Digging through Rust to find Gold: Extracting…

This report examines the rising use of Rust for malware and provides practical reverse-engineering guidance: building and disassembling Rust binaries, locating the main function via std::rt::lang_start_internal, extracting crate dependency strings and PDB paths that can leak build-time information, and handling Rust-specific analysis challenges. It includes an analysis of an unknown Rust sample (SHA256: 8f47d1e39242ee4b528fcb6eb1a89983c27854bac57bc4a15597b37b7edf34a6), highlights examples like BlackCat ransomware and Luca Stealer, and concludes that Rust’s evolving compilation and ABI behaviors hinder detection and static analysis, urging more dynamic analysis and tooling improvements.