002 — Domain Account Discovery	`net user {user} /dom`	Q7
Discovery	T1018 — Remote System Discovery	`nltest /dclist`	Q7
Collection	T1113 — Screen Capture	Desktop PNG staged, encoded, then deleted	Partial
Credential Access	T1555.003 — Credentials from Web Browsers	CastleStealer reads Chromium and Firefox stores	Q12
Collection	T1005 — Data from Local System	40+ desktop and extension crypto wallets enumerated	Q12
Command and Control	T1071.001 — Web Protocols	HTTP POST registration plus 50–60 s GET beacon	Q10
Command and Control	T1102 — Web Service	Telegram bot notification; Polygon contract fallback	Q11
Command and Control	T1132.001 — Standard Encoding	XOR key `helo1` plus Base64	Behavioral
Command and Control	T1573.001 — Symmetric Cryptography	WLDR AES-256-CBC with HMAC-SHA256	Behavioral
Command and Control	T1105 — Ingress Tool Transfer	`curl` retrieves WLDR stager and shellcode blobs	Q9

Native Audit-Log Hunts

Checks that do not require Falcon telemetry — run these in parallel with the CQL hunts, especially where sensor coverage is incomplete.

Windows Security 4698 (scheduled task created) — filter for task names beginning PythonLauncher-. Cross-check against your software deployment tooling; no legitimate deployment system uses that name.
Windows PowerShell 4104 (script block logging) — this is the only reliable native visibility into the WLDR in-memory agent. Search decoded blocks for RunspacePool combined with PBKDF2 or the literal protocol tag WSv1.
Sysmon Event 11 / 12-13 — file creation in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, and registry writes to the CurrentVersion\Run key with value name MyApp.
Proxy / secure web gateway logs — requests to the eight campaign domains, and any POST to a URL whose final path element is a bare hexadecimal or decimal token (the hardware identifier pattern). Also review requests carrying the exact user agent string listed in the Behavioral Signatures block.
DNS resolver logs — resolution of polygon-rpc.com from hosts with no developer or blockchain workload is a strong anomaly even though the domain itself is legitimate.
Software inventory — reconcile installed copies of MobaXterm, WebEx, Zoom, DBeaver and FaceIT against your approved-software baseline and the vendors' published installer hashes. Any copy installed from a non-vendor download path is in scope for the hash sweep.

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Q1 · mshta.exe executing a remote HTA (ClickFix initial access)

CONF HIGHFP LOWCOST LOW

Looks for: mshta.exe handed an http/https argument — the ClickFix entry point and the mechanism the MyApp Run key re-triggers at every logon. FP: a small number of legacy line-of-business apps invoke remote HTAs; baseline first and exclude by URL host, never by suppressing mshta wholesale.

// HUNT: mshta.exe executing a remotely hosted HTA
// MITRE: T1218.005, T1204.004
// CONF: high | FP: low | COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legacy internal apps that launch remote HTAs
// TUNING: exclude known-good internal hosts by adding a negated CommandLine regex
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^mshta(\.exe)?$/i
| CommandLine=/https?:/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)

Q2 · Run-key persistence pointing at mshta

CONF HIGHFP LOWCOST LOW

Looks for: an auto-start Run value whose data invokes mshta. Talos observed the value name MyApp, but the value name is trivially changed — matching on the data rather than the name is the durable form.

// HUNT: ASEP Run value invoking mshta (UAT-11795 persistence)
// MITRE: T1547.001, T1218.005
// CONF: high | FP: low | COST: low
// REQUIRES: AsepValueUpdate or RegGenericValueUpdate
// FALSE POSITIVES: rare; some vendor updaters register HTA helpers
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/CurrentVersion\\Run/i
| RegStringValue=/mshta/i
| table([ComputerName, UserName, RegObjectName, RegValueName, RegStringValue], limit=200)

Q3 · Python runtime executing LICENSE.txt (signature loader behavior)

CONF HIGHFP LOWCOST LOW

Looks for: the campaign's single most distinctive artifact — a Python interpreter given a licence text file as its script argument. This is the highest-value query in the pack. A legitimate build system never does this. Run it first and across the longest window your retention allows.

// HUNT: Python runtime executing a byte-compiled loader disguised as LICENSE.txt
// MITRE: T1059.006, T1036.005
// CONF: high | FP: low | COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: effectively none observed
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^pythonw?(\.exe)?$/i
| CommandLine=/LICENSE\.txt/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)

Q4 · Trojanized software installer spawning a Python runtime

CONF HIGHFP LOWCOST LOW

Looks for: any of the five abused installer families launching python.exe or pythonw.exe as a child. None of these products bundle or invoke a Python runtime during installation, so a hit is anomalous regardless of file hash.

// HUNT: abused installer families spawning a Python child process
// MITRE: T1204.002, T1059.006
// CONF: high | FP: low | COST: low
// REQUIRES: ProcessRollup2 with parent metadata
// FALSE POSITIVES: none expected — these installers do not ship Python
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(mobaxterm|webex_client|faceitinstaller|dbeaver|zoom)/i
| FileName=/^pythonw?(\.exe)?$/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)

Q5 · PythonLauncher scheduled-task persistence

CONF HIGHFP LOWCOST LOW

Looks for: registration of a task matching the PythonLauncher-{3 random chars} naming pattern the RAT generates. Also catches the PowerShell New-ScheduledTask command line form for environments where the task event is not collected.

// HUNT: PythonLauncher-* scheduled task registered for logon persistence
// MITRE: T1053.005, T1548.002
// CONF: high | FP: low | COST: low
// REQUIRES: ScheduledTaskRegistered (verify enabled in sensor policy)
// FALSE POSITIVES: none — no legitimate product uses this task name
#event_simpleName=/^ScheduledTaskRegistered$/
| TaskName=/PythonLauncher-/i
| table([ComputerName, UserName, TaskName, TaskExecutable], limit=200)

Q5b · New-ScheduledTask command-line fallback

CONF HIGHFP MEDCOST LOW

Looks for: PowerShell registering an AtLogOn task at highest run level that targets a Python runtime. FP: legitimate automation does register logon tasks — exclude your configuration-management service accounts and software-deployment parents before promoting this to an alert.

