UAT-11795 Starland RAT, Spirals Ransomware, and the Global Lua Loader Threat — OTX Intelligence Briefing

title: Potential WLDR Agent PowerShell Memory Execution
id: d41d8cd9-8f00-b204-e980-0998ecf8427e
description: Detects suspicious PowerShell execution patterns often associated with WLDR agent and memory-based implants observed in UAT-11795 campaigns.
status: experimental
date: 2026/07/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6223423423
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - ' -enc '
            - ' -encodedcommand '
            - 'DownloadString'
            - 'IEX'
    filter_legit:
        SubjectUserName:
            - 'SYSTEM'
            - 'NETWORK SERVICE'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative scripts
level: high

---

title: Starland RAT Python Network Activity
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Identifies Python processes establishing network connections, a behavior consistent with the Starland RAT malware used by UAT-11795.
status: experimental
date: 2026/07/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6223423424
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection:
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate Python development or scripting
level: medium

---

title: Suspicious Lua Loader Execution
id: e5f6g7h8-9012-34cd-ef56-789012345678
description: Detects the execution of LuaJIT or Lua scripts coupled with shellcode injection patterns associated with the "TTF Trap" global campaign.
status: experimental
date: 2026/07/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6223423425
tags:
    - attack.defense_evasion
    - attack.t1055.001
logsource:
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\luajit.exe'
            - '\lua.exe'
            - '\wscript.exe'
    selection_cli:
        CommandLine|contains:
            - 'donut'
            - 'shellcode'
            - '.lua'
    condition: all of selection_*
falsepositives:
    - Rare; legitimate software usually does not inject shellcode via Lua
level: critical


kql
// Hunt for connections to known UAT-11795 C2 infrastructure and generic Python RAT traffic
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where (RemoteUrl has_any (
    "windowscreenrepairnearme.com", 
    "zynaris.io", 
    "taikei-rmc-co.biz", 
    "allportcargoservice.com"
) or 
    RemoteIP in ("193.149.176.254", "74.114.119.201", "185.141.216.194"))
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort

// Hunt for suspicious PowerShell execution patterns (WLDR Agent)
DeviceProcessEvents 
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "DownloadString", "IEX") 
| where InitiatingProcessFileName !in ("explorer.exe", "services.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName


powershell
# IOC Hunt Script: Check for UAT-11795 and Spirals Ransomware Network Artifacts
# Requires Administrative Privileges

$C2_IPs = @(
    "193.149.176.254",
    "74.114.119.201",
    "185.141.216.194"
)

$C2_Domains = @(
    "windowscreenrepairnearme.com",
    "zynaris.io",
    "newremupdate.duckdns.org"
)

function Check-NetworkConnections {
    Write-Host "Checking active network connections for C2 indicators..." -ForegroundColor Cyan
    $activeConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
    
    foreach ($ip in $C2_IPs) {
        $match = $activeConnections | Where-Object { $_.RemoteAddress -eq $ip }
        if ($match) {
            Write-Host "[ALERT] Active connection found to C2 IP: $ip (PID: $($match.OwningProcess))" -ForegroundColor Red
            $process = Get-Process -Id $match.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "  Process Details: $($process.ProcessName) - $($process.Path)" -ForegroundColor Yellow
        }
    }
}

function Check-DnsCache {
    Write-Host "Checking DNS cache for malicious domains..." -ForegroundColor Cyan
    $dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
    
    foreach ($domain in $C2_Domains) {
        $match = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
        if ($match) {
            Write-Host "[ALERT] DNS cache entry found for domain: $domain" -ForegroundColor Red
        }
    }
}

function Check-HostsFile {
    Write-Host "Checking HOSTS file for malicious domain redirects..." -ForegroundColor Cyan
    $hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
    if (Test-Path $hostsPath) {
        $hostsContent = Get-Content $hostsPath
        foreach ($domain in $C2_Domains) {
            if ($hostsContent -match $domain) {
                Write-Host "[ALERT] Entry found in HOSTS file for: $domain" -ForegroundColor Red
            }
        }
    }
}

Check-NetworkConnections
Check-DnsCache
Check-HostsFile