43a9b0cd46afe1944d0010849cf3a90fc474d73b13359acc984b766404fbea37

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rd.exe
Size 23.1MB
Sample260705-ankyyabs5j
SHA256 43a9b0cd46afe1944d0010849cf3a90fc474d73b13359acc984b766404fbea37
MD5 50d6d12089283ff079c8a1f1d5aa5042
SHA1 6da240e691f522b0a13b082cd21f005cd090e8f4
SHA512 94c5ca92d4f4fe87a4c053ad67f5149be2b86eab4527d9b376d426c463d0501173ea69485887d445cddd70533db19228a2af9d6c9ca08fb1be23fe68ba817b9e
SSDEEP 393216:IGza0BvmFbLeDUfij6KBOo30O2Pa6GUrpLnQ8Qvg4T9goDaili6ZXOYRw:IevtUqZkokOr6GUrWvFfVjZXOYK
TLSH
T1A7373315F3940AACF42B84718A1256B3A6753CBA17249DE729C433653F3DAE42F3B364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery rat spyware trojan

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4808	icacls.exe
3492	icacls.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_4047F681E7327EA8	rustdesk.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\rustdesk_rCURRENT.log	rustdesk.exe

Executes dropped EXE 4 IoCs

pid	Process
3316	rustdesk.exe
5224	rustdesk.exe
2900	rustdesk.exe
2480	rustdesk.exe

Loads dropped DLL 55 IoCs

pid	Process
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
5224	rustdesk.exe
3316	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2900	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe
2480	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1824	taskkill.exe
5832	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df12000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 6b00000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df16b00000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	rustdesk.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3316	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5224	rustdesk.exe
5224	rustdesk.exe
3316	rustdesk.exe
3316	rustdesk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	5224	rustdesk.exe
Token: SeDebugPrivilege	5832	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3316	rustdesk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3316	rustdesk.exe
3316	rustdesk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1824	4376	rd.exe	88
PID 4376 wrote to memory of 3316	4376	rd.exe	91
PID 3316 wrote to memory of 3492	3316	rustdesk.exe	92
PID 3316 wrote to memory of 4808	3316	rustdesk.exe	93
PID 3316 wrote to memory of 5224	3316	rustdesk.exe	96
PID 3316 wrote to memory of 856	3316	rustdesk.exe	97
PID 3316 wrote to memory of 2900	3316	rustdesk.exe	100
PID 856 wrote to memory of 5832	856	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\rd.exe
"C:\Users\Admin\AppData\Local\Temp\rd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RuntimeBroker_rustdesk.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
  "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\icacls.exe
    "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    PID:3492
- - C:\Windows\system32\icacls.exe
    "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    PID:4808
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      PID:2480
- - C:\Windows\system32\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\RustDesk\shared_memory_portable_service
Size 23B
SHA256 9e2cd91e2714aa2ce269fefa67d905e72ec670f47335b1871fd8cb2d1a2563e9
MD5 99f17883200b8c562abd34f3c5969a73
SHA1 a292b97b6d5ff2fd795643641c426b9fe412586e
SHA512 3f9192a7806318f782f2da679026bf5c014be5962ff59da528065d0a3b2b85f346ccf2f4c243c672ae39e0b49127ec5f3b98857631b13aa3706d5d541fe2a6f8
MD5 SHA1 SHA512

