rustdesk-1[.]4[.]8-x86_64-host%3Drustdesk[.]sit[.]schaer-it[.]de%2Ckey%3D%2BiY%2BxZMPxbOgkRhKlL3NrwFY1RGrt2Y22lBNO7XrLZI%3D[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
rustdesk-1.4.8-x86_64-host%3Drustdesk.sit.schaer-it.de%2Ckey%3D%2BiY%2BxZMPxbOgkRhKlL3NrwFY1RGrt2Y22lBNO7XrLZI%3D.exe
Size 23.3MB
Sample260820-wvxf7sshre
SHA256 f0053229fa2a2459c8b86f326c3e7423018a72f010f9758dc21be171b112d1b2
MD5 5af92ed4c3f11961876966d7e13faff4
SHA1 74345e4c5aeb9406003ac00652910e01495a4bc9
SHA512 497502e0c513209fdf4e3f5b3b4a5808607bd8c1f729e5af8332b4ef04844949e119d37b93c34e6d579c86ebc70c529d65323afa7c2ef749994fa6ecb967e3c7
SSDEEP 393216:gwvq+NU4x4OUxSz6yxfEFwB8WYzDlXbKKQeIOZX7lbydJxnjRArJhh6Zmbw:gw24xz6w3FYNbrQrW9y9jYhAZmM
TLSH
T1A7373365F1A7097DD63BC07082011BB6A6797CF94B3598FB029077153F3DED02A3AA68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
rustdesk-1.4.8-x86_64-host%3Drustdesk.sit.schaer-it.de%2Ckey%3D%2BiY%2BxZMPxbOgkRhKlL3NrwFY1RGrt2Y22lBNO7XrLZI%3D.exe

File Explorer

rustdesk-1.4.8-x86_64-host%3Drustdesk.sit.schaer-it.de%2Ckey%3D%2BiY%2BxZMPxbOgkRhKlL3NrwFY1RGrt2Y22lBNO7XrLZI%3D.exe

.exe 23.3MB

rustdesk-1.4.8-x86_64-host%3Drustdesk.sit.schaer-it.de%2Ckey%3D%2BiY%2BxZMPxbOgkRhKlL3NrwFY1RGrt2Y22lBNO7XrLZI%3D.exe

IMPHASH 1728f5830d9188240379efd54db72133
SHA256 f0053229fa2a2459c8b86f326c3e7423018a72f010f9758dc21be171b112d1b2
MD5 5af92ed4c3f11961876966d7e13faff4
SHA1 74345e4c5aeb9406003ac00652910e01495a4bc9
SHA512 497502e0c513209fdf4e3f5b3b4a5808607bd8c1f729e5af8332b4ef04844949e119d37b93c34e6d579c86ebc70c529d65323afa7c2ef749994fa6ecb967e3c7
SSDEEP 393216:gwvq+NU4x4OUxSz6yxfEFwB8WYzDlXbKKQeIOZX7lbydJxnjRArJhh6Zmbw:gw24xz6w3FYNbrQrW9y9jYhAZmM
TLSH
T1A7373365F1A7097DD63BC07082011BB6A6797CF94B3598FB029077153F3DED02A3AA68
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1c:27:b2:c8:13:27:f4:02:0a:cd:b7:d2:e8:82:00:ab:6d:fb:67:04:c9:68:17:7a:83:e3:88:1e:eb:4b:c6:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Jun 21, 2026

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Subject

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

79:1e:01:e2:77:1b:0f:0b:68:94:6e:42:93:0d:86:a1

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2026 - Feb 22, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

307880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcessHeap HeapAlloc FormatMessageW GetTempPathW GetTempFileNameW CreateActCtxW ActivateActCtx DeleteFileW HeapSize GetModuleHandleW LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetProcAddress FlsFree FlushFileBuffers AddVectoredExceptionHandler SetThreadStackGuarantee GetConsoleOutputCP HeapReAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive FlsSetValue FlsGetValue FlsAlloc GetCommandLineW lstrlenW GetProcessId GetFileInformationByHandleEx WaitForMultipleObjects GetOverlappedResult WaitForSingleObject GetExitCodeProcess CopyFileExW AcquireSRWLockShared ReleaseSRWLockShared GetStringTypeW DuplicateHandle GetFileType SetStdHandle SetEnvironmentVariableW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetWindowsDirectoryW GetCommandLineA GetModuleHandleExW TerminateProcess ExitProcess WriteFile RtlPcToFileHeader LoadLibraryExW TlsFree GetSystemDirectoryW QueryPerformanceCounter Sleep TlsSetValue QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer TlsGetValue GetModuleHandleA GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode TlsAlloc MultiByteToWideChar WriteConsoleW GetCurrentProcess GetEnvironmentVariableW GetModuleFileNameW CreateFileW GetFileInformationByHandle InitializeCriticalSectionAndSpinCount GetFullPathNameW CreateDirectoryW FindFirstFileW FindClose GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList SetLastError GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx SetFilePointerEx CreateEventW CancelIo ReadFile GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx LoadLibraryA ReleaseMutex RtlVirtualUnwind SetFileInformationByHandle SwitchToThread DeleteCriticalSection LeaveCriticalSection HeapFree EnterCriticalSection RaiseException CloseHandle GetLastError GetSystemTimeAsFileTime FreeLibrary EncodePointer GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx

ntdll

RtlGetVersion NtCreateFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoInitialize CoCreateInstance CoTaskMemFree

comctl32

SetWindowSubclass GetWindowSubclass InitCommonControlsEx DefSubclassProc RemoveWindowSubclass

user32

GetDC GetMenuItemCount DestroyMenu DefWindowProcW ShowWindow DispatchMessageW DestroyWindow ReleaseDC DeleteMenu GetAncestor GetMessageW GetMenuItemID GetSubMenu GetClassNameW AllowSetForegroundWindow GetParent SetParent SendMessageW PostMessageW EnumChildWindows SetWindowPos IsWindow GetMonitorInfoW MonitorFromWindow AdjustWindowRectEx CreateWindowExW RegisterClassExW LoadCursorW SendNotifyMessageW GetClientRect IsDialogMessageW TranslateMessage

gdi32

DeleteObject CreateDIBSection CreateSolidBrush

shell32

SHGetKnownFolderPath DragFinish

shlwapi

SHCreateMemStream

windowscodecs

WICConvertBitmapSource

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

358KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22.9MB

Virtual Size

22.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rustdesk-1.4.8-x86_64-host%3Drustdesk.sit.schaer-it.de%2Ckey%3D%2BiY%2BxZMPxbOgkRhKlL3NrwFY1RGrt2Y22lBNO7XrLZI%3D.exe

PE Signature issue

kernel32

ntdll

ole32

comctl32

user32

gdi32

shell32

shlwapi

windowscodecs

bcrypt

advapi32

generic