Starland RAT Self-Deletion via os.remove Kill-Switch Response

Duo Tech@duotech

•updated Jul 16, 2026•1•0•1

Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.