Introduction: The Dawn of 64-Bit Malware
On May 26, 2004, the digital world witnessed a quiet but significant milestone. Security researchers Peter Ferrie and Peter Szor at Symantec Security Response received a sample of what would become known as W64/Rugrat.3344 — the first confirmed virus targeting the 64-bit Windows operating system running on Intel’s Itanium platform .
At the time, 64-bit computing was still an exotic frontier. Microsoft had been demonstrating the platform with claims that porting code was trivial — one famous demo featured “Larry” who supposedly ported a million lines of C code in just two weeks . But as the Rugrat virus demonstrated, writing assembly for the Itanium architecture was an entirely different beast. This wasn’t your grandmother’s code porting project.
As a forensic researcher examining this specimen nearly two decades later, the sophistication becomes clear. Rugrat wasn’t just a proof-of-concept — it was a declaration. A message that the 64-bit future would not remain malware-free for long.
Threat Profile: W64/Rugrat.3344 at a Glance
| Attribute | Details |
|---|---|
| Full Name | W64/Rugrat.3344 (also known as Win64.Rugrat.a) |
| Discovery Date | May 26, 2004 |
| Platform | Windows 64-bit (Intel Itanium / IA64 architecture) |
| Type | Direct-action parasitic file infector |
| Infection Targets | IA64 Portable Executable (PE) files |
| Payload | None — proof-of-concept only |
| Threat Level | Low (rated “1” on Symantec’s 1-5 scale) |
| Author Attribution | “Shrug – roy g biv” (member of 29A virus-writing group) |
| Family Association | W32/Chiton family — six previous “first” viruses |
Attribution: The 29A Connection
One of the most compelling forensic threads in Rugrat’s analysis is its origin. The virus body contains the string “Shrug – roy g biv”, linking it to the notorious 29A virus-writing group . For those unfamiliar, 29A (hex for 666) was perhaps the most technically sophisticated virus-writing collective in history, operating from 1996 until its dissolution in 2008 .
The 29A group was responsible for numerous malware “firsts”:
- Cabir — the first mobile phone virus
- Duts — the first virus for Windows CE
- Winux — the first cross-platform virus infecting both Windows and Linux
- Dotnut — the first .NET virus
Rugrat’s author had already made their mark with the W32/Chiton family — six proof-of-concept viruses, each demonstrating novel infection techniques. These included W32/Shrug (first to use Thread Local Storage structures) and W32/Chthon (first native Windows application virus) . Rugrat represented the natural evolution: taking those hard-won lessons into 64-bit territory.
Architectural Challenges: Why IA64 Matters
To understand Rugrat’s technical sophistication, one must first understand the Itanium architecture. Intel’s IA64 was fundamentally different from x86. It was designed around explicit parallelism — instructions grouped into “bundles” of three slots that execute simultaneously . Writing efficient code required thinking in parallel, a skill few assembly programmers possessed.
The Predication Problem
IA64 introduced the concept of “predication” to eliminate branches. Instead of conditional jumps, instructions could be conditionally executed based on predicate registers (p1, p2, etc.). Rugrat’s filtering code contains over 30 predicated instructions in a row, including predicated compares that reuse active predicate registers . Forensic analysts at the time called this “predication abuse.”
Consider this code snippet from the virus’s file-type validation:
ld2 r30 = [r32]
mov r31 = 0x5A4D
cmp.eq p1 = r30, r31
(p1) ld4 r30 = [r8]
(p1) mov r31 = 0x4550
(p1) cmp.eq p1 = r30, r31The first cmp sets predicate register P1 only if the condition matches. If not, every instruction predicated by P1 is silently ignored by the processor . This creates a dense, branchless code flow that’s difficult to read and even harder to analyze — exactly as intended.
The Global Pointer Convention
Another IA64 quirk that Rugrat exploits is the Global Pointer (GP) mechanism. To avoid costly relocations, IA64 executables use a global pointer stored in the GlobalPtr PE header field. Every structure that requires addressing — exported functions, vectored exception handlers, even Thread Local Storage callbacks — must be supplied as a PLABEL_DESCRIPTOR: a virtual address followed by a global pointer value .
Rugrat correctly supplies these structures. The virus carries its own Thread Local Storage directory and callback array for hosts lacking them. When infecting files that already have TLS callbacks, it surgically replaces the first callback address with its own while saving the original .
Infection Vector: The TLS Execution Trick
Rugrat’s most elegant feature is its use of Thread Local Storage (TLS) for execution. This was not a new technique — its predecessor Chiton used it in 32-bit Windows — but implementing it in 64-bit required significant adaptation.
