Researchers Compared Malware Development in Rust vs C & C++ Languages

In recent years, malware authors have increasingly turned to emerging programming languages like Rust, Nim, and Go for their nefarious creations.

This shift represents a tactical evolution as threat actors seek to bypass modern security solutions and complicate reverse engineering efforts.

A comprehensive analysis conducted in 2023 by the Rochester Institute of Technology aimed to assess whether malware developed in Rust truly presents greater challenges to security analysts than traditional C/C++ implementations.

The investigation revealed two primary hypotheses driving this trend: that binaries compiled in Rust are inherently more difficult to reverse engineer than C/C++ equivalents, and that malware developed in unconventional languages is more likely to evade signature-based detection mechanisms.

These hypotheses suggest that language selection has become a strategic consideration for attackers seeking to maximize operational effectiveness while minimizing detection risk.

BishopFox researchers noted significant differences when comparing functionally identical shellcode loaders written in both languages.

Their analysis demonstrated that Rust-based malware binaries were substantially larger than their C counterparts—151.5KB versus 71.7KB—potentially increasing the complexity and time required for thorough analysis by security professionals.

The comparative study utilized identical shellcode that launches calc.exe through memory injection techniques.

When executed in controlled environments, both implementations achieved the same results, but presented dramatically different challenges for analysts during static analysis and reverse engineering phases.

Reverse Engineering Complexity

The most striking distinction emerged during decompilation attempts using industry-standard tools like Ghidra.

When analyzing the C implementation, researchers obtained clean, readable decompiled output that closely resembled the original source code:-

int local_14;
FILE *local_10;
__main();
local_10 = fopen("shellcode/calc.bin","rb");
fseek(local_10,0,2);
local_14 = ftell(local_10);
// Additional code truncated

In stark contrast, the decompiled Rust equivalent produced nearly incomprehensible output with complex memory management patterns.

This difficulty stems from Rust’s compile-time optimizations, including function inlining and highly efficient but obfuscated assembly generation.

The research conclusively demonstrates that while Ghidra version 11.0 introduced Rust symbol name de-mangling capabilities, significant challenges remain in effectively analyzing Rust-based malware.

For security professionals, this signals the need for advanced analysis techniques when confronting the growing threat of malware written in emerging programming languages.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free