// HUNT: PowerShell registering a highest-privilege logon task for a Python runtime
// MITRE: T1053.005
// CONF: high | FP: medium | COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: config-management tooling registering logon tasks
// TUNING: exclude your deployment agent by ParentBaseFileName and service UserName
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/New-ScheduledTask/i
| CommandLine=/pythonw?(\.exe)?/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Q6 · Startup-folder LNK written for a Python runtime

CONF MEDFP MEDCOST LOW

Looks for: a shortcut dropped into the per-user Startup directory — the RAT's third persistence mechanism, created through the WScript.Shell COM object. FP: installers legitimately place Startup shortcuts; scope hits by correlating the writing process against Q3 and Q4 results rather than alerting on the write alone.

// HUNT: Startup folder shortcut created (UAT-11795 persistence C)
// MITRE: T1547.001
// CONF: medium | FP: medium | COST: low
// REQUIRES: FileCreateInfo
// FALSE POSITIVES: legitimate installers adding Startup shortcuts
// TUNING: exclude your software-deployment agent via ContextBaseFileName
#event_simpleName=/^FileCreateInfo$/
| TargetFileName=/Start Menu\\Programs\\Startup/i
| TargetFileName=/\.lnk$/i
| table([ComputerName, UserName, TargetFileName, ContextBaseFileName], limit=200)

Q7 · Chained host and domain reconnaissance

CONF HIGHFP LOWCOST LOW

Looks for: the exact discovery chain Starland RAT runs on domain-joined hosts. nltest /dclist paired with net user /dom in a single command line is rare outside of an operator or an implant.

// HUNT: nltest dclist plus domain user enumeration in one command line
// MITRE: T1018, T1087.002, T1082
// CONF: high | FP: low | COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: administrator troubleshooting; correlate with UserName
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/nltest/i
| CommandLine=/dclist/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Q8 · Security-product and memory enumeration via WMI/CIM

CONF MEDFP MEDCOST LOW

Looks for: the AV-product and physical-memory profiling the RAT performs before registering with C2. FP: inventory and asset-management agents query SecurityCenter2 routinely — exclude your inventory tooling by parent process, then treat residual hits as high-signal.

// HUNT: SecurityCenter2 AV enumeration or memorychip capacity profiling
// MITRE: T1518.001, T1082
// CONF: medium | FP: medium | COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: asset inventory and RMM agents
// TUNING: exclude inventory agents via ParentBaseFileName before alerting
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(SecurityCenter2|memorychip get Capacity)/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Q9 · curl retrieving a stage from campaign infrastructure

CONF HIGHFP LOWCOST LOW

Looks for: the WLDR handoff — a Windows shell command issued by Starland RAT that uses curl to pull the PowerShell stager. Matching on the campaign domains keeps this precise; the second variant below catches the generic pattern.

// HUNT: curl or PowerShell download referencing campaign staging infrastructure
// MITRE: T1105, T1059.001
// CONF: high | FP: low | COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: none — these hosts have no legitimate use
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(eorthopaedics\.com|sastoro\.com|zynaris\.io|alphabitcapital\.info|niggerdemon\.in|web-devtools\.com|aipythondevs\.com|windowscreenrepairnearme\.com)/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Q10 · Campaign C2 resolution and connection

CONF HIGHFP LOWCOST LOW

Looks for: DNS resolution of any of the eight published campaign domains. Note that two of them are assessed as hijacked legitimate domains, so a hit is meaningful but the domain may also carry benign traffic — always confirm the requesting process.

// HUNT: DNS resolution of published UAT-11795 campaign domains
// MITRE: T1071.001
// CONF: high | FP: low | COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: two domains are hijacked legitimate sites; confirm the process
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(eorthopaedics\.com|sastoro\.com|zynaris\.io|alphabitcapital\.info|niggerdemon\.in|web-devtools\.com|aipythondevs\.com|windowscreenrepairnearme\.com)$/i
| table([ComputerName, DomainName, ContextBaseFileName, ContextProcessId], limit=200)

Q10b · Campaign C2 IP connections

CONF MEDFP LOWCOST LOW

Looks for: outbound connections to the six published campaign IPv4 addresses. These are the most perishable indicators in the pack — a miss here does not clear a host.

// HUNT: outbound connection to published UAT-11795 IPv4 infrastructure
// MITRE: T1071.001
// CONF: medium | FP: low | COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: shared hosting reassignment; re-validate before blocking
#event_simpleName=/^NetworkConnectIP4$/
| in(field=RemoteAddressIP4, values=["104.248.233.104","192.81.216.250","74.114.119.201","178.255.126.39","193.149.176.254","185.238.191.234"])
| table([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=max)

Q11 · Blockchain RPC lookup from a non-developer process (fallback C2)

CONF MEDFP HIGHCOST LOW

Looks for: resolution of the public Polygon RPC endpoint, which Starland RAT queries to recover an XOR-encrypted fallback C2 domain when primary registration fails. FP: polygon-rpc.com is entirely legitimate — this is a context signal, never an alert on its own. Restrict to hosts with no blockchain or developer workload and always pivot on the requesting process, which should be a Python runtime for this campaign.

// HUNT: Polygon RPC resolution as Starland RAT fallback C2 discovery
// MITRE: T1102, T1568
// CONF: medium | FP: high | COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: legitimate blockchain development and wallet software
// TUNING: scope to non-developer OUs and pivot on ContextBaseFileName = a Python runtime
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^polygon-rpc\.com$/i
| ContextBaseFileName=/^pythonw?(\.exe)?$/i
| table([ComputerName, DomainName, ContextBaseFileName, ContextProcessId], limit=200)

Q12 · Known campaign payload hash sweep

CONF HIGHFP LOWCOST MED

Looks for: execution or on-disk write of any of the 28 published SHA256 payloads — trojanized installers, HTA stagers, the Python loader, WLDR PowerShell stages, shellcode blobs, CastleStealer and Remcos. Any hit is a confirmed compromise, not a lead.

