Attackers registered a convincing fake RustDesk site (rustdesk[.]work) that distributed a trojanized installer which installed both the real RustDesk client and a hidden backdoor, Winos4.0. The backdoor runs largely in memory, captures screenshots and keystrokes, and establishes C2 communications to 207.56.13[.]76:5666 to exfiltrate data and receive commands. #RustDesk #Winos4.0
Keypoints
- Threat actors created a near-perfect impersonation of the RustDesk website at rustdesk[.]work to trick users into downloading a trojanized installer.
- The installer rustdesk-1.4.4-x86_64.exe drops and runs the legitimate RustDesk installer while silently writing a malicious payload (logger.exe) to disk.
- logger.exe acts as a loader: it creates a new process, allocates executable memory, and transitions execution to Libserver.exe to hand off to the implant.
- Libserver.exe unpacks Winos4.0 (WinosStager DLLs and a ~128 MB payload) entirely in memory, evading file-based antivirus detection.
- Winos4.0 provides full remote access capabilities: screenshot capture, keystroke logging, credential theft, downloading/executing additional malware, and persistence across reboots.
- Command-and-control is hosted at 207.56.13[.]76:5666/TCP and the malware mixes malicious traffic with legitimate RustDesk network activity to blend in.
- Recommended defenses: verify download sources, monitor outbound connections (e.g., port 5666), apply application allowlisting, educate users about typosquatting, and block the listed IOCs.
MITRE Techniques
- [T1036 ] Masquerading – The campaign cloned a legitimate site and used a convincing domain to impersonate RustDesk (‘we identified a malicious website at rustdesk[.]work impersonating the legitimate RustDesk project, which is hosted at rustdesk.com’).
- [T1204 ] User Execution – The attack relies on users downloading and running a seemingly legitimate installer from search results (‘You install the software, launch it, and everything works exactly as expected’).
- [T1055 ] Process Injection – The loader creates a new process, allocates executable memory, and hands execution to Libserver.exe to run code in another process (‘Creates a new process; Allocates executable memory; Transitions execution to a new runtime identity: Libserver.exe’).
- [T1218 ] Signed Binary Proxy Execution / Living off the Land (general technique) – Attackers run the legitimate RustDesk installer alongside malicious components to avoid suspicion (‘It installs real RustDesk, fully functional and unmodified’ while also installing a backdoor).
- [T1041 ] Exfiltration Over C2 Channel – The implant sends stolen data and receives commands via an established C2 session (‘send commands to the infected machine and receive stolen data in return’).
- [T1071 ] Application Layer Protocol – The malware uses network communication to an attacker-controlled server (TCP 5666) to maintain C2 functionality (‘IP: 207.56.13[.]76 Port: 5666/TCP’).
- [T1056 ] Input Capture – Winos4.0 logs keystrokes to steal credentials (‘Log keystrokes and steal credentials’).
- [T1113 ] Screen Capture – The framework captures screenshots to monitor victim activity (‘Monitor victim activity and capture screenshots’).
- [T1105 ] Ingress Tool Transfer – The malware can download and execute additional tools or payloads on the infected host (‘Download and execute additional malware’).
- [T1547 ] Boot or Logon Autostart Execution (Registry Run Keys/Startup Folder) – The backdoor maintains persistence even after reboots and hides configuration in the registry (‘Maintain persistent access even after system reboots’ and ‘Hides configuration in the registry’).
- [T1497 ] Virtualization/Sandbox Evasion – The payload detects analysis environments by checking system memory and looking for debugging tools (‘Detects analysis environments; Checks available system memory and looks for debugging tools’).
- [T1070 ] Indicator Removal on Host – The malware clears artifacts such as browser history to remove traces of infection (‘Clears browser history; Invokes system APIs to delete browsing data’).
Indicators of Compromise
- [File hashes ] Trojans and loaders identified by SHA256 – 330016ab17f2b03c7bc0e10482f7cb70d44a46f03ea327cd6dfe50f772e6af30 (trojanized installer), 5d308205e3817adcfdda849ec669fa75970ba8ffc7ca643bf44aa55c2085cb86 (logger.exe/Winos4.0 loader), and several in-memory DLL hashes.
- [In-memory payload hashes ] Large memory-only modules unpacked at runtime – a71bb5cf751d7df158567d7d44356a9c66b684f2f9c788ed32dadcdefd9c917a (WinosStager DLL), 900161e74c4dbab37328ca380edb651dc3e120cfca6168d38f5f53adffd469f6, and other staged hashes.
- [Domain ] Malicious download site – rustdesk[.]work (fake RustDesk distribution site used to host the trojanized installer).
- [IP address / Port ] C2 and related network endpoints – 207.56.13[.]76:5666/TCP (command-and-control server), 209.250.254.15:21115-21116 (legitimate RustDesk relay traffic observed alongside malicious communications).
- [File names ] Installer and payload filenames observed on disk – rustdesk-1.4.4-x86_64.exe (trojanized installer), logger.exe (Winos4.0 loader), Libserver.exe (runtime implant process name).