RustyStealer
RustyStealer is an information-stealing malware family and credential-harvesting tool. The provided reporting describes it as a Rust-based stealer, including a newer "RustyStealer 2" variant, and in one analyzed sample as a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload. Its primary role is theft of credentials and other user data; reporting also states it is used to harvest browser sessions and cryptocurrency wallets. In observed intrusions, RustyStealer enabled attackers to compromise legitimate high-privilege accounts that were then used for lateral movement. Open-source reporting cited in the content says RustyStealer activity has been observed before deployment of Ymir ransomware, indicating its use as an access-enabling precursor in some intrusion chains.
RustyStealer has been documented since 2021. In a Kaspersky-observed intrusion, RustyStealer infiltrated multiple systems two days before Ymir ransomware was deployed. Attackers then used compromised high-privilege accounts with WinRM and PowerShell for lateral movement and remote control, and also installed tools such as Process Hacker and Advanced IP Scanner and executed SystemBC-related scripts. Separate reporting states that after abuse of a ScreenConnect installation, the follow-on malware was RustyStealer, which both harvested credentials and delivered additional malware.
The malware appears in multiple criminal distribution ecosystems. Breakglass Intelligence reported Amadey botnet campaigns tagged fbf543 distributing RustyStealer alongside other stealers, RATs, loaders, miners, and abused RMM tools, consistent with a pay-per-install or initial-access-broker style operation. In those campaigns, RustyStealer was one of many payload families delivered over several days. The content also states that Amadey drops RustyStealer, along with Vidar, LummaStealer, SalatStealer, and SantaStealer, to harvest credentials, browser sessions, and crypto wallets.
RustyStealer is also linked in the provided content to state-aligned activity. Synaptic Systems published a technical analysis describing RustyStealer as an infostealer used by the Iranian APT group MuddyWater. Separately, Breakglass Intelligence reported a SilverFox campaign targeting Chinese-speaking individuals in which RustyStealer was used alongside ValleyRAT and Gh0stRAT. In that campaign, a RustyStealer sample was disguised as a video-themed executable, persisted itself under %ProgramData% using one of 20 legitimate-sounding executable names, and exposed development artifacts including a PDB path of launcher.pdb and a Rust cargo path under C:\Users\dev.cargo, indicating a Windows-based Rust development environment.
High-confidence behaviors directly stated in the content include credential harvesting, theft of browser sessions and cryptocurrency wallets, delivery of additional malware, and use as a precursor to broader post-compromise activity. Targeting reflected in the content includes enterprise victims in ransomware intrusion chains and Chinese-speaking individuals in SilverFox social-engineering campaigns. No stable family-wide IOC set is provided in the content, but directly mentioned artifacts include the alias "RustyStealer 2," the PDB path "launcher.pdb," persistence under %ProgramData% using legitimate-sounding filenames, and the Rust cargo development path under C:\Users\dev.cargo.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sample 4: RustyStealer ... This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesMany of the Keitaro IP addresses we saw in the AS214351 network host and distribute malware.
The lure filenames are not random. They are precision-engineered psychological operations targeting specific anxieties within Chinese-speaking populations.
Execution
2 techniquesPersistence
1 techniquePrivilege Escalation
1 techniqueStealth
2 techniquesThis is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload
RustyStealer selects from a pool of 20 legitimate-sounding executable names when writing itself to %ProgramData%
Credential Access
3 techniquesRustyStealer, essentially a credential-harvesting tool, enabled attackers to gain unauthorized access to systems by compromising legitimate high-privilege accounts useful in lateral movement.
The simultaneous deployment of three malware families (ValleyRAT for access, Gh0stRAT for persistence, RustyStealer for credential theft)
MITRE ATT&CK Mapping ... Credential Access Credentials from Password Stores: Credentials from Web Browsers T1555.003 Vidar, Lumma, Salat, Santa, Rusty stealers
Lateral Movement
2 techniquesLateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.
Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.
Command and Control
4 techniquesMITRE ATT&CK Tactic Technique ID ... Command and Control Application Layer Protocol T1071
MITRE ATT&CK Tactic Technique ID ... Command and Control Multi-Stage Channels T1104
MITRE ATT&CK Mapping ... Command and Control Ingress Tool Transfer T1105 Amadey downloads 50+ payloads to infected hosts
62[.]60[.]226[.]248 was also hosting a customized remote monitoring and management (RMM) client called ScreenConnect that auto-enrolled victims into the actor-controlled network relays.
Exfiltration
1 techniqueAccording to Kaspersky researchers who discovered Ymir during an incident response... Kaspersky has found evidence that Ymir connects to external servers that might facilitate data exfiltration, the ransomware does not feature such a capability.
IOCs tracked for this family
43 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-compiled stealer/launcher carrying a large AES-encrypted payload. It uses strong encryption, Windows cryptographic APIs, and a persistence disguise system that writes itself to %ProgramData% under one of 20 legitimate-sounding filenames to evade casual forensic review. The campaign describes it as serving the credential theft role in the kill chain.
An information stealer and credential-harvesting tool that can also deliver additional malware.
A newer Rust-based stealer family distributed by the campaign.
RustyStealer is listed as an information stealer distributed in the campaign.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.