> Family · rustystealer — Rust x64 crypto clipboard clipper family (also known as xeno_clipper)_

~/packetpursuit $ cat /intel/families/rustystealer.md

typeentityconfidencemediumcreated2026-08-04updated2026-08-04malware-familyinfostealerclipperpecompilerc2collectiondefense-evasion

rustystealer

Overview

Windows PE32+ x64 cryptocurrency clipboard clipper compiled in Rust (MSVC target). Replaces copied wallet addresses with attacker-controlled ones using a compiled regex-automata engine for multi-chain address validation. The PDB path reveals the internal project name xeno_clipper; the builder username is twito. First observed in the PacketPursuit corpus on 2026-08-04.

The OpenCTI label rustystealer may be an umbrella tag; this sample is the first rustystealer-labelled entry in the wiki. The xeno_clipper name appears only in the PDB and should not be confused with the .NET RAT family xenorat (moom825).

Build Stack

  • Toolchain: Rust stable-x86_64-pc-windows-msvc (rustc 01f6ddf7) ^[sample 09157be3/strings.txt]
  • Architecture: PE32+ x64, Windows GUI subsystem ^[sample 09157be3/rabin2-info.txt]
  • Sections: 5 standard sections (.text, .rdata, .data, .pdata, .reloc) ^[sample 09157be3/rabin2-info.txt]
  • Dependencies: VCRUNTIME140.dll, ucrt, USER32.dll, KERNEL32.dll ^[sample 09157be3/rabin2-imports.txt]
  • Crates: regex-1.12.3, regex-automata-0.4.14, regex-syntax-0.8.10, aho-corasick-1.1.4, memchr-2.8.0 ^[sample 09157be3/strings.txt]
  • Signing: None ^[sample 09157be3/rabin2-info.txt]
  • Packing: None ^[sample 09157be3/binwalk.txt]

Deploy / TTPs

Technique ID Evidence
Input Capture: Clipboard Data T1115 OpenClipboard, GetClipboardData, SetClipboardData, EmptyClipboard ^[sample 09157be3/rabin2-imports.txt]
Data from Local System T1005 Clipboard enumeration for wallet addresses ^[sample 09157be3/strings.txt:1009-1012]
Masquerading T1036.005 Windows GUI subsystem, no console window ^[sample 09157be3/rabin2-info.txt]
Application Layer Protocol T1071.001 Hypothesized runtime-resolved network API via LoadLibraryA/GetProcAddress ^[sample 09157be3/rabin2-imports.txt]

Capabilities

  • clipboard-hijack-cryptocurrency
  • regex-engine-address-validation
  • bitcoin-bech32-clip
  • cardano-shelley-clip
  • ethereum-erc20-clip
  • dogecoin-base58-clip
  • rust-msvc-build-artefacts
  • xeno-clipper-pdb-fingerprint
  • twito-builder-path
  • runtime-api-resolution-via-loadlibrary
  • no-static-c2-obfuscated-or-external

Notable Analyses

  • /intel/analyses/09157be351149beef1bc7c1bba9cc37daa830d300f3c6a5eb9aa1acd3c9449f3.html — 09157be3, Rust x64 PE32+ clipper, builder twito, static-only

Related Entities

  • clipboard-hijack-cryptocurrency — cross-family concept: clipboard monitoring and address replacement
  • xenorat — distinct .NET RAT family by moom825; not related despite similar naming
  • unclassified-pe32-clipper — MSVC C++ x86 clipper with Telegram C2 and 14-coin regex coverage; different build stack
  • maskgramstealer — MinGW-w64 PE64 clipper with Telegram C2 and wallet-seed regex
  • dolphin — Rust RAT/clipper with browser/wallet injection and WebSocket C2; higher complexity