Starland RAT + WLDR Implant & Spirals Ransomware: OTX Pulse Analysis — UAT-11795 ClickFix Campaign and Rust-Based Double Extortion Detection Pack

---
title: ClickFix-Style User-Executed Malicious Command
id: 7c3a1e90-starland-clickfix-001
status: experimental
description: Detects ClickFix social-engineering execution pattern where users paste attacker commands into Run dialog or terminal spawning PowerShell/mshta with encoded commands, as used by UAT-11795 to deliver Starland RAT and WLDR agent.
author: Security Arsenal Threat Intelligence
date: 2026/08/15
references:
    - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\rundll32.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\wscript.exe'
    selection_flags:
        CommandLine|contains:
            - ' -enc '
            - ' -ec '
            - 'FromBase64String'
            - 'IEX'
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'iwr '
            - 'Invoke-WebRequest'
    condition: selection_parent and selection_child and selection_flags
falsepositives:
    - Rare administrative automation launched interactively
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
---
title: WLDR Agent or Starland RAT C2 Beaconing to Known Infrastructure
id: 7c3a1e90-wldr-c2-002
status: experimental
description: Detects network connections from scripting or Python processes to UAT-11795 C2 domains associated with the WLDR PowerShell implant and Starland RAT campaign.
author: Security Arsenal Threat Intelligence
date: 2026/08/15
references:
    - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname:
            - 'windowscreenrepairnearme.com'
            - 'zynaris.io'
    selection_process:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\python.exe'
            - '\pythonw.exe'
            - '\wscript.exe'
            - '\mshta.exe'
    condition: selection_domain and selection_process
falsepositives:
    - None expected; domains are actor-registered C2
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1059.001
---
title: Suspicious Tunneling Tool Execution on Web Server (Chisel / revsocks / Cloudflare Tunnel)
id: 7c3a1e90-spirals-tunnel-003
status: experimental
description: Detects execution of Chisel, revsocks, or cloudflared tunneling binaries on IIS web servers, a hallmark of the Spirals ransomware intrusion chain for covert C2 and lateral movement. Also flags suspicious child processes of w3wp.exe consistent with ASP.NET web shell activity.
author: Security Arsenal Threat Intelligence
date: 2026/08/15
references:
    - https://www.security.com/threat-intelligence/ransomware-spirals-extortion
logsource:
    category: process_creation
    product: windows
detection:
    selection_tunnel:
        Image|endswith:
            - '\chisel.exe'
            - '\revsocks.exe'
            - '\cloudflared.exe'
        CommandLine|contains:
            - 'trycloudflare.com'
            - 'chisel client'
            - 'chisel server'
            - '--socks5'
    selection_webshell:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\nltest.exe'
    condition: 1 of selection_*
falsepositives:
    - Sanctioned Cloudflare Tunnel deployments for internal apps (whitelist by path and hash)
    - Web application code legitimately spawning system tools (rare on IIS)
level: high
tags:
    - attack.command_and_control
    - attack.t1572
    - attack.t1090.001
    - attack.persistence
    - attack.t1505.003

// UAT-11795 (Starland RAT / WLDR) + Spirals ransomware combined hunt
// Searches process, network, and file telemetry for campaign indicators and behaviors
let C2Domains = dynamic(["windowscreenrepairnearme.com", "zynaris.io"]);
let BadHashes = dynamic([
    "a6821c7e9bfe2e6af0f690d906ec6a26161e2198c256fb60f3b4731c317f3ad9",
    "162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca",
    "17e41d66ebfd56edc960f58f4285697ceceaa812514bb15092672c747979896e",
    "1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6",
    "0f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141",
    "4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649",
    "7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b",
    "83a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892",
    "84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d",
    "862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1"
]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl in~ (C2Domains)
    | project Hit="C2_Beacon", TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP),
    (DeviceFileEvents
    | where TimeGenerated > ago(90d)
    | where SHA256 in~ (BadHashes) or MD5 in~ ("c33f097fdb2b69b4cbb1c3f29ae88b43", "26a15a6a9bea58e9ad2ada9a6c8606b5")
    | project Hit="Known_Malware_Hash", TimeGenerated, DeviceName, FileName, FolderPath, SHA256),
    (DeviceProcessEvents
    | where TimeGenerated > ago(90d)
    // ClickFix pattern: explorer-spawned encoded PowerShell
    | where (InitiatingProcessFileName =~ "explorer.exe"
             and FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe")
             and ProcessCommandLine has_any ("-enc", "-ec ", "FromBase64String", "IEX", "DownloadString"))
       // Spirals chain: w3wp spawning shells or tunneling tools
       or (InitiatingProcessFileName =~ "w3wp.exe"
           and FileName in~ ("cmd.exe", "powershell.exe", "whoami.exe", "net.exe"))
       or FileName in~ ("chisel.exe", "revsocks.exe", "cloudflared.exe")
       or ProcessCommandLine has_any ("trycloudflare.com", "chisel client", "--socks5")
    | project Hit="Behavioral", TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256)
| sort by TimeGenerated desc

