Loading malware…
RustyStealer is a Windows information-stealing malware family used primarily to harvest credentials and support follow-on intrusions. Stolen credentials, including those belonging to privileged accounts, have enabled attackers to access additional systems and move laterally within compromised enterprise networks. Its documented reconnaissance behaviors include file and directory discovery and process enumeration.
RustyStealer uses PowerShell to add Microsoft Defender folder exclusions and establishes persistence through RunOnce entries and scheduled tasks. An analyzed Rust-compiled launcher carried an AES-encrypted payload and selected from multiple legitimate-looking executable names when installing itself, combining payload concealment with masquerading.
Distribution has included deployment by the Amadey botnet through pay-per-install operations, downloading by Lcrypt0rx ransomware, and installation after attackers established access using ConnectWise ScreenConnect. RustyStealer has also appeared in SilverFox campaigns targeting Chinese-speaking users, including a malicious executable presented as a video-themed lure.
In a documented ransomware incident in Colombia, RustyStealer infected multiple systems two days before Ymir ransomware was deployed. Attackers subsequently abused stolen privileged credentials and used WinRM and PowerShell for lateral movement and remote control. This operational association does not make RustyStealer itself ransomware or establish that its operators are the same as those deploying Ymir.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sample 4: RustyStealer ... This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Many of the Keitaro IP addresses we saw in the AS214351 network host and distribute malware.
The lure filenames are not random. They are precision-engineered psychological operations targeting specific anxieties within Chinese-speaking populations.
Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.
This sample has obfuscated content for obstructing analysis and includes shared modules indicating that the artifact can invoke functions from APIs, such as native Windows DLLs... RustyStealer TTPs... Execution Shared Modules T1129.
The video title promises the footage. The file is an .exe.
MITRE ATT&CK Tactic Technique ID ... Persistence Registry Run Keys T1547.001
MITRE ATT&CK Tactic Technique ID ... Persistence Registry Run Keys T1547.001
This sample has obfuscated content for obstructing analysis... RustyStealer TTPs... Defense evasion Obfuscated Files or Information T1027.
This is a Rust-compiled launcher carrying a 5.5 MB AES-encrypted payload
RustyStealer selects from a pool of 20 legitimate-sounding executable names when writing itself to %ProgramData%
RustyStealer, essentially a credential-harvesting tool, enabled attackers to gain unauthorized access to systems by compromising legitimate high-privilege accounts useful in lateral movement.
The simultaneous deployment of three malware families (ValleyRAT for access, Gh0stRAT for persistence, RustyStealer for credential theft)
MITRE ATT&CK Mapping ... Credential Access Credentials from Password Stores: Credentials from Web Browsers T1555.003 Vidar, Lumma, Salat, Santa, Rusty stealers
RustyStealer TTPs: Tactic Technique ID Discovery Process Discovery T1057.
The malware constantly uses the memmove function while enumerating subdirectories and files inside the affected system, so they can be encrypted later... Tactics, techniques and procedures... Discovery File and Directory Discovery T1083.
Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.
Lateral movement across the network was facilitated using tools like Windows Remote Management (WinRM) and PowerShell for remote control.
MITRE ATT&CK Tactic Technique ID ... Command and Control Application Layer Protocol T1071
MITRE ATT&CK Tactic Technique ID ... Command and Control Multi-Stage Channels T1104
MITRE ATT&CK Mapping ... Command and Control Ingress Tool Transfer T1105 Amadey downloads 50+ payloads to infected hosts
62[.]60[.]226[.]248 was also hosting a customized remote monitoring and management (RMM) client called ScreenConnect that auto-enrolled victims into the actor-controlled network relays.
According to Kaspersky researchers who discovered Ymir during an incident response... Kaspersky has found evidence that Ymir connects to external servers that might facilitate data exfiltration, the ransomware does not feature such a capability.
54 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.