The Detach-Only Strategy
The virus executes only during the DLL_PROCESS_DETACH event — when an application is exiting . This is a deliberate stealth choice: a slow startup is highly suspicious to users, but a slow shutdown often goes unnoticed. The virus simply waits for the host program to terminate before performing its infection routine.
Register Forensics: The B0 Pointer
During TLS initialization, it’s NTDLL.DLL (the Native API) that calls the TLS entry point. On Itanium processors, this call leaves a pointer into NTDLL’s address space in the B0 register . Rugrat captures this pointer to gain access to NTDLL without needing to locate it through traditional means — a clever form of register-based API resolution.
CRC API Resolution
Rugrat uses a CRC method to match API names rather than storing them as plain strings . This serves two purposes:
- Obfuscation — the API names aren’t visible in the virus body
- Size reduction — 32-bit checksums take less space than function name strings
The virus imports functions from three libraries:
From NTDLL.DLL:
LdrGetDllHandle()— to gain access to other modulesRtlAddVectoredExceptionHandler()— installs exception protectionRtlRemoveVectoredExceptionHandler()— cleans up
From KERNEL32.DLL (16 functions total):
CreateFileMappingA()/MapViewOfFile()/UnmapViewOfFile()— file mapping for infectionCreateFileW()/FindFirstFileW()/FindNextFileW()— Unicode file enumerationSetFileAttributesW()/SetFileTime()— attribute and timestamp restorationGlobalAlloc()/GlobalFree()— memory managementGetTickCount()— potentially for entropy or timing
From SFC_OS.DLL:
SfcIsFileProtected()— avoids infecting System File Checker-protected files
Notably, Rugrat uses only Unicode functions, unlike its 32-bit predecessor. This reflects the reality that 64-bit Windows is based on Windows NT, which is entirely Unicode under the hood .
Exception Handling: The Elegant Control Flow
One of Rugrat’s most sophisticated techniques is its use of Vectored Exception Handling (VEH) . Unlike Structured Exception Handling (SEH), which is stack-based and vulnerable to exploitation, VEH is heap-based and provides “up-front” exception control . Introduced in Windows XP, VEH gives handlers priority over SEH handlers .
The Exception Exit Pattern
Rugrat’s code contains two instances where it forces an exception to exit a routine. Since the virus has already installed a vectored exception handler to catch errors during infection, simulating an error condition results in execution of a common cleanup block . This eliminates the need for separate success and failure handlers — a clever size optimization.
The LD1 R8 = [R0] Instruction
The exception-causing instruction itself is subtle. On IA64, the R0 register always contains zero. The instruction LD1 R8 = [R0] attempts to read the 0th byte of memory — address 0x0 — which always causes an access violation .
But why this specific instruction? The answer lies in IA64’s bundle architecture. Instructions are grouped in bundles of three slots. If an exception occurs in a bundle with other instructions, those instructions could be interrupted. Worse, when resuming from an exception handler, execution continues from the specific slot where the exception occurred — skipping any earlier slots in the same bundle .
The virus author chose LD1 because it is always placed in the first slot of a bundle, ensuring predictable exception behavior.
File Infection Methodology
Rugrat performs a standard direct-action file infection, meaning it stops running immediately after infecting files rather than staying resident .
Directory Traversal: Linked List vs. Recursion
The virus searches the current directory and all subdirectories using a linked list rather than recursion . This choice reflects the fact that the .B variant infects DLLs, which can have very small stack sizes. A recursive traversal might overflow the stack; a linked list iterates safely.
Infection Filters
Files are examined regardless of their suffix, but must pass a strict set of filters :
- System File Checker check — files protected by SFC (Windows XP/2003) are skipped
- Architecture validation — must be IA64 character mode or GUI application
- Digital certificate check — files with certificates are not infected
- Image integrity — no bytes outside the image (no overlays)
Code Placement Strategy
If relocation data exist at the end of the file, Rugrat moves the data to a larger offset and places its code in the created gap. If no relocation data exist, the virus code is appended directly . For the .A variant (which doesn’t infect DLLs), the relocation check is rarely used since most executables lack relocation data.
The .B variant, however, infects DLLs using the same method — meaning even “resource-only” DLLs without a main entry point can still be infection sources, as the TLS entry point will still be called .
Stealth Operations
After infection, Rugrat:
- Restores the host’s original timestamp
- Resets file attributes (cleared before infection)
- Calculates a new file checksum if one existed previously
The Forensic Trail: Detection and Analysis
Strings Analysis
The virus contains two notable strings that were never displayed:
'Shrug - roy g biv'— author attribution'06/05/04'— possibly the creation date
File Size Anomalies
Rugrat appends a random number of zero bytes to the end of the virus body . This creates variable-length infections that might evade simple signature detection.
