Loading malware…
RustSL is a Rust-based modular shellcode loader and antivirus-evasion framework that has been used both as a publicly available offensive tool and as the basis for customized malware loaders in real intrusion campaigns. It is designed to generate statically linked payload loaders with flexible compile-time options, multiple shellcode transformation and encryption schemes, anti-analysis checks, and varied memory allocation and execution techniques intended to reduce detection by antivirus and EDR products. Documented capabilities include anti-sandbox and anti-virtualization checks, indirect and VEH-based syscall execution, multiple local and remote payload-loading methods, and numerous shellcode execution and injection options.
In operational use, a modified RustSL variant has been associated with the Silver Fox threat group. In campaigns observed from late 2025 into early 2026, Silver Fox used tax-themed phishing lures to deliver archives containing executables disguised as document files. These customized RustSL samples unpacked encrypted embedded payloads, performed geofencing through public GeoIP services, and in some cases implemented a reboot-based persistence method referred to as Phantom Persistence. The loader was used to download and execute ValleyRAT, which in turn delivered additional malware including the Python-based ABCDoor backdoor.
RustSL primarily targets Windows in the observed malicious campaigns and functions as a loader for post-compromise payload delivery. Its significance lies in combining modular loader generation, anti-analysis features, and flexible execution paths with straightforward adaptation by threat actors for geographically filtered phishing operations and staged malware deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
В архиве - исполняемый файл с иконкой Adobe PDF, на деле - загрузчик Silver Fox RustSL.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities.
Оба варианта рассылки пытаются сыграть на важности писем от налоговых органов, чтобы убедить жертву скачать документ и запустить цепочку атаки.
MITRE ATT&CK: ... Obfuscated Files or Information (T1027, Defense Evasion)... Реализует распаковку нагрузки: зашифрованный payload размещается между маркерами <RSL_START> и <RSL_END>... Расшифровка - XOR с жёстко закодированным ключом RSL_STEG_2025_KEY.
MITRE ATT&CK: Masquerading (T1036, Defense Evasion)... Исполняемый файл из архива - модифицированная версия Rust-загрузчика RustSL... зашифрованный payload размещается... в файлах с расширениями .png, .htm, .md, .log, .xlsx, .ico, .cfg, .map, .xml или .old.
guard.rs... реализует различные проверки среды и страны запуска. В самых первых образцах загрузчиков ... использовала все доступные методы обнаружения виртуальных машин и песочниц
guard.rs... реализует различные проверки среды и страны запуска. В самых первых образцах загрузчиков ... использовала все доступные методы обнаружения виртуальных машин и песочниц
В более поздних версиях осталась только геолокационная проверка... Для определения страны Silver Fox RustSL отправлял запросы на пять публичных сервисов
Another module added to Silver Fox RustSL is guard.rs. It implements various environment checks and country-based geofencing.
The end goal of the Silver Fox RustSL variant is to unpack the encrypted malicious payload, while implementing country-based geofencing... While the GitHub variant only includes China in its country list, the bespoke version features India, Indonesia, South Africa, Russia, and Cambodia.
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Кастомизированный Rust-загрузчик, используемый Silver Fox для доставки последующих полезных нагрузок. Маскируется под легитимные файлы, распаковывает зашифрованный payload из файлов-приманок, выполняет геолокационную фильтрацию через несколько публичных Geo-IP сервисов и в отдельных образцах использует технику Phantom Persistence.
RustSL is a modified Rust-based loader adapted by Silver Fox from a public GitHub repository. The customized version includes steganography-based payload unpacking, environment checks, and country-based geofencing. It disguises itself with PDF or Excel icons, loads encrypted shellcode, downloads ValleyRAT components, and implements 'Phantom Persistence' by intercepting shutdown signals and forcing reboot-based re-execution.
An open-source shellcode loader whose modified variant unpacks encrypted malicious payloads, performs geofencing and environment checks, establishes persistence via Phantom Persistence, and downloads ValleyRAT.
An open-source shellcode loader and antivirus bypass framework modified by Silver Fox to unpack encrypted payloads, apply geofencing, perform VM/sandbox checks, establish persistence in some variants, and download/execute ValleyRAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.