MalwareUsed by 1 actor

RustyStealer

RustyStealer is a Windows information-stealing malware family written in Rust and used to harvest credentials and other sensitive data from compromised systems. It has been observed as both a standalone stealer and a launcher carrying an encrypted payload, and open reporting indicates it can also deliver additional malware. Documented intrusion chains show RustyStealer preceding hands-on-keyboard activity and later-stage ransomware deployment, including cases involving Ymir, where stolen high-privilege credentials enabled unauthorized access and lateral movement through remote administration mechanisms such as WinRM and PowerShell. It has also appeared as a payload in commodity botnet and pay-per-install ecosystems, including Amadey-driven distribution, alongside other stealers and remote access tools.

Operational reporting links RustyStealer to multiple threat contexts. It has been associated with financially motivated malware delivery operations and has also been reported as a tool used by the Iranian state-linked group MuddyWater. In Chinese-language intrusion activity attributed to the SilverFox cluster, RustyStealer has been used with social-engineering lures and persistence under legitimate-sounding executable names. Across these contexts, the malware is consistently characterized as a credential-harvesting infostealer that supports follow-on compromise.

Observed behavior includes collection of credentials and system information, command execution or remote control functionality in some incidents, and use as an access-enabling component for broader post-compromise operations. In ransomware-linked cases, RustyStealer infections were detected before encryption events and were assessed to have facilitated compromise of privileged accounts useful for lateral movement. Technical reporting also notes Rust-compiled launcher variants with AES-encrypted embedded payloads and obfuscation or packing characteristics consistent with evasive delivery tooling.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Silver Fox

Sample 4: RustyStealer ... This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload.

via breakglass intelintel.breakglass.tech

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Many of the Keitaro IP addresses we saw in the AS214351 network host and distribute malware.

T1566PhishingEvidence1

The lure filenames are not random. They are precision-engineered psychological operations targeting specific anxieties within Chinese-speaking populations.

Execution

3 techniques

T1059.001PowerShellEvidence1

Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.

T1129Shared ModulesEvidence1

This sample has obfuscated content for obstructing analysis and includes shared modules indicating that the artifact can invoke functions from APIs, such as native Windows DLLs... RustyStealer TTPs... Execution Shared Modules T1129.

T1204.002Malicious FileEvidence1

The video title promises the footage. The file is an .exe.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Tactic Technique ID ... Persistence Registry Run Keys T1547.001

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Tactic Technique ID ... Persistence Registry Run Keys T1547.001

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

This sample has obfuscated content for obstructing analysis... RustyStealer TTPs... Defense evasion Obfuscated Files or Information T1027.

T1027.013Encrypted/Encoded FileEvidence1

This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload

T1036.005Match Legitimate Resource Name or LocationEvidence1

RustyStealer selects from a pool of 20 legitimate-sounding executable names when writing itself to %ProgramData%

Credential Access

3 techniques

T1003OS Credential DumpingEvidence1

RustyStealer, essentially a credential-harvesting tool, enabled attackers to gain unauthorized access to systems by compromising legitimate high-privilege accounts useful in lateral movement.

T1555Credentials from Password StoresEvidence2

The simultaneous deployment of three malware families (ValleyRAT for access, Gh0stRAT for persistence, RustyStealer for credential theft)

T1555.003Credentials from Web BrowsersEvidence1

MITRE ATT&CK Mapping ... Credential Access Credentials from Password Stores: Credentials from Web Browsers T1555.003 Vidar, Lumma, Salat, Santa, Rusty stealers

Discovery

2 techniques

T1057Process DiscoveryEvidence1

RustyStealer TTPs: Tactic Technique ID Discovery Process Discovery T1057.

T1083File and Directory DiscoveryEvidence1

The malware constantly uses the memmove function while enumerating subdirectories and files inside the affected system, so they can be encrypted later... Tactics, techniques and procedures... Discovery File and Directory Discovery T1083.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.

T1021.006Windows Remote ManagementEvidence1

Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

MITRE ATT&CK Tactic Technique ID ... Command and Control Application Layer Protocol T1071

T1104Multi-Stage ChannelsEvidence1

MITRE ATT&CK Tactic Technique ID ... Command and Control Multi-Stage Channels T1104

T1105Ingress Tool TransferEvidence1

MITRE ATT&CK Mapping ... Command and Control Ingress Tool Transfer T1105 Amadey downloads 50+ payloads to infected hosts

T1219Remote Access ToolsEvidence1

62[.]60[.]226[.]248 was also hosting a customized remote monitoring and management (RMM) client called ScreenConnect that auto-enrolled victims into the actor-controlled network relays.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

According to Kaspersky researchers who discovered Ymir during an incident response... Kaspersky has found evidence that Ymir connects to external servers that might facilitate data exfiltration, the ransomware does not feature such a capability.

INDICATORS OF COMPROMISE

IOCs tracked for this family

51 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

42 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app7 days ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

uri●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

breakglass intelNews

Apr 1, 2026

30 Samples in 10 Days: SilverFox Weaponizes Scam Compound Fear and a Phone Farm Business Front to Target Chinese Diaspora - Breakglass Intelligence - Breakglass Intelligence

A Rust-compiled stealer/launcher carrying a large AES-encrypted payload. It uses strong encryption, Windows cryptographic APIs, and a persistence disguise system that writes itself to %ProgramData% under one of 20 legitimate-sounding filenames to evade casual forensic review. The campaign describes it as serving the credential theft role in the kill chain.

infoblox threat intel blogNews

Mar 26, 2026

Inside Keitaro Abuse Part 2: One Platform, Many Threats

An information stealer and credential-harvesting tool that can also deliver additional malware.

breakglass intelNews

Mar 12, 2026

LummaStealer's Go Loader and the fbf543 Amadey Supermarket: 50 Payloads, 13 Malware Families, and the Bulletproof Host That Ties It All Together - Breakglass Intelligence - Breakglass Intelligence

A newer Rust-based stealer family distributed by the campaign.

breakglass intelNews

Mar 12, 2026

Amadey's Marketplace: Inside a 100-Sample Pay-Per-Install Operation Distributing Vidar, XWorm, and 22 Other Malware Families - Breakglass Intelligence - Breakglass Intelligence

RustyStealer is listed as an information stealer distributed in the campaign.

+7 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching51

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RustyStealer