90 lines
2.7 KiB
Markdown
90 lines
2.7 KiB
Markdown
---
|
|
name: analyzing-rust-malware-internals
|
|
description: 'Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling
|
|
Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates
|
|
for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and
|
|
its crates.'
|
|
domain: cybersecurity
|
|
subdomain: reverse-engineering
|
|
tags:
|
|
- reverse-engineering
|
|
- rust
|
|
- symbol-demangling
|
|
- crates
|
|
- stripped-binaries
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1027
|
|
- T1587.001
|
|
- T1059
|
|
d3fend:
|
|
- D3-SDA
|
|
- D3-DA
|
|
references:
|
|
- 'Rust symbol mangling (RFC 2603 v0 scheme) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html'
|
|
- 'MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/'
|
|
---
|
|
|
|
# Analyzing Rust Malware Internals
|
|
|
|
## When to Use
|
|
|
|
- You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and
|
|
enumerate crate dependencies.
|
|
- Standard analysis is hampered by Rust's name mangling and large static linking.
|
|
|
|
**Do not use** this for non-Rust binaries — confirm the Rust signature first. This skill reads the
|
|
binary statically and executes nothing.
|
|
|
|
## Prerequisites
|
|
|
|
- The Rust binary (read inertly).
|
|
|
|
## Safety & Handling
|
|
|
|
- Read bytes statically; treat strings as untrusted.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Confirm Rust and toolchain
|
|
|
|
```bash
|
|
python scripts/analyst.py info sample.bin
|
|
```
|
|
|
|
Looks for `rustc`/`cargo` markers, the `rust` panic/unwind strings, and embedded source paths
|
|
(`/rustc/<hash>/library/...`, `~/.cargo/registry/...`).
|
|
|
|
### Step 2: Demangle symbol names
|
|
|
|
Detects v0 (`_R...`) and legacy (`_ZN...17h<hash>E`) mangled symbols and demangles them to readable
|
|
paths.
|
|
|
|
### Step 3: Enumerate crates
|
|
|
|
Extract crate names/versions from `.cargo/registry/src/.../<crate>-<ver>/` paths to fingerprint
|
|
capabilities (e.g., `reqwest`, `tokio`, `aes`, `winapi`).
|
|
|
|
### Step 4: Map and document
|
|
|
|
Map notable crates to behavior and ATT&CK.
|
|
|
|
## Validation
|
|
|
|
- The Rust toolchain signature is confirmed before demangling.
|
|
- Demangled names are readable module paths (not still-mangled).
|
|
- Crate names/versions are plausible registry entries.
|
|
|
|
## Pitfalls
|
|
|
|
- Mixing v0 and legacy mangling in one binary — handle both.
|
|
- Stripped binaries where only registry path strings remain.
|
|
- Static crates inflating the symbol set; focus on the author's crate/`main`.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the analyzer/demangler.
|
|
- Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).
|