// HUNT: published UAT-11795 payload hashes executed or written to disk
// MITRE: T1204.002, T1105
// CONF: high | FP: low | COST: medium
// REQUIRES: ProcessRollup2, PeFileWritten
// FALSE POSITIVES: none — any match is a confirmed detection
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten)$/
| in(field=SHA256HashData, values=["6ca7a458985350ac082a9c9820d7f8d39128a4c4bda2f5d32f169a45b7b22bc6","6ae334ce60d1a9b7fb96d1d0d0eda5ec7c2c31d3f0cf3e4d7e3056504d50043d","1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6","ddcf66ecc61dc6b8cd36748d284d8cb45a470201b5373dd2bfc47700c7da32e1","603fd9724de346a06e00c1b8502c2ac1180812a18bbf30032dab8d469e5c18e1","f4491736743a16f1278b8ba01649ee93343764e35ae5e1c0d5e0c0e1d7e32c14","2c7a99f137efd718f89cf8b260379c99af89ea1939568df09314918f2c5999a3","5b9bf7957a9f8869c87ace1a6d76b48e2623073e72739ad0636b5dfa4bb2e0c3","7dc77a5abab119960fbe42b1535c957020cce1b8e0a3cf58d4eddc51b5bf9940","36e3838d07978f49ebe6546d57d2f311b8d6566558bcd58448e921c988cc346a","575ce92c473e6d47810321e309a4e29dd7f52f4152526b0bdca80f54b53aed2f","964256d3259b6e0c701ec04116c45cf0ec381c1c209dc29b09a7930cd7a4810b","a6821c7e9bfe2e6af0f690d906ec6a26161e2198c256fb60f3b4731c317f3ad9","a32ac345e39cb7606322e2155bd7b4d6941c1678619e48d1f14d9301ee53e6c0","2751281d3800d82ecd3fad7c1d2293f3b947875a343b0672b4f4024a261165d2","47dedb08385449d48d8b6543030310317c92cddafa25e14ee0cb9a32d53ced5c","162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca","451ac8ca34d5bcdfe476465f69eb517b2608f267c7e8d69f8ef36197a6f1d949","365024336c7681ac0854321ac6c140a245b9593285da02d2a590124cdc592370","a080b5380ccc8fc40b24c02151d305efc32d931dc547881e01a2e6f2b070c7dc","17e41d66ebfd56edc960f58f4285697ceceaa812514bb15092672c747979896e","f8da52ff98e66b137b5d31908f0a5d0fa1eb446034337f8bba3d5bba60f586be","d52540621dec5ed56cac8532f0e4fe10a7575c3e17e984f59646909fa587dd35","a59742d3086924c5f511d248df01601bfbf723359590fb3f3ba355f2792cc455","2a27b3415114b874da295c19cce5227a8b8d9525cc2da331034a1f45528eecae","1b46f761719dce44baa2d7b417c5214fc41c080f7f9ba485e7e489d949097f1f","896185a89bd7eb0520b03fdcfb8db0be98b43cf15f14041d73b23d3988c1bcab","a1835d333ac3db961a8ff1f4864e3c10a6f73a872c040599091390a009ac7804"])
| table([ComputerName, UserName, FileName, FilePath, CommandLine, SHA256HashData], limit=max)

CrowdStrike Custom IOA Recommendations

Three queries are strong enough to promote from hunt to Custom IOA. The remainder should stay investigate-only until baselined in your environment.

IOA name	Type	Pattern	Action	Exclusions
UAT-11795 — Python runtime executing LICENSE.txt	Process Creation	Image `pythonw?\.exe` · CommandLine contains `LICENSE.txt`	Block & alert	None recommended
UAT-11795 — PythonLauncher logon task	Process Creation	CommandLine matches `New-ScheduledTask` and `PythonLauncher-`	Alert (detect)	Deployment service accounts
UAT-11795 — Installer spawning Python	Process Creation	Parent in the five abused installer families · child `pythonw?\.exe`	Alert (detect)	None — these products do not ship Python

Deployment path: Endpoint security → Custom IOA rule groups → create a Windows Process Creation group, add the three rules above in Monitor mode first. Review for one full business week — the abused installers are legitimate products your users genuinely run, so the parent-child rules need a baseline before enforcement. Promote the LICENSE.txt rule to Block first; it is the safest of the three.

Remaining queries stay investigate-only: Q1, Q2, Q6, Q7, Q8, Q9, Q10, Q10b, Q11 and Q12 either carry tunable false-positive surface or are indicator sweeps better served by the IOC Management import in section 10.

