MalwareUsed by 1 actor

WLDR agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAT-11795

The WLDR agent is a sophisticated PowerShell-based C2 memory implant that features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads.

via talosintelligence otherblog.talosintelligence.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

The response from the C2 server can include either commands or tasks ... encrypted PowerShell commands or scripts ... executed through one of the two runtime engines defined in the backdoor program.

T1059.001PowerShellEvidence1

Talos has observed that the threat actor executed a Windows shell command through Starland RAT as an intermediate payload to download and execute a PowerShell stager.

T1204User ExecutionEvidence1

The threat actor gains initial access to the victim machine potentially through a ClickFix social engineering technique that entices the user to execute a command, which then stealthily downloads and executes a remotely hosted weaponized HTA file.

T1204.002Malicious FileEvidence1

The execution of the HTA file results in the downloading and execution of trojanized installers bundled with a malicious Python package.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The compiled Python loader is a relatively large file obfuscated with numerous junk functions ... implementing XOR decryption ... The PowerShell stager is heavily obfuscated

T1140Deobfuscate/Decode Files or InformationEvidence1

The actual execution logic is confined to six lines in the loader program, implementing XOR decryption using the XOR key 198 (0xC6) to decrypt the encrypted embedded payload of Starland RAT

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

It performs system reconnaissance, assembling the victim profile that includes the system hardware-bound unique identifier (HWID), total RAM size of the victim machine, and installed antivirus

T1482Domain Trust DiscoveryEvidence1

The RAT also conducts Active Directory reconnaissance via the PowerShell command Get-WmiObject Win32_ComputerSystem.Domain.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

The RAT consolidates all collected data ... and sends it to the primary C2 through an HTTP POST request ... After the RAT registers ... it sends a GET request to the C2 server every 50–60 seconds.

T1105Ingress Tool TransferEvidence1

Downloads the payload file to the “ %TEMP% ” folder and executes it by file extension, supporting EXE, MSI , DLL , and ZIP formats

T1573Encrypted ChannelEvidence1

The network communication is encrypted using AES-256-CBC with HMAC-SHA256 ... The WLDR agent employs capabilities including encrypted HTTP beaconing

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The collected data ... is sent to the primary C2 through an HTTP POST request ... transmitting all collected material over a TCP socket to the attacker-controlled infrastructure.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

talosintelligence otherNews

Jul 16, 2026

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

A bespoke PowerShell in-memory remote access implant delivered in this campaign as a later-stage payload. It uses encrypted HTTP/HTTPS C2 communications, host reconnaissance, mutex protection, retry/reconnect logic, and a Runspace-based concurrent task execution engine for interactive remote PowerShell operations.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

WLDR agent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAT-11795

The WLDR agent is a sophisticated PowerShell-based C2 memory implant that features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads.

via talosintelligence otherblog.talosintelligence.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

The response from the C2 server can include either commands or tasks ... encrypted PowerShell commands or scripts ... executed through one of the two runtime engines defined in the backdoor program.

T1059.001PowerShellEvidence1

Talos has observed that the threat actor executed a Windows shell command through Starland RAT as an intermediate payload to download and execute a PowerShell stager.

T1204User ExecutionEvidence1

T1204.002Malicious FileEvidence1

The execution of the HTA file results in the downloading and execution of trojanized installers bundled with a malicious Python package.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The compiled Python loader is a relatively large file obfuscated with numerous junk functions ... implementing XOR decryption ... The PowerShell stager is heavily obfuscated

T1140Deobfuscate/Decode Files or InformationEvidence1

The actual execution logic is confined to six lines in the loader program, implementing XOR decryption using the XOR key 198 (0xC6) to decrypt the encrypted embedded payload of Starland RAT

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

It performs system reconnaissance, assembling the victim profile that includes the system hardware-bound unique identifier (HWID), total RAM size of the victim machine, and installed antivirus

T1482Domain Trust DiscoveryEvidence1

The RAT also conducts Active Directory reconnaissance via the PowerShell command Get-WmiObject Win32_ComputerSystem.Domain.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

The RAT consolidates all collected data ... and sends it to the primary C2 through an HTTP POST request ... After the RAT registers ... it sends a GET request to the C2 server every 50–60 seconds.

T1105Ingress Tool TransferEvidence1

Downloads the payload file to the “ %TEMP% ” folder and executes it by file extension, supporting EXE, MSI , DLL , and ZIP formats

T1573Encrypted ChannelEvidence1

The network communication is encrypted using AES-256-CBC with HMAC-SHA256 ... The WLDR agent employs capabilities including encrypted HTTP beaconing

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The collected data ... is sent to the primary C2 through an HTTP POST request ... transmitting all collected material over a TCP socket to the attacker-controlled infrastructure.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

talosintelligence otherNews

Jul 16, 2026

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.