{"id":63592,"date":"2026-07-16T07:39:52","date_gmt":"2026-07-16T11:39:52","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=63592"},"modified":"2026-07-16T07:39:52","modified_gmt":"2026-07-16T11:39:52","slug":"starland-rat-fake-installers","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/starland-rat-fake-installers\/","title":{"rendered":"Starland RAT Deploys Credential Theft Campaign via Fake Installers"},"content":{"rendered":"

Cybercriminals have evolved their tactics yet again, moving beyond the traditional phishing email to weaponize the very tools that power modern productivity. A new credential theft campaign, linked to the financially motivated Russian threat actor tracked as UAT-11795, is distributing the sophisticated Starland RAT through trojanized installers of widely trusted applications. This operation, active since at least June<\/a> 2025, demonstrates a dangerous evolution in malware strategy: the fusion of remote access capabilities, cryptocurrency theft, and enterprise-level reconnaissance into a single, persistent threat ecosystem. Targeting users primarily in the United States, with additional infections detected in Germany<\/a>, Romania, and Venezuela, the Starland RAT campaign serves as a stark warning for organizations and individuals alike.<\/p>\n

What is Starland RAT?<\/h2>\n

Starland RAT is a sophisticated remote access trojan deployed by the threat actor UAT-11795. It functions as the central command module of a multi-stage malware operation, designed to steal credentials, cryptocurrency wallets, and provide attackers with persistent remote control over infected systems. The malware is distributed through fake software installers, tricking victims into believing they are downloading legitimate applications such as Zoom or WebEx.<\/p>\n

Trojanized Installers and the ClickFix Technique<\/h2>\n

The initial access vector for the Starland RAT campaign is notably deceptive. Attackers have created malicious versions of popular software packages, including MobaXterm, WebEx, Zoom, DBeaver, and FaceIT. Victims land on convincing websites or search results offering these applications, but the downloaded installers are weaponized.<\/p>\n

This campaign heavily relies on the ClickFix technique. Instead of exploiting a software vulnerability, the attackers manipulate user behavior. Victims are tricked into copying and pasting commands into Windows dialogs or executing instructions presented on a spoofed webpage. This action bypasses many traditional security controls because the malicious action is user-initiated.<\/p>\n

The infection chain is initiated by an HTA file, which downloads a modified NSIS installer packed with a Python-based loader disguised as a harmless file named LICENSE.txt.<\/p>\n

Inside the Starland RAT Infection Chain<\/h2>\n

Sandbox Evasion and Persistence<\/h3>\n

Once executed, the Starland RAT is far from a simple remote access tool. It first performs a detection check to determine if it is running inside a sandbox or a malware analysis environment. If the environment is deemed legitimate, the installer decrypts and launches the Starland RAT payload.<\/p>\n

The malware establishes robust persistence to survive system reboots and maintain long-term access. This is achieved through multiple overlapping mechanisms:<\/p>\n