Machine-Readable IOC Appendix

Falcon IOC Management CSVbulk import

type,value,action,severity,expiration,description,tags
sha256,6ca7a458985350ac082a9c9820d7f8d39128a4c4bda2f5d32f169a45b7b22bc6,prevent,critical,2027-01-18,Trojanized installer MobaXterm_v26.1.exe,campaign:UAT-11795
sha256,6ae334ce60d1a9b7fb96d1d0d0eda5ec7c2c31d3f0cf3e4d7e3056504d50043d,prevent,critical,2027-01-18,Trojanized installer WebEx_Client.exe,campaign:UAT-11795
sha256,1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6,prevent,critical,2027-01-18,Trojanized installer FaceitInstaller_x64.exe,campaign:UAT-11795
sha256,ddcf66ecc61dc6b8cd36748d284d8cb45a470201b5373dd2bfc47700c7da32e1,prevent,critical,2027-01-18,Trojanized installer dbeaver-ce-windows-x86_64.exe,campaign:UAT-11795
sha256,603fd9724de346a06e00c1b8502c2ac1180812a18bbf30032dab8d469e5c18e1,prevent,critical,2027-01-18,Trojanized installer dbeaver_ce_windows_x86_64.exe,campaign:UAT-11795
sha256,f4491736743a16f1278b8ba01649ee93343764e35ae5e1c0d5e0c0e1d7e32c14,prevent,critical,2027-01-18,Trojanized installer Zoom Installer,campaign:UAT-11795
sha256,2c7a99f137efd718f89cf8b260379c99af89ea1939568df09314918f2c5999a3,prevent,critical,2027-01-18,Weaponized HTA downloader stager,campaign:UAT-11795
sha256,5b9bf7957a9f8869c87ace1a6d76b48e2623073e72739ad0636b5dfa4bb2e0c3,prevent,critical,2027-01-18,Weaponized HTA downloader stager,campaign:UAT-11795
sha256,7dc77a5abab119960fbe42b1535c957020cce1b8e0a3cf58d4eddc51b5bf9940,prevent,critical,2027-01-18,Weaponized HTA downloader stager,campaign:UAT-11795
sha256,36e3838d07978f49ebe6546d57d2f311b8d6566558bcd58448e921c988cc346a,prevent,critical,2027-01-18,Weaponized HTA downloader stager,campaign:UAT-11795
sha256,575ce92c473e6d47810321e309a4e29dd7f52f4152526b0bdca80f54b53aed2f,prevent,critical,2027-01-18,Weaponized HTA downloader stager,campaign:UAT-11795
sha256,964256d3259b6e0c701ec04116c45cf0ec381c1c209dc29b09a7930cd7a4810b,prevent,critical,2027-01-18,Weaponized HTA downloader stager,campaign:UAT-11795
sha256,a6821c7e9bfe2e6af0f690d906ec6a26161e2198c256fb60f3b4731c317f3ad9,prevent,critical,2027-01-18,Weaponized HTA downloader stager,campaign:UAT-11795
sha256,a32ac345e39cb7606322e2155bd7b4d6941c1678619e48d1f14d9301ee53e6c0,prevent,critical,2027-01-18,Batch dropper staged by HTA VBScript,campaign:UAT-11795
sha256,2751281d3800d82ecd3fad7c1d2293f3b947875a343b0672b4f4024a261165d2,prevent,critical,2027-01-18,Archived plugin bundle,campaign:UAT-11795
sha256,47dedb08385449d48d8b6543030310317c92cddafa25e14ee0cb9a32d53ced5c,prevent,critical,2027-01-18,Byte-compiled Python loader disguised as LICENSE.txt,campaign:UAT-11795
sha256,162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca,prevent,critical,2027-01-18,Starland RAT Python implant,campaign:UAT-11795
sha256,451ac8ca34d5bcdfe476465f69eb517b2608f267c7e8d69f8ef36197a6f1d949,prevent,critical,2027-01-18,WLDR PowerShell Stage-1-obfuscated-1.ps1,campaign:UAT-11795
sha256,365024336c7681ac0854321ac6c140a245b9593285da02d2a590124cdc592370,prevent,critical,2027-01-18,WLDR PowerShell Stage-1-obfuscated-2.ps1,campaign:UAT-11795
sha256,a080b5380ccc8fc40b24c02151d305efc32d931dc547881e01a2e6f2b070c7dc,prevent,critical,2027-01-18,WLDR PowerShell Stage-1-obfuscated-3.ps1,campaign:UAT-11795
sha256,17e41d66ebfd56edc960f58f4285697ceceaa812514bb15092672c747979896e,prevent,critical,2027-01-18,WLDR PowerShell Stage-1.ps1,campaign:UAT-11795
sha256,f8da52ff98e66b137b5d31908f0a5d0fa1eb446034337f8bba3d5bba60f586be,prevent,critical,2027-01-18,WLDR PowerShell Stage-2.ps1,campaign:UAT-11795
sha256,d52540621dec5ed56cac8532f0e4fe10a7575c3e17e984f59646909fa587dd35,prevent,critical,2027-01-18,WLDR in-memory PowerShell C2 agent,campaign:UAT-11795
sha256,a59742d3086924c5f511d248df01601bfbf723359590fb3f3ba355f2792cc455,prevent,critical,2027-01-18,WLDR PowerShell PS-Stage-3-JSON.json,campaign:UAT-11795
sha256,2a27b3415114b874da295c19cce5227a8b8d9525cc2da331034a1f45528eecae,prevent,critical,2027-01-18,x64 shellcode loader for CastleStealer,campaign:UAT-11795
sha256,1b46f761719dce44baa2d7b417c5214fc41c080f7f9ba485e7e489d949097f1f,prevent,critical,2027-01-18,x32 shellcode loader for Remcos RAT,campaign:UAT-11795
sha256,896185a89bd7eb0520b03fdcfb8db0be98b43cf15f14041d73b23d3988c1bcab,prevent,critical,2027-01-18,CastleStealer .NET infostealer payload,campaign:UAT-11795
sha256,a1835d333ac3db961a8ff1f4864e3c10a6f73a872c040599091390a009ac7804,prevent,critical,2027-01-18,Remcos RAT payload,campaign:UAT-11795
domain,eorthopaedics.com,detect,high,2027-01-18,PowerShell stage chain host and WLDR C2 under /feed/,campaign:UAT-11795
domain,sastoro.com,detect,high,2027-01-18,Parallel WLDR C2 under /alpha/,campaign:UAT-11795
domain,zynaris.io,detect,high,2027-01-18,HTA stager and trojanized installer lure host,campaign:UAT-11795
domain,alphabitcapital.info,detect,high,2027-01-18,Campaign infrastructure,campaign:UAT-11795
domain,niggerdemon.in,detect,high,2027-01-18,Campaign infrastructure,campaign:UAT-11795
domain,web-devtools.com,detect,high,2027-01-18,Raw shellcode payload staging,campaign:UAT-11795
domain,aipythondevs.com,detect,high,2027-01-18,Starland RAT primary C2,campaign:UAT-11795
domain,windowscreenrepairnearme.com,detect,high,2027-01-18,Starland RAT primary C2 (likely hijacked domain),campaign:UAT-11795
ipv4,104.248.233.104,detect,high,2026-10-18,Campaign C2 or staging node,campaign:UAT-11795
ipv4,192.81.216.250,detect,high,2026-10-18,Campaign C2 or staging node,campaign:UAT-11795
ipv4,74.114.119.201,detect,high,2026-10-18,Campaign C2 or staging node,campaign:UAT-11795
ipv4,178.255.126.39,detect,high,2026-10-18,Campaign C2 or staging node,campaign:UAT-11795
ipv4,193.149.176.254,detect,high,2026-10-18,Campaign C2 or staging node,campaign:UAT-11795
ipv4,185.238.191.234,detect,high,2026-10-18,Campaign C2 or staging node,campaign:UAT-11795
url,https://eorthopaedics.com/feed/note,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://web-devtools.com/starlandfox,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://web-devtools.com/x32remka,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://web-devtools.com/dopfile,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://web-devtools.com/file.zip,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://eorthopaedics.com/feed/cew78zwvd2/,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://eorthopaedics.com/feed/gnsmetadyx54/,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://sastoro.com/alpha/nrpilqjnut/,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://sastoro.com/alpha/dpyb8w3ycih8/,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795
url,https://windowscreenrepairnearme.com/command,detect,high,2026-10-18,Staging or C2 URL path,campaign:UAT-11795