Registry and Filesystem Footprint
Unlike worms, Rugrat does not modify the registry or create new files. Its only action is infecting PE files in the current directory and subdirectories. This minimal footprint made it difficult to detect through traditional heuristic means.
Broader Context: The 2004 Security Landscape
Rugrat’s appearance in May 2004 was part of a wave of “firsts” in malware history. The same year saw the release of Cabir (first mobile phone virus) and continued evolution of the Sasser worm family.
The 29A group was at the height of its influence. Their online magazine, released in irregular intervals, contained source code for some of the most technically advanced malware ever created. When Russian authorities arrested a 29A member in November 2004, fining him just 3,000 rubles, it signaled the beginning of the group’s decline .
Microsoft’s 64-bit strategy was still unfolding. The Itanium platform was expensive and niche — a far cry from the AMD64 (x86-64) architecture that would eventually dominate. As the article’s authors presciently noted: “The news of AMD64 is spreading, and systems are sold for as little as $700” . They concluded: “How much smoother could the transition be for the virus writers?”
Legacy and Significance
Rugrat was never a widespread threat. Its threat rating was “Low” across all major antivirus vendors . But its significance was never about prevalence — it was about possibility.
The virus demonstrated that:
- 64-bit malware was feasible — the architecture, while complex, could be exploited
- Existing techniques ported — TLS infection, CRC resolution, and VEH all worked in 64-bit
- The author understood the platform — predication, bundles, global pointers — all handled correctly
- Defenses were insufficient — SFC protection was bypassed for non-protected files
As the original analysis concluded with a quote from Rugrats (the cartoon, not the virus): “Let’s hope that this baby doesn’t grow up” .
Modern Relevance: Why Rugrat Still Matters
For today’s forensic analysts and security researchers, Rugrat offers enduring lessons:
First, the importance of platform understanding. Malware authors study architecture manuals — defenders must do the same. Rugrat’s author clearly read the Intel IA64 instruction set guide; the code reflects deep knowledge of bundle alignment, predicate registers, and exception semantics.
Second, the value of minimalism. Rugrat’s code is compact, efficient, and stealthy. Modern malware could learn from its restraint: no unnecessary persistence, no noisy payload, just effective infection.
Third, the persistence of proof-of-concept. Rugrat demonstrated that “firsts” matter in malware evolution. Each new platform, each new architecture, each new feature will eventually attract attention from those seeking to be the first to exploit it.
Technical Summary
| Category | Details |
|---|---|
| File Type | IA64 Portable Executable (PE) |
| Infection Type | Parasitic appender/inserter |
| Entry Point | Thread Local Storage callback |
| API Resolution | CRC32 checksums |
| Exception Handling | Vectored Exception Handler (VEH) |
| File Enumeration | Linked-list directory traversal, Unicode APIs |
| Protection Bypass | SFC check via SfcIsFileProtected |
| Stealth | Timestamp restoration, attribute reset, checksum recalculation |
| Size | 3,344 bytes (hence the “.3344” in the name) |
Conclusion
W64/Rugrat.3344 occupies a unique place in digital forensics history. It was the first of its kind — a milestone that marked the transition of malware into 64-bit computing. It was technically sophisticated, architecturally aware, and elegantly crafted.
“How much smoother could the transition be for the virus writers?” — proved prophetic. Today, 64-bit malware is the norm, not the exception. The techniques Rugrat pioneered — TLS callbacks, vectored exception handling, CRC-based API resolution — are now standard tools in the malware author’s toolkit.
For the forensic researcher, Rugrat remains a masterclass in assembly-level analysis. It rewards those who understand IA64’s quirks, who can trace predicate flows through 30 instructions, who recognize the significance of a register pointer left by NTDLL. It’s a reminder that in malware analysis, the details matter — and sometimes, the smallest details reveal the most.
References
Computerworld. “Symantec nabs first 64-bit virus.” June 1, 2004.
F-Secure. “Rugrat Virus Description.” 2004.
iTnews. “Rugrat virus hits 64-bit Windows.” May 28, 2004.
Wikipedia. “Microsoft-specific exception handling mechanisms.”
Ferrie, Peter & Ször, Péter. “64-bit Rugrats.” Virus Bulletin, July 2004.
Computerwoche. “Erster 64-Bit-Virus im Umlauf.” May 31, 2004.
InformationWeek. “First 64-Bit Windows Virus Arrives.” May 28, 2004.
Wikipedia. “29A.”
ZDNet.de. “Premiere: Virus für 64 Bit-Windows.” May 27, 2004.
CRN Magazine. “First 64-bit Windows Virus Spotted.” May 31, 2004.
