# Analyzing Rust Malware Internals

> Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-rust-malware-internals`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/analyzing-rust-malware-internals
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-rust-malware-internals
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Analyzing Rust Malware Internals

## When to Use

- You have a Rust-compiled binary and need to confirm the toolchain, demangle symbol names, and
  enumerate crate dependencies.
- Standard analysis is hampered by Rust's name mangling and large static linking.

**Do not use** this for non-Rust binaries — confirm the Rust signature first. This skill reads the
binary statically and executes nothing.

## Prerequisites

- The Rust binary (read inertly).

## Safety & Handling

- Read bytes statically; treat strings as untrusted.

## Workflow

### Step 1: Confirm Rust and toolchain

```bash
python scripts/analyst.py info sample.bin
```

Looks for `rustc`/`cargo` markers, the `rust` panic/unwind strings, and embedded source paths
(`/rustc//library/...`, `~/.cargo/registry/...`).

### Step 2: Demangle symbol names

Detects v0 (`_R...`) and legacy (`_ZN...17hE`) mangled symbols and demangles them to readable
paths.

### Step 3: Enumerate crates

Extract crate names/versions from `.cargo/registry/src/.../-/` paths to fingerprint
capabilities (e.g., `reqwest`, `tokio`, `aes`, `winapi`).

### Step 4: Map and document

Map notable crates to behavior and ATT&CK.

## Validation

- The Rust toolchain signature is confirmed before demangling.
- Demangled names are readable module paths (not still-mangled).
- Crate names/versions are plausible registry entries.

## Pitfalls

- Mixing v0 and legacy mangling in one binary — handle both.
- Stripped binaries where only registry path strings remain.
- Static crates inflating the symbol set; focus on the author's crate/`main`.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the analyzer/demangler.
- Rust v0 mangling RFC and ATT&CK T1027 (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-analyzing-rust-malware-internals
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.