Behavioral Signaturesnot importable — hunt these

# UAT-11795 behavioral signatures (no atomic IOC form)
# Loader / persistence
pythonw.exe executing an argument named LICENSE.txt
Scheduled task name pattern: PythonLauncher-{3 random chars}
Run key value name: MyApp -> mshta.exe with a remote URL
Startup LNK targeting a Python runtime with LICENSE.txt argument
# Starland RAT runtime
XOR key for C2 payload encoding: helo1
XOR key for the packaged Python loader: 198 (0xC6)
Beacon interval: GET every 50-60 seconds
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Sandbox evasion: aborts on WDAGUtilityAccount and on Cuckoo / Any.Run / Joe Sandbox / Hybrid Analysis hostnames
Public IP lookup service abused: api64.ipify.org (legitimate - do not block)
# Fallback C2 resolution (legitimate infrastructure - context only)
Polygon JSON-RPC endpoint: polygon-rpc.com
Polygon contract: 0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba
Contract function selector: 0xc659f3b8
Fallback domain XOR key: $m7*rYpry3
# WLDR PowerShell C2 agent (in-memory only)
Mutex: f2j398fj239d8j23dkkskskkkkkkkkk
Session password (hardcoded): odg5t8mvssvh
Protocol version tag bound to every MAC: WSv1
Crypto: AES-256-CBC + HMAC-SHA256, PBKDF2-SHA256 at 5000 iterations
Beacon interval: poll every 10 seconds; reconnect retry at 30 seconds
Headers mimic a Chrome 124 browser session
# Actor-side artifacts (reporting context, not blockable)
Telegram bots: 8384531459 (skuefq_bot), 7993597060 (komandastuk_bot)
Telegram channel: stuk komanda (created 2025-06-05)

Staging & C2 URLsproxy / SWG blocklist

https://eorthopaedics.com/feed/note
https://web-devtools.com/starlandfox
https://web-devtools.com/x32remka
https://web-devtools.com/dopfile
https://web-devtools.com/file.zip
https://eorthopaedics.com/feed/cew78zwvd2/
https://eorthopaedics.com/feed/gnsmetadyx54/
https://sastoro.com/alpha/nrpilqjnut/
https://sastoro.com/alpha/dpyb8w3ycih8/
https://windowscreenrepairnearme.com/command

Named Malware & Toolingtriage vocabulary

Actor:      UAT-11795 (Russian-speaking, financially motivated)
Loader:     Byte-compiled Python loader (shipped as LICENSE.txt)
RAT:        Starland RAT (Python, in-memory)
C2 agent:   WLDR agent / WLDR C2 framework (PowerShell, in-memory)
Stealer:    CastleStealer (.NET)
RAT:        Remcos RAT (commercial, x32 shellcode path)
Installers abused: MobaXterm, Cisco WebEx, Zoom, DBeaver, FaceIT
Packaging:  NSIS (Nullsoft Scriptable Install System)
Talos ClamAV: Win.Trojan.Starland_Installer-10060342-0
              Win.Malware.Starland-10060343-0
              Win.Malware.Remka-10060344-0
Talos Snort SIDs: 66787-66790, 301580

Alternate Hash Formsplaceholders — not published

# Talos published SHA256 only for this campaign.
# MD5 and SHA1 are NOT shipped here because no cited source contains them.
# Populate from your own sample detonation or VirusTotal lookup before use.
md5,REPLACE_WITH_MD5,detect,high,2027-01-18,Starland RAT sample,campaign:UAT-11795
sha1,REPLACE_WITH_SHA1,detect,high,2027-01-18,Starland RAT sample,campaign:UAT-11795
# Do not invent or derive these values. An unsourced hash is not an indicator.

Import note: Falcon IOC Management natively accepts sha256, md5, sha1, domain, ipv4 and ipv6. The url rows in the CSV are included for completeness and provenance, but should be routed to your proxy or secure web gateway rather than the Falcon IOC importer — the dedicated URL block above is formatted for that.

Detection Validation Gates

Gate 1 — Telemetry ready

Confirm ScheduledTaskRegistered events are present in your tenant for the last 7 days. If the count is zero, Q5 is silently blind and Q5b becomes your only task-persistence coverage.
Confirm AsepValueUpdate is populated; if your sensor policy only emits RegGenericValueUpdate, Q2 still works but volume rises.
Confirm PowerShell Script Block Logging is forwarding. Without it the WLDR agent is invisible after the curl stage.

Gate 2 — Benign baseline

Run Q1, Q6, Q8 and Q5b over 7 days with no exclusions and record hit counts. Anything over roughly 20 hits/day per 1,000 endpoints needs tuning before promotion.
Q3 and Q4 should return zero in a clean environment. A non-zero baseline is itself a finding — investigate before assuming false positives.

Gate 3 — Positive tests

In an isolated VM, run pythonw.exe LICENSE.txt against a harmless script renamed to LICENSE.txt and confirm Q3 fires.
Register a task named PythonLauncher-abc and confirm Q5 fires; delete it afterwards.
Write a benign Run value invoking mshta https://example.com/test.hta and confirm Q2 fires; remove it afterwards.

Gate 4 — Promotion criteria

Promote to Custom IOA only after 7 days at zero unexplained hits. Start in Monitor mode, then Block for the LICENSE.txt rule.
Re-validate the six IPv4 indicators before any network block — they carry the shortest expiry and the highest reassignment risk in this pack.

Hardening — Tiered

Immediate — deploy this week

Block mshta.exe execution for standard users (MITRE M1042 · CIS Windows Benchmark application-control guidance). This severs the campaign's initial-access and re-persistence path in one control. Deploy via WDAC or AppLocker deny rules; mshta.exe has essentially no modern business use on a workstation.
Enable the ASR rule "Block JavaScript or VBScript from launching downloaded executable content" and "Block executable content from email client and webmail" (MITRE M1038 · Microsoft Security Baseline). The HTA-to-batch-to-installer hop is exactly this pattern.
Import the section 10 CSV into Falcon IOC Management — hashes at prevent, domains at detect. Route the URL rows to your proxy instead.
Hunt Q3 across your full retention window immediately. It is zero-false-positive and retrospective; run it before any hardening lands.

