216.73.216.226

Inside Akira Ransomware's Rust Experiment

· Published 03/12/2024 22:42 · Modified 04/12/2024 09:21

Export JSON

Essential information

Published
03/12/2024 22:42
Modified
04/12/2024 09:21
Tags
2024-12-03 akira ransomware rust
Related entities
1 intrusion sets (apt), 17 techniques (mitre), 1 malware, 1 others

Description

Check Point Research analyzed the version of that targeted ESXi servers in early 2024. The malware's complex assembly is attributed to idioms, boilerplate code, and compiler strategies. The analysis reveals the 's use of the seahorse CLI framework, indicatif library for progress reporting, and a hybrid encryption approach using curve25519 and SOSEMANUK. The malware's default behavior targets ESXi VMs, but it can also function as general-purpose Linux . The study highlights the challenges in reverse-engineering binaries due to aggressive inlining and optimization, emphasizing the need for advanced tooling to identify spliced inline code.

External references