MalwareUsed by 1 actor

RustyStealer

RustyStealer is a Windows information stealer primarily used to harvest credentials and support follow-on compromise. It can gather information about compromised systems, enumerate files and running processes, support command execution, and deliver additional malware. Observed samples use PowerShell to add Microsoft Defender folder exclusions and establish persistence through RunOnce entries and scheduled tasks. A Rust-compiled launcher variant carries an AES-encrypted payload and persists using legitimate-sounding executable names.

RustyStealer is distributed through Amadey-based pay-per-install operations and has been deployed following attacker-controlled ConnectWise ScreenConnect installations. SilverFox has distributed it using Chinese-language social-engineering lures, including a video-themed executable targeting Chinese-speaking users. Its use has also been associated with the Iranian threat group MuddyWater; these deployment associations do not establish authorship or exclusive ownership.

In a ransomware intrusion in Colombia, RustyStealer infected multiple systems two days before Ymir ransomware deployment. Harvested credentials, including those of a high-privilege account, enabled attackers to move laterally using WinRM and PowerShell. RustyStealer has also been delivered by Lcrypt0rx ransomware, demonstrating its use within multi-stage criminal intrusion chains.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Silver Fox

Sample 4: RustyStealer ... This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload.

via breakglass intelintel.breakglass.tech

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Many of the Keitaro IP addresses we saw in the AS214351 network host and distribute malware.

T1566PhishingEvidence1

The lure filenames are not random. They are precision-engineered psychological operations targeting specific anxieties within Chinese-speaking populations.

Execution

3 techniques

T1059.001PowerShellEvidence1

Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.

T1129Shared ModulesEvidence1

This sample has obfuscated content for obstructing analysis and includes shared modules indicating that the artifact can invoke functions from APIs, such as native Windows DLLs... RustyStealer TTPs... Execution Shared Modules T1129.

T1204.002Malicious FileEvidence1

The video title promises the footage. The file is an .exe.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Tactic Technique ID ... Persistence Registry Run Keys T1547.001

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Tactic Technique ID ... Persistence Registry Run Keys T1547.001

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

This sample has obfuscated content for obstructing analysis... RustyStealer TTPs... Defense evasion Obfuscated Files or Information T1027.

T1027.013Encrypted/Encoded FileEvidence1

This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload

T1036.005Match Legitimate Resource Name or LocationEvidence1

RustyStealer selects from a pool of 20 legitimate-sounding executable names when writing itself to %ProgramData%

Credential Access

3 techniques

T1003OS Credential DumpingEvidence1

RustyStealer, essentially a credential-harvesting tool, enabled attackers to gain unauthorized access to systems by compromising legitimate high-privilege accounts useful in lateral movement.

T1555Credentials from Password StoresEvidence2

The simultaneous deployment of three malware families (ValleyRAT for access, Gh0stRAT for persistence, RustyStealer for credential theft)

T1555.003Credentials from Web BrowsersEvidence1

MITRE ATT&CK Mapping ... Credential Access Credentials from Password Stores: Credentials from Web Browsers T1555.003 Vidar, Lumma, Salat, Santa, Rusty stealers

Discovery

2 techniques

T1057Process DiscoveryEvidence1

RustyStealer TTPs: Tactic Technique ID Discovery Process Discovery T1057.

T1083File and Directory DiscoveryEvidence1

The malware constantly uses the memmove function while enumerating subdirectories and files inside the affected system, so they can be encrypted later... Tactics, techniques and procedures... Discovery File and Directory Discovery T1083.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.

T1021.006Windows Remote ManagementEvidence1

Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

MITRE ATT&CK Tactic Technique ID ... Command and Control Application Layer Protocol T1071

T1104Multi-Stage ChannelsEvidence1

MITRE ATT&CK Tactic Technique ID ... Command and Control Multi-Stage Channels T1104

T1105Ingress Tool TransferEvidence1

MITRE ATT&CK Mapping ... Command and Control Ingress Tool Transfer T1105 Amadey downloads 50+ payloads to infected hosts

T1219Remote Access ToolsEvidence1

62[.]60[.]226[.]248 was also hosting a customized remote monitoring and management (RMM) client called ScreenConnect that auto-enrolled victims into the actor-controlled network relays.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

According to Kaspersky researchers who discovered Ymir during an incident response... Kaspersky has found evidence that Ymir connects to external servers that might facilitate data exfiltration, the ransomware does not feature such a capability.

INDICATORS OF COMPROMISE

IOCs tracked for this family

54 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

43 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

12 SOURCESView more in app

breakglass intelNews

Apr 1, 2026

30 Samples in 10 Days: SilverFox Weaponizes Scam Compound Fear and a Phone Farm Business Front to Target Chinese Diaspora - Breakglass Intelligence - Breakglass Intelligence

A Rust-compiled stealer/launcher carrying a large AES-encrypted payload. It uses strong encryption, Windows cryptographic APIs, and a persistence disguise system that writes itself to %ProgramData% under one of 20 legitimate-sounding filenames to evade casual forensic review. The campaign describes it as serving the credential theft role in the kill chain.

infoblox threat intel blogNews

Mar 26, 2026

Inside Keitaro Abuse Part 2: One Platform, Many Threats

An information stealer and credential-harvesting tool that can also deliver additional malware.

breakglass intelNews

Mar 12, 2026

LummaStealer's Go Loader and the fbf543 Amadey Supermarket: 50 Payloads, 13 Malware Families, and the Bulletproof Host That Ties It All Together - Breakglass Intelligence - Breakglass Intelligence

A newer Rust-based stealer family distributed by the campaign.

breakglass intelNews

Mar 12, 2026

Amadey's Marketplace: Inside a 100-Sample Pay-Per-Install Operation Distributing Vidar, XWorm, and 22 Other Malware Families - Breakglass Intelligence - Breakglass Intelligence

RustyStealer is listed as an information stealer distributed in the campaign.

+8 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching54

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RustyStealer