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\rustdesk\data\app.so
Size 12.6MB
SHA256 2c92c70f292cb03a2cc8e47ca006d327c92a27cfac1a930945478a5d4f6b1534
MD5 8ed0bebca7ad9707b22385941bf3a5af
SHA1 82364442138cfe07d241f5aea43c3cfeefc586a8
SHA512 af17efd8fdcb26e79e2182c585f3cd155d637ee98ffb0ee081de71bd1f7add7fe3d122ceac5a37cc4419386ec23ccd5565531783f6b0f173c0a9f197f8718786
SSDEEP 393216:bEw8ekpCXITVJBq9BUpOvlLQxgNaUlB0WmV0shO:bEikkX+XgU4vlLQxolB06shO
TLSH
T1DDD64A9FD4B543A0C025F6B5F79EABBA5A1878D84E31A18646DC0B673E97C6007CE133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\FontManifest.json
Size 483B
SHA256 068f1cc96816fab157a6813ce233731e46bf661ad84d0018381fb58b19396886
MD5 f4f31d18ca443c7bfb50340e84b860d5
SHA1 f97538077e02122cf0377211bba8a4ab0bbbe4f3
SHA512 3da40b86ad28f41e29b44112601a910e4d2def19a0da8de3c272fb59227b025f7d25e713a3f89d22069f5799bf68fa4ac5647e85a71344925d664a61ac3e6ffe
TLSH
T1DDF0540F052519F890DDC595B0E3649370542B47528DE81EE7751FA4ABF0B0027286F3
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\rustdesk\data\icudtl.dat
Size 760KB
SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
MD5 692337664e861ad322138061132dddc6
SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
TLSH
T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_drop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
Size 332KB
SHA256 f3b7a37731960e2c465d0f9aa7d5776bc6facee84ff3b2e2fcebc8d0337ca2c6
MD5 86e7dcef8d654bc1624d632f985297f8
SHA1 773e1d1da8fdbf2361ccbbc685e282058469c56a
SHA512 93d5451e3ef9d50dee9c30ffe6819120b7d7cd837ca77efee646bc490d33f81cdc21d62f52cd4b625b7835352e8384ae7bd653eea723d804add08e390b3bbf5b
SSDEEP 6144:kR4/9uCIvoqJivCriaariRiiKPlHryZeSBP:kRvCIRi6DaGEiKPlLyUS5
TLSH
T1A7745B19F7A554BAE167C53CC9A34945EBB2BC560BA0D6CB1390075A3F33BE04A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_multi_window_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
Size 396KB
SHA256 89cf9967892061181a8d3a302777c0783005baf0f5fb6136924b032cef3b9d26
MD5 f3f0046d791d8a54312dc3758a3d8a7a
SHA1 d88e05ca5d506e515a9361a2ddb2298cb18f0471
SHA512 8295e379aa0462452539020e7a577d34dfea477eb2a5da38035e821441415ecfe608b8e30b26145a7f98d29c4967ba0d78a628c16b378f8e21e7d9915cc3e641
SSDEEP 6144:6Nu7uzadCZaz372h7Wzr8hg9fL8d35m/PothxEPwldYvf7TSnbN:eaCZaPWmp9fgtThxEPwl2vz+R
TLSH
T1B8846C2AFB6414B5E167C138C9774546EA727C894B619BCF2394079A2F33FE04A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
Size 359KB
SHA256 bfb78f728819db12a4a0e5b3f30b68e2ee0e955bed15bf34c623138aea15a6eb
MD5 587c6ab13ecb2a9c65ded63c09428af1
SHA1 816c503dd212c7bc8831ca9b0cb74bd4f17dcd2d
SHA512 10198c45c4b979a94476f7b9a980baab2c162d97ddf5e4500685ff6288ef25e4a260901919fe2fa9bdc725b62f0a24a7a13f1351a287b2166d432e09274540d2
SSDEEP 6144:LhDy6RwpACl7b97g8SNDRure8UVDt447xPsfCrw2:9KpACdWDNDQelVR447xPsqc2
TLSH
T16C746D5AFBA814B5E1678138CDA74945EBB27C464BA0D7CF2390065A2F33FE05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_custom_cursor_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
Size 322KB
SHA256 798e3463cb84acfc003bf8d9d7dc1c5b32300ba00009f9d0de3ea73e6ffadc65
MD5 85f60cc5b546ea6bf7e9a46b1b2b6635
SHA1 7108b2752011767f60553c0e03fd70e8b7af64ce
SHA512 b2aaa36bcf98e403baca5c8c4fa545eaf346f7ef14ea0318e948cc9adba573e21dc9bd18256f44f48e7cfcb443a369e15565cf0e8032329dfc4109e26eb75879
SSDEEP 6144:TlvCz6DzEUctTvKfyNPEUM467qaEHg0u56KZ6:5vCz0+TGytEa67qaEHgFW
TLSH
T152645B1AF7A454BAE167853CCD974945EBF27C424BA4D6CB0390069E3F23BE44A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_gpu_texture_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
Size 354KB
SHA256 d54a17673226d82078d12cd1016ae45630d0423a4cbf51b48c74bb849e5728a3
MD5 7a9cb2d635f5684694f99e4340c81921
SHA1 442f11182d37ed692f5f140e71d9b783935153e7
SHA512 f2f95657a65831d968d3daabcb887c79f284466b310fe83a2dcaa6cf7462ac54cd1848421a8bf4bcf81d0c53d67a1f453055d3dfc6fb5d043f0726adbe0e7dca
SSDEEP 6144:rIqQVCx2DdJ9kzqMeOtvQVSUiOVEg7T1o3wXS:fQVCxMJ+zUOWVSUiO37T1oL
TLSH
T1A6746D2AFBA454BAE167C138C9674945E7B27C464760D6CF23940B5A2F33FE0893E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_windows.dll
Size 17.2MB
SHA256 509cf49850aa91e6505a1c89c31e7b30c2b9734fa96944c69a603a0e762fadbf
MD5 6708142e00499d4dfc17432139f2e278
SHA1 7ad07e8a6d5a871588e7c1ef7c65ec29412c7b0f
SHA512 39895bf6b0f18eb2c611b075240afb92f620ed4812565d70ac9c93971f5a1f7f7f1cb9ad0df81eda5ac915fcb21699e8bf76e7ab16fbacc3becf1fe28a11b94b
SSDEEP 98304:Lr9tjMEbhsb464T36lgzqbka78FKAWS3rpUJkUNZ3phDJ8cpSq6nYriNtZ356rX3:1ffggz7Q35r36YriN707eM
TLSH
T13C078C03E59640FDC48DD2B89B5B9A27F671B8490621B5DF238827263F67BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librustdesk.dll

