reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-rust-malware-internals/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-rust-malware-internals	Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and its crates.	cybersecurity	reverse-engineering	reverse-engineering rust symbol-demangling crates stripped-binaries	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1587.001 T1059	D3-SDA D3-DA	Rust symbol mangling (RFC 2603 v0 scheme) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/

Analyzing Rust Malware Internals

When to Use

• You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and enumerate crate dependencies.
• Standard analysis is hampered by Rust's name mangling and large static linking.

Do not use this for non-Rust binaries — confirm the Rust signature first. This skill reads the binary statically and executes nothing.

Prerequisites

• The Rust binary (read inertly).

Safety & Handling

• Read bytes statically; treat strings as untrusted.

Workflow

Step 1: Confirm Rust and toolchain

python scripts/analyst.py info sample.bin

Looks for rustc/cargo markers, the rust panic/unwind strings, and embedded source paths (/rustc/<hash>/library/..., ~/.cargo/registry/...).

Step 2: Demangle symbol names

Detects v0 (_R...) and legacy (_ZN...17h<hash>E) mangled symbols and demangles them to readable paths.

Step 3: Enumerate crates

Extract crate names/versions from .cargo/registry/src/.../<crate>-<ver>/ paths to fingerprint capabilities (e.g., reqwest, tokio, aes, winapi).

Step 4: Map and document

Map notable crates to behavior and ATT&CK.

Validation

• The Rust toolchain signature is confirmed before demangling.
• Demangled names are readable module paths (not still-mangled).
• Crate names/versions are plausible registry entries.

Pitfalls

• Mixing v0 and legacy mangling in one binary — handle both.
• Stripped binaries where only registry path strings remain.
• Static crates inflating the symbol set; focus on the author's crate/main.

References

• See references/api-reference.md for the analyzer/demangler.
• Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).