UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

MITRE Techniques

• [T1204.004 ] User Execution: Malicious File – The victim is tricked into running a command or installer through ClickFix-style social engineering (‘entices the user to execute a command’ and ‘download and execute a remotely hosted weaponized HTA file’).
• [T1218.005 ] System Binary Proxy Execution: Mshta – The weaponized HTA is executed through Microsoft HTML Application Host (‘on the victim’s machine, likely utilizing a ClickFix technique’ and ‘mshta.exe’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell stages, loaders, and agents are used throughout the infection chain (‘download and execute additional PowerShell script payloads’ and ‘PowerShell C2 memory implant’).
• [T1059.005 ] Command and Scripting Interpreter: Visual Basic – The HTA file runs embedded VBScript to drop files and set persistence (‘the HTA file runs an embedded VBScript’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Persistence is established through HKCU Run key and Startup folder LNK (‘establishes persistence under “HKCUSoftwareMicrosoftWindowsCurrentVersionRun”‘ and ‘a secondary Startup folder LNK shortcut is created’).
• [T1105 ] Ingress Tool Transfer – Payloads, shellcode, and archives are downloaded from attacker-controlled servers (‘downloads and executes trojanized installers’ and ‘downloads the payload file to the “%TEMP%” folder’).
• [T1027 ] Obfuscated Files or Information – Python and PowerShell payloads are obfuscated and encrypted (‘compiled Python loader is disguised as a license file’ and ‘heavily obfuscated’).
• [T1027.013 ] Obfuscated Files or Information: Encrypted/Encoded File – Payloads and C2 data are XOR/Base64 encrypted (‘XOR decryption using the XOR key 198’ and ‘XOR encrypts it, Base64-encodes it’).
• [T1055 ] Process Injection – The campaign injects and executes payloads in memory using APC and reflective techniques (‘staged using the asynchronous procedure call (APC), process injection technique’ and ‘reflective PE injection technique’).
• [T1216 ] System Script Proxy Execution – The actor uses HTA/VBScript and scripted loaders to proxy execution (‘weaponized HTA file’ and ‘NSIS script … execute the malicious byte-compiled Python code’).
• [T1057 ] Process Discovery – The malware collects host and domain information as part of reconnaissance (‘whoami && systeminfo && net user {USERNAME} /dom && nltest /dclist’).
• [T1082 ] System Information Discovery – Host OS, RAM, CPU, AV, and build details are collected (‘gathering information on antivirus products, network adapter configurations, OS version and build, domain membership’).
• [T1016 ] System Network Configuration Discovery – Network adapter and related host configuration are gathered (‘network adapter configurations’).
• [T1033 ] System Owner/User Discovery – The malware checks usernames and computer names for anti-analysis and profiling (‘compares the logged-on username’ and ‘verifies the victim’s computer name’).
• [T1113 ] Screen Capture – The RAT captures a screenshot of the desktop and stages it for exfiltration (‘captures a screenshot of the victim machine’s desktop’).
• [T1555 ] Credentials from Password Stores – Browser data and credentials are harvested from browsers and wallets (‘steal browser data and cryptocurrency wallets’ and ‘direct SQLite database access’).
• [T1112 ] Modify Registry – The VBScript writes a Run key for persistence (‘establishes persistence under “HKCUSoftwareMicrosoftWindowsCurrentVersionRun”‘).
• [T1021.001 ] Remote Services: Remote Desktop Protocol – The trojanized MobaXterm lure targets remote administration workflows (‘SSH, remote desktop, and network administration terminal’).