Inside Akira, ransomware's Rust experiment — Ben Herzog, Check Point скачать в хорошем качестве

Inside Akira, ransomware's Rust experiment — Ben Herzog, Check Point

Inside Akira, ransomware's Rust experiment Presented at the VB2025 conference in Berlin, 24 - 26 September 2025. ↓ Slides: N/A ↓ Paper: https://www.virusbulletin.com/uploads... → Details: https://www.virusbulletin.com/confere... ✪ PRESENTED BY ✪ • Ben Herzog (Check Point Software Technologies) ✪ ABSTRACT ✪ Rust binaries are notoriously resistant to "full RE" that maps the binary functionality end to end. In this research, we do just that – analysing "Akira v2", a Rust-based encryptor circulated by the prolific Akira RaaS group in early 2024. We work through the binary's opaque, sometimes barely documented, built-in types; its aggressively recursive in-lining of library code; and other "surprises" prepared for us by the Rust compiler. We explain in detail how we approached all these obstacles, and how one can methodically cross-reference Rust docs and idioms to understand code that would otherwise be impenetrable. We lay out the binary's structure, control flow, and even some of the original author's design process – and we see how all these factors translate into assembly, sometimes in surprising ways.