Path C:\Users\Admin\AppData\Local\rustdesk\librustdesk.dll
Size 33.7MB
SHA256 b2dfb94f88626e9ec7a5bb95e236c2b497568bab6fa63a221c6dfcf33cafecfb
MD5 0dcd008cba82b93dcbae0fbde25d86ec
SHA1 121112a20ecd7456c5ac94249bd419676b3af492
SHA512 d467e44dbd112e06fd6d125b1a65889340f5c7c1f8ead9656c5d27717944a82932120d22354109c967fe83b3cb0a94c4380be32320c5f460c8a7f2b607a414f1
SSDEEP 393216:86Sx6q+ZZGFZz3h1j88c5lxd9Z4AbWlC7XpY8BOxivOtlPjFrBoLSeEcLsQa9dL3:86IU+cGDzlGPsz
TLSH
T1CF777B46F25651E8C02AE574826B6E22FAB13C4D43316BEB17E05A213E63BD05B3F7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printer_driver_adapter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\printer_driver_adapter.dll
Size 1.3MB
SHA256 2512f943bc803c63179db8e0acb0be58ce48ecdd6daff89eebb8168bbf34657d
MD5 6c050f90a870a1edb5754d27b6e64e07
SHA1 211997c295a7a3737b55e5d449ca5ecbe60a2e79
SHA512 edbb3e0565d7ce23584a8328f2c0053968919f676ff9954202b226074502f23e0949b60ddcb8a92c99721412f39abb62fc2ff0b8b6a53f4e3040437c0809592d
SSDEEP 24576:MUzwii98X0HkTYjW1JXp2gX9N8WdAov2Efq/F/:tzwLHOa4Xp2vWdfqd/
TLSH
T10D557D62FA95897DC06BC07082574BB6AA7174CA0B31A9FF419886783E25FF51F3C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 356KB
SHA256 d85eb795ad58a206e40eee01c2f5c0a3b018f25b6e5bac1d32afae346fed05f1
MD5 d4d4ff09d78d46c56e213e217b4731af
SHA1 f0cfd3e3709c1ca4bda0af42d2eb2444ecdf527e
SHA512 af7acb963b02fc4e4548da69d82e733bc358f061b6a5592bcde36422a14a7d6fc1579d0d803b51847130bfe2d038e2b0127ccfe6a68c2bdd7e153cedc4864361
SSDEEP 6144:lJI3empCvWzibaW8WlSWoWWWRWUWPWjWqWTWc5enIZ36qWee0MFEqc0EjW0Vqo4b:4CvyGaW8WlSWoWWWRWUWPWjWqWTWBIZO
TLSH
T177747E1AFBA454F9E167C138CD964945EAB27C460BA1DBCF13940B5A2F336E08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
Size 526KB
SHA256 f7d8d2cefda82d4bfbf7444f7be1d8819e718a1a3c2d24a381f25c39ba5e5830
MD5 39618e49ed4abd5e53bb7095b2a566ca
SHA1 f577c4f0752b0d700682130d03cc2df437e65a68
SHA512 9584a184dbb93e0de20dd69aefacdad3d50966e67a7bb9df65d208b22a73ccd7947e141398f638475812e0da8c99563f18e574266a701bbcb22292cfd36cec7c
SSDEEP 6144:FvM4Cn7osApJ245VAhLQzzBzXjEUmo1wOerpzQSUJ+LDf8259oz7wVfesb5bQ:FpCn85AizXjjT3+LDfRoz7wVfbbJQ
TLSH
T152B46C2AE7A843B5E167D138C9534506FBB1B84A576196CF43E00AAE2F677F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