Near term — 1 to 4 weeks

Enforce PowerShell Constrained Language Mode for non-administrators (MITRE M1038 · CIS Benchmark). The WLDR agent depends on RunspacePool and .NET reflection; constrained language mode breaks the in-memory agent even after the loader runs.
Enable PowerShell Script Block Logging and module logging fleet-wide (MITRE M1047 · Microsoft Security Baseline). This closes the largest telemetry gap in section 5 and is a prerequisite for detecting the WLDR agent at all.
Set UAC to "Always notify" and disable the auto-elevation path for standard users (MITRE M1052 · CIS Benchmark). The RAT escalates its scheduled task via a runas ShellExecuteW call that a prompting UAC configuration interrupts.
Deploy application control for installer provenance — allow the five abused products only from vendor-signed installers, matched by publisher certificate rather than file name. The trojanized copies keep the legitimate product name.
Restrict outbound access to a proxy with TLS inspection and category-based blocking (MITRE M1037). The campaign uses HTTP POST to freshly registered and hijacked domains; an authenticated egress proxy denies the unproxied direct-connect path entirely.

Strategic — 1 to 3 months

Remove local administrator rights from developer and IT-admin endpoints (MITRE M1026 · CIS Benchmark). This population is the campaign's highest-value target — they install their own tooling and hold privileged credentials. Pair with a managed software portal so the legitimate need that ClickFix exploits disappears.
Stand up a curated internal software repository for MobaXterm, DBeaver, WebEx, Zoom and similar tools, with hash-pinned vendor artifacts. The root cause here is users sourcing installers from search results.
Deploy phishing-resistant MFA and hardware-bound session tokens (MITRE M1032). The campaign's objective is credential theft; FIDO2 with token binding makes stolen browser credentials substantially less useful.
Establish a cryptocurrency-wallet policy for corporate endpoints — if wallets have no business purpose, block the 40+ wallet extension IDs at the browser-management layer. ⚠ best-practice, no formal benchmark

Deployable Playbooks

1 — Block mshta.exe for standard users (AppLocker deny rule)

<!-- Import: Group Policy -> Windows Settings -> Security Settings -> Application Control Policies -> AppLocker -> Executable Rules -->
<!-- PREREQUISITE: the Application Identity service (AppIDSvc) must be Running and set to
     Automatic, or AppLocker does not evaluate any rule. Set it via GPO, not per-host. -->
<!-- SHIPS AS AuditOnly ON PURPOSE. AppLocker is default-deny: a rule collection that
     contains ANY rule permits only explicitly allowed files. The three Allow rules below
     are Microsoft's mandatory defaults and MUST stay, or enforcing this policy blocks
     every executable on the machine -- including your RMM agent. Run AuditOnly for at
     least a week, review AppLocker EventID 8003 (would-have-blocked) in
     Microsoft-Windows-AppLocker/EXE and DLL, then flip to Enabled. -->
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">

  <!-- Default allow rules -- do not remove -->
  <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default) All files in Program Files"
                Description="Allows members of the Everyone group to run applications in Program Files."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%PROGRAMFILES%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default) All files in Windows"
                Description="Allows members of the Everyone group to run applications in the Windows folder."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%WINDIR%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default) All files -- Administrators"
                Description="Allows members of the local Administrators group to run all applications."
                UserOrGroupSid="S-1-5-32-544" Action="Allow">
    <Conditions><FilePathCondition Path="*" /></Conditions>
  </FilePathRule>

  <!-- The UAT-11795 control. Scoped to BUILTIN\Users (S-1-5-32-545), NOT Everyone:
       AppLocker deny beats allow, so a deny on Everyone would also lock out admins
       and remove your own recovery path. No <Exceptions> block -- a wildcard
       FilePublisherCondition matches every signed binary, and mshta.exe is
       Microsoft-signed, so it would cancel this very rule. -->
  <FilePathRule Id="9f1c2b70-4e0a-4a5e-9d3b-0f2a6c8e1d44"
                Name="Deny mshta.exe for standard users"
                Description="UAT-11795 initial access and Run-key re-persistence path"
                UserOrGroupSid="S-1-5-32-545" Action="Deny">
    <Conditions>
      <FilePathCondition Path="%WINDIR%\System32\mshta.exe" />
      <FilePathCondition Path="%WINDIR%\SysWOW64\mshta.exe" />
    </Conditions>
  </FilePathRule>
</RuleCollection>

Prerequisites: AppIDSvc Running/Automatic (GPO); a pilot OU; one week of AuditOnly data. Reboot required: no, but AppLocker only re-evaluates on policy refresh (gpupdate /force).

Verify (after AuditOnly week): in Event Viewer, Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL, filter EventID 8003 -- those are the files that would have been blocked. Zero unexpected entries means it is safe to set EnforcementMode="Enabled". After enforcing, a blocked mshta launch logs EventID 8004.

Rollback: set EnforcementMode="NotConfigured" and re-import, or unlink the GPO and run gpupdate /force. If a machine is already locked out by an over-broad policy, boot to Safe Mode (AppLocker does not enforce there) and stop AppIDSvc, or delete %WINDIR%\System32\AppLocker\*.AppLocker locally.

Remove the Exceptions block once you have confirmed no line-of-business application depends on mshta. Audit first with EnforcementMode="AuditOnly" for one week.

2 — Enable the two relevant ASR rules (PowerShell)

# Run elevated on each endpoint, or deploy via Intune / GPO.
# Rule GUIDs are Microsoft-published and stable.

# Block JavaScript or VBScript from launching downloaded executable content
Add-MpPreference -AttackSurfaceReductionRules_Ids d3e037e1-3eb8-44c8-a917-57927947596d `
                 -AttackSurfaceReductionRules_Actions Enabled

# Block executable content from email client and webmail
Add-MpPreference -AttackSurfaceReductionRules_Ids be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify
(Get-MpPreference).AttackSurfaceReductionRules_Ids
(Get-MpPreference).AttackSurfaceReductionRules_Actions

3 — Enable PowerShell Script Block Logging (registry / GPO)

# GPO path: Computer Configuration -> Administrative Templates -> Windows Components
#           -> Windows PowerShell -> Turn on PowerShell Script Block Logging

$key = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
New-Item -Path $key -Force | Out-Null
Set-ItemProperty -Path $key -Name EnableScriptBlockLogging -Value 1 -Type DWord

