Zig-compiled malware

Malware compiled with the Zig programming language and its self-hosted compiler. Zig produces native PE/ELF/Mach-O binaries via LLVM/LLD with minimal runtime, making it an attractive target for authors who want small, self-contained executables with modern standard-library features.

Detection / Fingerprint

• Linker version: 14.0 (LLVM/LLD, consistent with Zig's LLVM backend)
• Strings: user-agent: zig/X.Y.Z, (std.http), thread {} panic: , Panicked during a panic. Aborting., TLS handshake state strings (c hs traffic, s hs traffic, finished)
• Imports: Minimal set — typically ntdll, KERNEL32, WS2_32, CRYPT32, ADVAPI32. No C++ runtime, no .NET Framework, no MSVC CRT.
• Sections: .text, .rdata, .data, .pdata, .CRT, .tls, .reloc (standard COFF sections from LLD)
• Entropy: .text moderate (~6.3), .rdata very low (~1.0–2.0) due to plaintext stdlib tables and string blobs
• No packing: Zig binaries are rarely packed; the compiler already produces tight output.

Implementation Patterns Observed

Zig's standard library embeds large amounts of cryptographic and networking code directly into the binary. A simple std.http.Client HTTPS request pulls in:

• std.crypto.tls.Client (TLS 1.3)
• std.crypto.aes (AES S-Box / Inverse S-Box tables)
• std.hash.crc (CRC32 polynomial table)
• Base64 / URL encoding tables

This creates a distinctive .rdata fingerprint: large blocks of numeric tables interspersed with Zig error names and HTTP header strings.

Reproduce on your own VMs

1. Install Zig: wget https://ziglang.org/download/0.12.0/zig-linux-x86_64-0.12.0.tar.xz
2. Write a small main.zig using std.http.Client to fetch https://example.com.
3. Build: zig build-exe -target x86_64-windows-gnu -OReleaseSmall main.zig
4. Inspect strings: strings main.exe | grep -E 'zig/|std\.http|panic'
5. Verify YARA: the silentnet_zig_012_launcher rule in dbe586b5's report should NOT match (no XOR obfuscation), but the 4 of string condition will hit.

Defensive Countermeasures

• YARA rules targeting Zig stdlib strings (see silentnet report).
• Behavioral: Zig binaries with GUI subsystem making HTTPS connections shortly after launch, especially with user-agent: zig/*.
• Static: Look for the combination of WS2_32 + CRYPT32 + ADVAPI32 with no C++ imports and no .NET metadata.

Pages where observed

• silentnet