URLhaus-PL-d3e5d5e5289c2e39e12dc91a4e286faf64812bf68c83c1f37e88b2fac79d105c medium

Description

Malware family: RustyStealer. File type: exe. Size: 296,000 bytes. First seen: 2026-09-25 06:23:13.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Download sample (ZIP, password: infected) URLhaus
• URLhaus payload page URLhaus

• MalwareBazaar | RustyStealer - abuse.ch
  web:bazaar.abuse.ch

  RustyStealer malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as RustyStealer . Database Entry

  2026-09-25 10:01 UTC
• MalwareBazaar | SHA256 ...
  web:bazaar.abuse.ch

  Information on RustyStealer malware sample (SHA256 d3e5d5e5289c2e39e12dc91a4e286faf64812bf68c83c1f37e88b2fac79d105c) MalwareBazaar uses YARA rules from several public ...

  2026-09-25 10:01 UTC
• RustyStealer Sample Detected: Setup.exe - paragraph.com
  web:paragraph.com

  RustyStealer samples are typically distributed through phishing emails, malvertising, fake software downloads, or cracked installers. Once executed, the malware usually establishes persistence on the host, harvests credentials and sensitive data, and establishes an outbound channel to command-and-control infrastructure operated by the attackers.

  2026-09-25 10:01 UTC
• URLhaus | RustyStealer
  web:urlhaus.abuse.ch

  In case URLhaus is able to identify the associated malware family, the payload will be tagged accordingly (field signature). The page below gives you an overview on payloads that URLhaus has identified as RustyStealer .

  2026-09-25 10:01 UTC
• URLhaus | rustystealer
  web:urlhaus.abuse.ch

  URLhaus Database Malware URLs on URLhaus are usually associated with certain tags. Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with rustystealer . Database Entry

  2026-09-25 10:01 UTC
• RustyStealer Malware Profile & 7d C2 Tracker | Derp
  web:www.derp.ca

  RustyStealer is a Windows information-stealing malware family written in Rust and used to harvest credentials and other sensitive data from compromised systems. It has been observed as both a standalone stealer and a launcher carrying an encrypted payload , and open reporting indicates it can also deliver additional malware. Documented intrusion chains show RustyStealer preceding hands-on ...

  2026-09-25 10:01 UTC
• Windows Analysis Report RustyStealer.exe
  web:www.joesandbox.com

  Signatures Antivirus / Scanner detection for submitted sample Multi AV Scanner detection for submitted file Suricata IDS alerts for network traffic Found direct / indirect Syscall (likely to bypass EDR) Sets debug register (to hijack the execution of another thread) Contains functionality to call native functions Contains functionality which may be used to detect a debugger (GetProcessHeap ...

  2026-09-25 10:01 UTC
• RustyStealer - Mallory
  web:www.mallory.ai

  RustyStealer has also been reported as a payload delivered by the Amadey botnet in pay-per-install campaigns alongside other stealers, RATs, loaders, and abused remote-management tools. In those campaigns it was one of several commodity malware families distributed to harvest credentials, browser sessions, and crypto wallets.

  2026-09-25 10:01 UTC
• Trojan:Win64/RustyStealer!MSR - microsoft.com
  web:www.microsoft.com

  Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

  2026-09-25 10:01 UTC
• RustyStealer Malware - Malware removal instructions (updated) - PCrisk
  web:www.pcrisk.com

  RustyStealer is a stealer - a type of malware designed to extract/exfiltrate sensitive information. Generally, infections of this kind can result in severe privacy issues, financial losses, and even identity theft.

  2026-09-25 10:01 UTC

Only Available for Registered Users. Sign in to view.