Analyzing Rust Malware Internals

---
name: analyzing-rust-malware-internals
description: 'Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling
  Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates
  for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and
  its crates.'
domain: cybersecurity
subdomain: reverse-engineering
tags:
  - reverse-engineering
  - rust
  - symbol-demangling
  - crates
  - stripped-binaries
version: 1.0.0
author: analyst-ai-pack
license: Apache-2.0
mitre_attack:
  - T1027
  - T1587.001
  - T1059
d3fend:
  - D3-SDA
  - D3-DA
references:
  - 'Rust symbol mangling (RFC 2603 v0 scheme) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html'
  - 'MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/'
---

# Analyzing Rust Malware Internals

## When to Use

- You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and
  enumerate crate dependencies.
- Standard analysis is hampered by Rust's name mangling and large static linking.

**Do not use** this for non-Rust binaries — confirm the Rust signature first. This skill reads the
binary statically and executes nothing.

## Prerequisites

- The Rust binary (read inertly).

## Safety & Handling

- Read bytes statically; treat strings as untrusted.

## Workflow

### Step 1: Confirm Rust and toolchain

```bash
python scripts/analyst.py info sample.bin
```

Looks for `rustc`/`cargo` markers, the `rust` panic/unwind strings, and embedded source paths
(`/rustc/<hash>/library/...`, `~/.cargo/registry/...`).

### Step 2: Demangle symbol names

Detects v0 (`_R...`) and legacy (`_ZN...17h<hash>E`) mangled symbols and demangles them to readable
paths.

### Step 3: Enumerate crates

Extract crate names/versions from `.cargo/registry/src/.../<crate>-<ver>/` paths to fingerprint
capabilities (e.g., `reqwest`, `tokio`, `aes`, `winapi`).

### Step 4: Map and document

Map notable crates to behavior and ATT&CK.

## Validation

- The Rust toolchain signature is confirmed before demangling.
- Demangled names are readable module paths (not still-mangled).
- Crate names/versions are plausible registry entries.

## Pitfalls

- Mixing v0 and legacy mangling in one binary — handle both.
- Stripped binaries where only registry path strings remain.
- Static crates inflating the symbol set; focus on the author's crate/`main`.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the analyzer/demangler.
- Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).