Reborn in Rust: Attempt to thwart malware analysis
Essential information
- Published
- 26/05/2025 12:59
- Modified
- 26/05/2025 15:10
- Tags
- 2025-05-26 asyncrat command and control hardware id plugins remote access trojan reverse engineering rust rustyasyncrat system information tls
- Related entities
- 4 observables, 1 intrusion sets (apt), 11 techniques (mitre), 2 malware
Description
AsyncRAT, a remote access trojan known since 2019, has been rewritten in Rust, marking a shift from its original C# implementation. This change aims to complicate reverse engineering efforts due to limited analysis tool support for Rust. The malware retains its core functionality, including plugin installation, code execution, and persistence. It installs via scheduled tasks or temporary directory copying, stores plugins in the registry, and communicates with command and control servers over TLS. The Rust variant supports fewer commands compared to its .NET counterpart, suggesting ongoing development. The malware collects system information, including hardware ID, OS details, and antivirus software presence. Debug strings in the samples indicate active development of this Rust version.
External references
- https://feeds.feedblitz.com/~/918988475/0/gdatasecurityblog-en~Reborn-in-Rust-AsyncRAT-makes-a-move-to-counter-analysis
- https://www.gdatasoftware.com/blog/2025/05/38207-asyncrat-rust
- https://www.gdatasoftware.com/fileadmin/_processed_/3/d/G_DATA_Blog_AsyncRAT_Rust_Title_1ec19f22af.jpg
- https://otx.alienvault.com/pulse/68346595ae982472dd23e2a0