# Security Arsenal - UAT-11795 (Starland/WLDR/Remcos) & Spirals Hunt Script
# Run elevated on endpoints and web servers. Outputs findings to console and CSV.

$findings = @()

# --- 1. Known malicious file hashes (OTX pulses) ---
$badHashes = @(
    "a6821c7e9bfe2e6af0f690d906ec6a26161e2198c256fb60f3b4731c317f3ad9",
    "162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca",
    "17e41d66ebfd56edc960f58f4285697ceceaa812514bb15092672c747979896e",
    "1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6",
    "0f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141",
    "4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649",
    "7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b",
    "83a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892",
    "84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d",
    "862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1"
)
$scanPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:USERPROFILE\Downloads", "C:\ProgramData", "C:\inetpub\wwwroot")
foreach ($p in $scanPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($h -and ($badHashes -contains $h.ToLower())) {
                $findings += [pscustomobject]@{Type="MaliciousHash"; Detail="$($_.FullName) SHA256=$h"}
            }
        }
    }
}

# --- 2. Persistence artifacts: Run keys and scheduled tasks (Remcos / Starland / WLDR) ---
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($rk in $runKeys) {
    Get-ItemProperty -Path $rk -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty -Path $rk -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
        if ($val -match "powershell|python|mshta|wscript|-enc|FromBase64String") {
            $findings += [pscustomobject]@{Type="SuspiciousRunKey"; Detail="$rk\$($_.Name) = $val"}
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match "powershell|python|mshta|wscript" -and
    $_.Actions.Arguments -match "-enc|-w hidden|IEX|DownloadString"
} | ForEach-Object {
    $findings += [pscustomobject]@{Type="SuspiciousScheduledTask"; Detail="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"}
}

# --- 3. Network connections to WLDR C2 domains and tunneling processes ---
$c2Domains = @("windowscreenrepairnearme.com", "zynaris.io")
foreach ($d in $c2Domains) {
    $resolved = Resolve-DnsName -Name $d -ErrorAction SilentlyContinue
    if ($resolved) { $findings += [pscustomobject]@{Type="C2DomainResolves"; Detail="$d -> $(($resolved.IPAddress) -join ',')" } }
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.ProcessName -match "powershell|python|chisel|revsocks|cloudflared") {
        $findings += [pscustomobject]@{Type="SuspiciousConnection"; Detail="$($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)"}
    }
}

# --- 4. Tunneling binaries and ASP.NET web shells (Spirals chain) ---
Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -match "chisel|revsocks|cloudflared" } | ForEach-Object {
    $findings += [pscustomobject]@{Type="TunnelingProcess"; Detail="$($_.ProcessName) PID=$($_.Id) Path=$($_.Path)"}
}
if (Test-Path "C:\inetpub\wwwroot") {
    Get-ChildItem "C:\inetpub\wwwroot" -Recurse -Include *.aspx,*.asp,*.ashx -ErrorAction SilentlyContinue | Where-Object {
        (Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue) -match "ProcessStartInfo|cmd.exe|eval\(|Request\[|runat=.server"
    } | ForEach-Object {
        $findings += [pscustomobject]@{Type="PossibleWebShell"; Detail="$($_.FullName) LastWrite=$($_.LastWriteTime)"}
    }
}

# --- Output ---
if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\UAT11795_Spirals_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) findings — escalate to IR immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No Starland/WLDR/Spirals artifacts found on this host." -ForegroundColor Green
}