# Module logging (companion setting)
$mod = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
New-Item -Path $mod -Force | Out-Null
Set-ItemProperty -Path $mod -Name EnableModuleLogging -Value 1 -Type DWord
New-Item -Path "$mod\ModuleNames" -Force | Out-Null
Set-ItemProperty -Path "$mod\ModuleNames" -Name '*' -Value '*'

# Verify
Get-ItemProperty -Path $key -Name EnableScriptBlockLogging

4 — Sweep and remove campaign persistence (PowerShell, run as admin)

# READ-ONLY audit first. Review output before running any removal.

Write-Host '--- Scheduled tasks matching PythonLauncher- ---'
Get-ScheduledTask | Where-Object { $_.TaskName -like 'PythonLauncher-*' } |
    Select-Object TaskName, State, @{n='Action';e={$_.Actions.Execute}}

Write-Host '--- HKCU Run values invoking mshta ---'
$runKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
Get-ItemProperty -Path $runKey -ErrorAction SilentlyContinue |
    Get-Member -MemberType NoteProperty |
    Where-Object { (Get-ItemProperty -Path $runKey).($_.Name) -match 'mshta' } |
    Select-Object Name

Write-Host '--- Startup folder shortcuts targeting a Python runtime ---'
$startup = [Environment]::GetFolderPath('Startup')
Get-ChildItem -Path $startup -Filter *.lnk -ErrorAction SilentlyContinue | ForEach-Object {
    $sh = New-Object -ComObject WScript.Shell
    $lnk = $sh.CreateShortcut($_.FullName)
    if ($lnk.TargetPath -match 'python') {
        [PSCustomObject]@{ Shortcut = $_.Name; Target = $lnk.TargetPath; Args = $lnk.Arguments }
    }
}

Write-Host '--- Loader artifacts named LICENSE.txt beside a Python runtime ---'
Get-ChildItem -Path $env:LOCALAPPDATA, $env:APPDATA -Recurse -Filter 'LICENSE.txt' `
    -ErrorAction SilentlyContinue |
    Where-Object { Test-Path (Join-Path $_.DirectoryName 'pythonw.exe') } |
    Select-Object FullName, Length, LastWriteTime

5 — Enforce Constrained Language Mode for non-administrators

# Apply via GPO preference or Intune. Machine-wide default; administrators
# should be exempted through a WDAC policy rather than by unsetting this.

[Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

# Verify on a target host (expect: ConstrainedLanguage)
$ExecutionContext.SessionState.LanguageMode

Constrained Language Mode breaks some legitimate administrative scripts. Pilot on one ring, and pair with a WDAC policy so signed administrative tooling still runs in Full Language Mode.

Containment Runbook

Phase	Actions	Owner	Evidence to capture
1 · Triage 0–1 h	Confirm the hit is genuine (Q3/Q4/Q12 are confirmatory; Q1/Q6/Q8 need corroboration). Identify the trojanized product and where the user obtained it.	SOC L1	Process tree, full command lines, installer file path and hash, browser download history
2 · Isolate 0–1 h	Network-contain the host in Falcon. Do not power off — the WLDR agent and Starland RAT are memory-resident and a reboot destroys the best evidence.	SOC L2	Memory image if your process supports it; Falcon containment timestamp
3 · Scope 1–4 h	Run Q10, Q10b and Q12 fleet-wide. Run Q3 across full retention. Check whether the same trojanized installer reached other users — check your proxy logs for the staging domains, not just endpoints with hits.	Threat hunting	Host list, first-seen timestamps per host, download source URLs
4 · Credential response 1–8 h	Treat every credential on the host as compromised. Force password reset and revoke active sessions and refresh tokens for the user. Prioritise any privileged or service credential cached on a developer or IT-admin endpoint.	IAM	Reset confirmations, session revocation log, list of credentials that were present in browser stores
5 · Crypto asset response 1–8 h	If any wallet was present, notify the user immediately and advise moving assets to a new wallet from a clean device. CastleStealer exfiltrates wallet data on first run — assume theft, not attempted theft.	IR lead + user	Wallet inventory found on host, exfiltration timestamps from C2 beacons
6 · Eradicate 4–24 h	Rebuild rather than clean. The chain plants three independent persistence mechanisms and can fetch arbitrary follow-on payloads; a missed Startup LNK re-infects. If rebuild is impossible, use playbook 4 and re-verify with all queries.	Endpoint eng.	Rebuild ticket, or removal evidence for all three persistence mechanisms
7 · Recover 1–3 d	Reissue the legitimate software from a vendor-verified source. Return the host to production only after 48 h of clean telemetry against the full query set.	Endpoint eng.	Clean-telemetry attestation, software provenance record
8 · Harden 1–4 w	Execute the section 12 Immediate and Near-term tiers. Feed the download source URL into your web filtering. Brief the affected user population on the ClickFix pattern specifically.	Security eng.	Change records, ASR/AppLocker deployment confirmation, awareness comms

Detection Coverage Map

Technique	Behavior	CQL	IOA	Coverage
T1204.004 / T1218.005	ClickFix lure into remote HTA via mshta	Q1	—	GOOD
T1547.001	Run-key persistence invoking mshta	Q2	—	GOOD
T1059.006 / T1036.005	Python loader disguised as LICENSE.txt	Q3	Yes	GOOD
T1204.002	Trojanized installer spawning Python	Q4	Yes	GOOD
T1053.005	PythonLauncher logon task	Q5, Q5b	Yes	GOOD
T1547.001	Startup folder LNK persistence	Q6	—	PARTIAL — needs per-environment tuning
T1018 / T1087.002 / T1082	Chained domain and host discovery	Q7	—	GOOD
T1518.001	Security product enumeration	Q8	—	PARTIAL — inventory agents create noise
T1105 / T1059.001	curl retrieving the WLDR stager	Q9	—	GOOD
T1071.001	C2 domain resolution and IP connection	Q10, Q10b	—	GOOD — but perishable
T1102 / T1568	Polygon smart-contract fallback C2	Q11	—	PARTIAL — legitimate infrastructure, context only
T1204.002 / T1105	Known payload hashes on disk or executing	Q12	—	GOOD
T1548.002	UAC bypass via runas ShellExecuteW	—	—	GAP — no discrete Falcon event; mitigate via UAC policy
T1562.001	AMSI and ETW patched in memory	—	—	GAP — in-memory patching; rely on Falcon prevention policy
T1055.004	APC injection staging shellcode	—	—	GAP — rely on Falcon behavioral prevention
T1497	Sandbox evasion checks	—	—	GAP — decision logic leaves no telemetry
T1113	Desktop screenshot staged then deleted	—	—	PARTIAL — FileDeleteInfo correlation possible but very noisy
T1555.003 / T1005	Browser credential and wallet theft	Q12	—	PARTIAL — detected via payload hash, not the read itself
T1573.001 / T1132.001	Encrypted and encoded C2 channel	—	—	GAP — WLDR agent is memory-only; needs Script Block Logging

