Author: Virus Bulletin - Bewertung: 0x - Views:1
Inside Akira, ransomware's Rust experiment
Presented at the VB2025 conference in Berlin, 24 - 26 September 2025.
↓ Slides: N/A
↓ Paper: https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/Inside-Akira-ransomwares-Rust-experiment.pdf
→ Details: https://www.virusbulletin.com/conference/vb2025/abstracts/inside-akira-ransomwares-rust-experiment/
✪ PRESENTED BY ✪
• Ben Herzog (Check Point Software Technologies)
✪ ABSTRACT ✪
Rust binaries are notoriously resistant to "full RE" that maps the binary functionality end to end. In this research, we do just that – analysing "Akira v2", a Rust-based encryptor circulated by the prolific Akira RaaS group in early 2024. We work through the binary's opaque, sometimes barely documented, built-in types; its aggressively recursive in-lining of library code; and other "surprises" prepared for us by the Rust compiler. We explain in detail how we approached all these obstacles, and how one can methodically cross-reference Rust docs and idioms to understand code that would otherwise be impenetrable. We lay out the binary's structure, control flow, and even some of the original author's design process – and we see how all these factors translate into assembly, sometimes in surprising ways.