One on one with Rust

One on One with Rust ☹️

Recently, the complex threat research group of Positive Technologies’ TI department has been increasingly encountering malware written in Rust. The malware can be either very simple or very complex in its implementation, and most often this complexity is due to the features of the Rust language.

Public reports show a trend not only toward an increase in the frequency of Rust being used by various threat actors as a language for their tools, but also a trend toward these tools becoming more complex.

While initially mostly simple loaders, droppers, injectors, or auxiliary tools for reconnaissance on the victim’s system were used, later Rust began to be used for writing ransomware and C2 frameworks, both open-source and closed-source.

☕️ In the article we will tell what approaches we use for successful reverse engineering of Rust binary files, what difficulties we encounter, and how we overcome them.

#TI #Malware #Rust
@ptescalator