| name | analyzing-rust-malware-internals |
| description | Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and its crates. |
| domain | cybersecurity |
| subdomain | reverse-engineering |
| tags | ["reverse-engineering","rust","symbol-demangling","crates","stripped-binaries"] |
| version | 1.0.0 |
| author | analyst-ai-pack |
| license | Apache-2.0 |
| mitre_attack | ["T1027","T1587.001","T1059"] |
| d3fend | ["D3-SDA","D3-DA"] |
| references | ["Rust symbol mangling (RFC 2603 v0 scheme) — https://rust-lang.github.io/rfcs/2603-rust-symbol-name-mangling-v0.html","MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/"] |
Analyzing Rust Malware Internals
When to Use
- You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and
enumerate crate dependencies.
- Standard analysis is hampered by Rust's name mangling and large static linking.
Do not use this for non-Rust binaries — confirm the Rust signature first. This skill reads the
binary statically and executes nothing.
Prerequisites
- The Rust binary (read inertly).
Safety & Handling
- Read bytes statically; treat strings as untrusted.
Workflow
Step 1: Confirm Rust and toolchain
python scripts/analyst.py info sample.bin
Looks for rustc/cargo markers, the rust panic/unwind strings, and embedded source paths
(/rustc/<hash>/library/..., ~/.cargo/registry/...).
Step 2: Demangle symbol names
Detects v0 (_R...) and legacy (_ZN...17h<hash>E) mangled symbols and demangles them to readable
paths.
Step 3: Enumerate crates
Extract crate names/versions from .cargo/registry/src/.../<crate>-<ver>/ paths to fingerprint
capabilities (e.g., reqwest, tokio, aes, winapi).
Step 4: Map and document
Map notable crates to behavior and ATT&CK.
Validation
- The Rust toolchain signature is confirmed before demangling.
- Demangled names are readable module paths (not still-mangled).
- Crate names/versions are plausible registry entries.
Pitfalls
- Mixing v0 and legacy mangling in one binary — handle both.
- Stripped binaries where only registry path strings remain.
- Static crates inflating the symbol set; focus on the author's crate/
main.
References
