Loading malware…
WLDR is a PowerShell-based in-memory command-and-control implant used by the financially motivated, Russian-speaking threat actor UAT-11795 in campaigns active since at least June 2025. It has been observed primarily against victims in the United States, with additional activity affecting Germany, Romania, and Venezuela, and is associated with operations targeting the cryptocurrency sector.
WLDR is delivered through an obfuscated PowerShell stager as part of a multi-stage intrusion chain that also uses trojanized installers for legitimate software and ClickFix-style social engineering. The implant operates entirely in memory and is designed for post-compromise access rather than standalone initial infection. Its architecture supports encrypted beaconing, modular task delivery, concurrent PowerShell Runspace execution, interactive in-memory script execution, and resilient reconnection behavior. Observed implementations used strong encrypted communications and victim-specific payload delivery tied to host identifiers.
In this campaign, WLDR functioned alongside Starland RAT and additional payloads such as CastleStealer and Remcos RAT. It contributed to credential theft and cryptocurrency wallet data theft while helping operators maintain persistent access through ongoing encrypted command-and-control. The broader intrusion set also featured defense-evasion measures including in-memory execution and PowerShell abuse, enabling long-term access and flexible post-exploitation on compromised Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The WLDR framework represents one of the campaign's more advanced capabilities. Delivered through an obfuscated PowerShell stager, WLDR operates entirely in memory and supports encrypted communications, concurrent PowerShell Runspace execution, modular task delivery, and robust reconnection logic.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
This arrives in three stages: a heavily obfuscated PowerShell stager, a downloader that fetches victim-specific payloads bound to the machine’s hardware ID, and the WLDR agent itself
the PowerShell-based WLDR agent, which operates entirely in-memory with encrypted beaconing and a Runspace execution engine
47dedb08385449d48d8b6543030310317c92cddafa25e14ee0cb9a32d53ced5c Python_Loader.py
451ac8ca34d5bcdfe476465f69eb517b2608f267c7e8d69f8ef36197a6f1d949 Stage-1-obfuscated-1.ps1 365024336c7681ac0854321ac6c140a245b9593285da02d2a590124cdc592370 Stage-1-obfuscated-2.ps1 a080b5380ccc8fc40b24c02151d305efc32d931dc547881e01a2e6f2b070c7dc Stage-1-obfuscated-3.ps1
6ca7a458985350ac082a9c9820d7f8d39128a4c4bda2f5d32f169a45b7b22bc6 MobaXterm_v26.1.exe ... 6ae334ce60d1a9b7fb96d1d0d0eda5ec7c2c31d3f0cf3e4d7e3056504d50043d WebEx_Client.exe ... 1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6 FaceitInstaller_x64.exe ... f4491736743a16f1278b8ba01649ee93343764e35ae5e1c0d5e0c0e1d7e32c14 Zoom Installer
Cisco Talos reported that the group even hides a fallback command-and-control channel within a Polygon smart contract
53 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously undocumented in-memory PowerShell post-exploitation framework that supports encrypted communications, modular tasking, concurrent runspaces, reconnection logic, and interactive execution of additional scripts entirely in memory.
A PowerShell-based in-memory agent with encrypted beaconing and a Runspace execution engine, used to exfiltrate credentials, browser data, and cryptocurrency wallet assets and maintain persistent access.
A newly documented PowerShell in-memory command-and-control implant/framework deployed by Starland RAT. It supports encrypted C2, concurrent task execution via runspaces, module delivery, and interactive remote PowerShell execution, with victim-specific payloading tied to hardware ID.
A bespoke PowerShell-based in-memory C2 implant used for credential theft, cryptocurrency wallet data theft, persistent access, and encrypted command-and-control communications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.