New Starland RAT Steals Browser Credentials and Scans for Over 40 Crypto Wallets

A financially motivated, Russian-speaking threat actor tracked as UAT-11795, orchestrating a large-scale campaign since at least June 2025.

A sophisticated Python-based remote access trojan dubbed “Starland RAT,” alongside a stealthy in-memory PowerShell implant known as the “WLDR agent.”

The operation targets users across the United States and parts of Europe, with a primary focus on credential theft and cryptocurrency wallet harvesting.

The campaign stands out for its modular, multi-stage infection chain and resilient command-and-control architecture.

Initial access is achieved באמצעות ClickFix-style social engineering, where victims are tricked into executing malicious commands that launch a weaponized HTA file via mshta.exe.

This stage drops a trojanized installer bundled with a Python runtime and an obfuscated loader disguised as a benign LICENSE.txt file, executed through a modified NSIS installer script.

Once triggered, the Python loader decrypts and executes Starland RAT directly in memory using XOR obfuscation (key 0xC6).

The malware is engineered for Windows environments and leverages ctypes to dynamically resolve Win32 API calls such as VirtualAllocEx and CreateRemoteThread, enabling process injection and execution without static imports.

Anti-analysis checks include comparisons against known sandbox usernames and hostnames, including WDAGUtilityAccount and environments like Cuckoo and Any.Run, ensuring early termination in controlled environments.

Starland RAT establishes persistence via scheduled tasks (PythonLauncher-{random}) and Startup folder shortcuts, while attempting privilege escalation through ShellExecuteW with the runas verb.

It performs extensive reconnaissance, collecting HWID, RAM size, antivirus details, and Active Directory context using commands such as Get-CimInstance and nltest /dclist.

A screenshot of the victim’s desktop is captured, encoded, and exfiltrated alongside system profiling data.

A defining capability of Starland RAT is its focus on cryptocurrency theft. The malware enumerates more than 40 browser-based and desktop wallet applications, aggregating findings into an encrypted JSON payload (XOR key “helo1”) sent via HTTP POST using a spoofed Chrome user-agent.

Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.  

Before full exfiltration, victim metadata and wallet presence are transmitted to attacker-controlled Telegram bots (e.g., skuefq_bot and komandastuk_bot), providing real-time visibility into compromised assets.

The C2 infrastructure is distributed and designed to blend with legitimate traffic. Domains such as eorthopaedics[.]com and sastoro[.]com host staged payloads under deceptive paths like /feed/ and /alpha/, while web-devtools[.]com delivers raw shellcode payloads.

Starland RAT Steals Browser Credentials

The primary RAT C2 nodes include windowscreenrepairnearme[.]com and aipythondevs[.]com, with communication uniquely tied to victim HWIDs derived from disk volume serial numbers.

Notably, the actor employs blockchain-based resilience by embedding a fallback mechanism via a Polygon smart contract (0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba).

The RAT retrieves an XOR-encrypted backup C2 domain באמצעות eth_call requests to polygon-rpc[.]com, ensuring continuity even if primary infrastructure is disrupted.

Post-compromise activity includes delivery of secondary payloads such as CastleStealer, a .NET credential and crypto stealer, and Remcos RAT for persistent remote access.

In parallel, Talos identified the deployment of the WLDR agent, a fileless PowerShell implant delivered عبر an obfuscated stager chain.

The WLDR framework features encrypted beaconing, HWID-bound tasking, and a Runspace-based execution engine, allowing concurrent in-memory execution of attacker-defined modules.

Infrastructure telemetry and passive DNS data indicate the majority of infections are concentrated in the United States, with additional activity observed in Germany, Romania, and Venezuela.

The use of trojanized installers for widely used software such as MobaXterm, DBeaver, WebEx, Zoom, and FACEIT suggests an opportunistic, high-volume distribution strategy targeting both enterprise and consumer environments.

The discovery of a private Telegram channel named “stuk komanda,” created in June 2025, further confirms the operational maturity of UAT-11795, with evidence suggesting its use as a covert C2 or staging hub.

The combination of multi-layered payload delivery, crypto-targeting functionality, and decentralized fallback mechanisms highlights an evolution in financially driven malware campaigns leveraging both traditional and emerging infrastructure.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide