RustyStealer
RustyStealer is a Rust-based information stealer and credential-harvesting malware family for Windows. The reporting describes it as an infostealer used to gather credentials, browser sessions, and cryptocurrency wallet data, and in some cases to deliver additional malware. It has been observed as a precursor in multi-stage intrusion chains, including incidents where it enabled compromise of legitimate high-privilege accounts that were then used for lateral movement via WinRM and PowerShell before Ymir ransomware deployment. In one Kaspersky-investigated case, a RustyStealer sample named AudioDriver2.0.exe was found on multiple systems two days before ransomware execution; that sample was placed in Windows\Temp, had MD5 5ee1befc69d120976a60a97d3254e9eb, was detected as Trojan.Win32.Sheller.ey, and communicated with C2 74.50.84[.]181 over port 443. Open-source reporting cited in the content also links RustyStealer activity to intrusion chains preceding Ymir ransomware.
RustyStealer has also been reported as a payload delivered by the Amadey botnet in pay-per-install campaigns alongside other stealers, RATs, loaders, and abused remote-management tools. In those campaigns it was one of several commodity malware families distributed to harvest credentials, browser sessions, and crypto wallets. Separate reporting attributes a RustyStealer variant to the Iranian APT group MuddyWater. Another campaign linked RustyStealer to the SilverFox threat actor targeting Chinese-speaking victims with social-engineering lures; in that case, the sample was a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload, included a PDB path of launcher.pdb and a Rust cargo path under C:\Users\dev.cargo, and persisted under %ProgramData% using one of 20 legitimate-sounding executable names. The content maps RustyStealer to MITRE ATT&CK techniques T1083, T1057, T1129, and T1027.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sample 4: RustyStealer ... This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload.
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
Credential Access
3 techniques
Credential Access
RustyStealer, essentially a credential-harvesting tool, enabled attackers to gain unauthorized access to systems by compromising legitimate high-privilege accounts useful in lateral movement.
Discovery
2 techniques
Discovery
Lateral Movement
2 techniques
Lateral Movement
Command and Control
4 techniques
Command and Control
MITRE ATT&CK Tactic Technique ID ... Command and Control Application Layer Protocol T1071
MITRE ATT&CK Tactic Technique ID ... Command and Control Multi-Stage Channels T1104
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-compiled stealer/launcher carrying a large AES-encrypted payload. It uses strong encryption, Windows cryptographic APIs, and a persistence disguise system that writes itself to %ProgramData% under one of 20 legitimate-sounding filenames to evade casual forensic review. The campaign describes it as serving the credential theft role in the kill chain.
An information stealer and credential-harvesting tool that can also deliver additional malware.
A newer Rust-based stealer family distributed by the campaign.
RustyStealer is listed as an information stealer distributed in the campaign.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.