Reverse Engineering Rust Malware in 2026
Talkat RustConf 2026 · on Wednesday, 2026-09-09· at 14:00· Room 510ac | Palais des Congrès de Montréal, Palais des Congrès de Montréal·
summary
Survey of Rust malware shows >60 families since 2022, from ransomware to infostealers and RATs, with real-world cases like the arrayref compromise delivering Rust backdoors that run on Windows, macOS and Linux. Demonstrations use Binary Ninja, IDA Pro and Ghidra plus library-matching (WARP) and highlight obstacles: pervasive inlining, Rust string slices, widespread use of obfstr, embedded panic location metadata (even /home/kali cargo paths) and many binaries shipped with symbols still present.
AI-written summary · about
chapters (12)
- 0:00Introduction to Rust malware
- 1:59Rust malware ecosystem
- 10:10Obfstr string obfuscation demo
- 13:20Reverse engineering basics
- 15:34Finding fn main in Rust binaries
- 19:26Analyzing Rust strings
- 21:23Panic location metadata
- 28:11Identifying library code
- 32:05Rust calling conventions
- 35:08Teaching Rust reversing
- 37:50AI in reverse engineering
- 39:21Key takeaways
related talks
19mCounterexamples in Safe Rust
31m"From Blue Screens to Orange Crabs: Microsoft’s Rusty Revolution"
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
45mBuilding Safe and Secure Systems in Rust
33mBasic Malware Analysis for Incident Responders
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis
32mProspecting Ransomware Tech
45mRust