texture_rgba_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
Size 331KB
SHA256 fe0f657a3cb47935a013f242a734528bff6d19ce468f36c82673c3a35b316461
MD5 a203e43381ed79903c838aed9c8cd360
SHA1 885fad747864967eb0c1941f8473b497975a9f1f
SHA512 8d82dc5309eb32edd7cf59bb182a00de76c34678a22a2879503bf4d4ddfbce85209bba768e2b080ffa29e48a4d5d0de2d10639bbf9fe747b08e92385759b9762
SSDEEP 6144:Un6gHCyvN6xlody6G1iYpCyf7VphHNXqaZz:UPCyVhybroyf7Vphxx
TLSH
T144745B29F7A954B5E167C53CC9A74946EBB27C420BA0D6CF13A0065A3F33BE05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uni_links_desktop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
Size 530KB
SHA256 12c8e941eb1fd52166548f52a237b21a10e5b2affe982ac94a5cb5d5a8bc0b31
MD5 528076fa1bb774b854a382818ab1becd
SHA1 e3a633394415296f207a76ce286c8e859e2ef42a
SHA512 b54cefcff53089edb1752e6f3d08fd5dc05ec5bdff8cb30b6b1220be1efdd8fa7db1d0dcacce432dc7f61622fb58991f8a37bc06bc53b48658750d73c77691a8
SSDEEP 12288:96M0PhCz3uvbsZwx9ASwryQao7qaEhBzh:gM0PhCUMwDEoo7qaEhBd
TLSH
T1F5B47D29E7AC43B5E167E178C9534906EBB1B84A5761A7CF43E006AA1F277F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
Size 335KB
SHA256 32f8d2432bd80efaf9a402c94fdf7a502351465c77bc89a481df16ca61a6b8b0
MD5 5e474aa1c342ec4dd16763dad1da39d5
SHA1 cfc0afcf6f95c42855f505d24e6f2bf4b3b2d1ce
SHA512 b11f13b2bece65e4bcb340f01a3ef66b0d94d99d5d66ca38a98e6c103fe8784f3140dd9b697a7a14308194c972254223ae6687e11d7b4553450082a5dd69d250
SSDEEP 6144:e7uWnMFCDOlYgxWprJc0XuM5k7VvbGAMu:DWnMFChgUpO0+M5k7VvbL
TLSH
T15D746C1AF7A554B9E167C13CC9634945EBB2BC464BA1D6CF1390065A3F33BE08A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_manager_plugin.dll
Size 556KB
SHA256 34c39bbce453e09c892286d4693e53fa4d4ca7aa0fe1bdf5bf599d933b7dfc82
MD5 ea0ac20ce6943d376d47dafb5fa4528f
SHA1 d1fd07bba2beb32e48e4086234b3f833278399e6
SHA512 8884f7f00914628fd3c385780619730690781c9d6d06bdcb173003fcfec5b7b8a3c4fa0af4624afbb2c061de7d26ed250083db20163da534d8f1fa61a95fd14f
SSDEEP 6144:TwGFsr3jLCOcPkBBFBMC4wXszJAVK9wM+J2CpssZ17AxGZSE/BWOqJaPqaE3TEIx:9YCO0k0zOysAxGZSoCaPqaE3TGo
TLSH
T1A6C48D2AA7A843B5E167D134C9474606EBB1B8465761A7CF03E05AAB2F277F04B3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_size_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_size_plugin.dll
Size 524KB
SHA256 98357495df1b0101d170c83c420add3eac7d18b2f4615fe84a0d0960b517b20d
MD5 1d4270aa9c926476aa5d925fa0f0c37f
SHA1 1143d0a197f4886ecfa377154c60db854429d06b
SHA512 a99a82ee36aec527752514e8c8bda17d8f6d1f5d70ab634e18765e068f35cfbbc73b88aaabeeb600f01cbc321aab17c52fdc40fd6c805a0d7d25e1c35dfea175
SSDEEP 6144:PeWzfLCt3ngLV0n/vFsX+FPoWoezzkwYCTW36jzL45ewqslwOUYPqaqNPwlOj:PLCtJvFg0no735usmOUYPqaqNPn
TLSH
T179B46C29E7AC43B6E167D138C9534506FBB1784A576196CF43E046AE2F277E04A3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3316-159-0x000002CA02AB0000-0x000002CA0374D000-memory.dmp

Download

memory/3316-160-0x000002CA02AB0000-0x000002CA0374D000-memory.dmp

Download

memory/3316-158-0x000002CA02AB0000-0x000002CA0374D000-memory.dmp

Download

memory/3316-161-0x000002CA00320000-0x000002CA00321000-memory.dmp

Download

memory/3316-157-0x000002CA00310000-0x000002CA00311000-memory.dmp

Download