Twelve of nineteen mapped behaviors have good or partial CQL coverage and three are promoted to Custom IOAs. The residual gaps cluster in two places: in-memory tradecraft (AMSI/ETW patching, APC injection, the WLDR agent itself) and malware-internal decision logic (sandbox evasion), neither of which produces discrete process telemetry. The first is addressed by Falcon behavioral prevention plus PowerShell Script Block Logging — which is why enabling it is a Near-term hardening item rather than an optional nicety. The second is not detectable by design and is accepted. Validation gates for every query are in section 11; clear Gate 1 before treating any zero-hit result as clean.

Hunt Summary Ticket

TITLE:      Hunt — UAT-11795 Starland RAT / WLDR C2 via trojanized software installers
SEVERITY:   High — active campaign, credential and cryptocurrency theft, published IOCs
SCOPE:      All Windows endpoints. Prioritise developer and IT-administration hosts
            (MobaXterm, DBeaver) and any user permitted to install their own software.

HYPOTHESIS: A user was socially engineered (ClickFix) into running mshta against a
            remote HTA, which delivered a trojanized installer for legitimate software.
            The installer side-loaded a byte-compiled Python loader disguised as
            LICENSE.txt, which decrypted Starland RAT into memory. The RAT persists via
            a PythonLauncher-* scheduled task, a Run key, and a Startup LNK, then stages
            CastleStealer, Remcos RAT, or the in-memory WLDR PowerShell C2 agent.

QUERIES:    Q1  mshta executing a remote HTA
            Q2  Run-key persistence invoking mshta
            Q3  Python runtime executing LICENSE.txt        <-- RUN THIS FIRST
            Q4  Abused installer spawning a Python child
            Q5  PythonLauncher-* scheduled task registered
            Q5b New-ScheduledTask command-line fallback
            Q6  Startup-folder LNK targeting a Python runtime
            Q7  Chained nltest / net user domain discovery
            Q8  SecurityCenter2 and memorychip enumeration
            Q9  curl retrieving a stage from campaign infrastructure
            Q10 Campaign C2 DNS resolution
            Q10b Campaign C2 IPv4 connections
            Q11 Polygon RPC fallback C2 lookup (context only)
            Q12 Published payload hash sweep

DO FIRST:   1. Run Q3 across your full retention window. Zero false positives expected;
               any hit is a confirmed compromise.
            2. Import the section 10 CSV into Falcon IOC Management.
            3. Confirm ScheduledTaskRegistered telemetry exists (Validation Gate 1)
               before treating a zero-hit Q5 result as clean.

FINDINGS:   [ ] Hosts with Q3 or Q4 hits ............................ ____
            [ ] Hosts with Q12 hash hits ............................ ____
            [ ] Hosts resolving campaign domains (Q10) .............. ____
            [ ] Trojanized product identified ....................... ____
            [ ] Download source URL captured ........................ ____

GAPS:       AMSI/ETW in-memory patching, APC injection, sandbox-evasion logic and the
            WLDR agent itself produce no discrete process telemetry. PowerShell Script
            Block Logging is a prerequisite for WLDR visibility — verify before relying
            on a clean result.

ACTIONS:    [ ] Block mshta.exe for standard users (playbook 1)
            [ ] Enable the two ASR rules (playbook 2)
            [ ] Enable PowerShell Script Block Logging (playbook 3)
            [ ] Sweep persistence on any suspect host (playbook 4)
            [ ] Force credential reset for every affected user
            [ ] Advise crypto-wallet holders to move assets from a clean device

OWNER:      ____________________
VERSION:    v0.2 (2026-07-19)

Changelog

v0.22026-07-24CQL correctness pass. All table() calls now carry an explicit row limit: the default is 200 and truncation is silent, so a capped result was indistinguishable from a complete one. Atomic-IOC sweeps (filters over 5+ hashes or C2 IPs) use limit=max so a wide infection is never silently under-scoped; behavioural hunts use limit=200, where exceeding the cap indicates the query needs tuning. Where present, event names that do not exist in the Falcon data model were corrected (e.g. ServiceInstalled is a Sysmon concept, not a Falcon event; ElfFileWritten is ELFFileWritten) — such queries could never return a row. No detection logic, fields, or IOCs changed.

v0.1 2026-07-19 Initial pack. Built from the Cisco Talos UAT-11795 report and official IOC repository (both 2026-07-16), corroborated by three independent press sources. 14 CQL queries, 3 Custom IOA candidates, 52 atomic indicators (28 SHA256, 8 domains, 6 IPv4, 10 URLs) — all traced to saved source snapshots. MD5 and SHA1 shipped as labelled placeholders because no cited source publishes them.

References

Tier	Source	Used for	Published	Accessed
1	Cisco Talos — UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant	Infection chain, persistence, recon commands, WLDR internals, payload triage	2026-07-16	2026-07-18
1	Cisco Talos — official IOC repository entry	All 52 atomic indicators	2026-07-16	2026-07-18
2	BleepingComputer — Russian hackers trojanize WebEx, Zoom apps to push Starland malware	Independent corroboration of delivery and attribution	2026-07-16	2026-07-18
2	Security Affairs — New Russian campaign uses fake WebEx and Zoom installers	Independent corroboration of campaign scope and payload set	2026-07-16	2026-07-18
2	GBHackers — New Starland RAT steals browser credentials and scans 40+ crypto wallets	Independent corroboration of collection objectives	2026-07-16	2026-07-18
Ref	MITRE ATT&CK	Technique and mitigation mapping	—	2026-07-18

Provenance: the verbatim fetched text of all five sources is saved alongside this pack in StarlandRAT-UAT11795-Hunt-sources/. Every atomic indicator in section 10 was verified to appear in that saved text by check_ioc_provenance.py before this pack was released.