SStar Agent Windows Temp CMD Execution

Ethan Andrews@eandrews

•updated Jun 4, 2026•8•0•6

Detects the SStar Agent malware executing remote shell commands by creating and executing ephemeral batch files. The malware creates a file named sstar-*.cmd in the %TEMP% directory and executes it using cmd.exe.