How real software downloads can hide remote backdoors

Summary

Attackers are operating a lookalike RustDesk download site (rustdesk.work) that delivers a trojanized installer: a legitimate RustDesk setup bundled with a malicious loader dubbed Winos4.0. When executed, the dropper plants logger.exe and Libserver.exe, then loads the backdoor in memory to reduce on-disk artifacts. The implant establishes command-and-control to 207.56.13.76 over TCP/5666, enabling persistent remote access. This activity is driven by social engineering and brand impersonation, not a RustDesk software vulnerability.

Investigation

Analysts obtained the malicious binary rustdesk-1.4.4-x86_64.exe and observed it writing a legitimate RustDesk installer plus a weaponized logger.exe to disk. The logger.exe component spawns Libserver.exe, which then stages WinosStager DLLs and a large in-memory payload without persisting those modules to disk. Network telemetry confirmed outbound communications to 207.56.13.76:5666, assessed as the campaign’s C2 channel. Investigators extracted key IOCs, including the spoofed domain (rustdesk.work), dropped filenames, and associated file hashes.

Mitigation

Enforce verified software acquisition practices and download RustDesk only from the official source (rustdesk.com). Apply application allowlisting (or equivalent controls) to prevent execution of untrusted binaries, particularly “installer” files originating from user-writable directories. Monitor and restrict outbound traffic to TCP/5666, and add detections/block rules for connections to rustdesk.work. Block 207.56.13.76 and the malicious domain across DNS, proxy, and firewall controls.

Response

Create detections for execution of logger.exe and Libserver.exe, and alert on any network connections to 207.56.13.76:5666. Proactively hunt across endpoints for the trojanized installer (and any available SHA-256 indicators) and validate whether RustDesk was installed from non-approved sources. If compromise is confirmed, isolate affected hosts, terminate the malicious process tree, remove related artifacts, and rotate potentially exposed credentials (especially any accounts used during installation or subsequent remote sessions).

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Delivery & Execution: An attacker delivers a trojanized RustDesk installer (rustdesk-1.4.4-x86_64.exe) via a phishing email. The file is saved to %TEMP% and executed with elevated privileges.
  2. Payload Drop: Upon execution, the installer extracts two malicious binaries—logger.exe and Libserver.exe—into the same directory and immediately launches them as child processes.
  3. Persistence (T1546.016): logger.exe writes a Run‑key entry (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) pointing to itself, ensuring persistence after reboot.
  4. Code Injection (T1574.005 / T1055.005): Libserver.exe injects a reflective DLL into explorer.exe to gain high‑privilege execution and opens a reverse shell to the attacker’s C2.
  5. Evasion (Masquerading – T1036.011): All binaries retain the “RustDesk” naming convention to blend with legitimate software.

• Regression Test Script: The script below automates steps 1‑3, producing the three required process‑creation events. It uses PowerShell to copy pre‑staged malicious binaries (simulated with benign placeholders for safety) and launches them with the proper parent‑child relationship.

  # -------------------------------------------------
  # Simulation Script – Trojanized RustDesk Installer
  # -------------------------------------------------
  # Prerequisite: Two benign placeholder executables placed in C:Malware (named logger.exe & Libserver.exe)
  #   In a real red‑team test these would be the actual malicious payloads.
  # -------------------------------------------------
  
  $installerPath = "$env:TEMPrustdesk-1.4.4-x86_64.exe"
  $payloadDir    = "$env:TEMPrustdesk_payload"
  $loggerPath    = "$payloadDirlogger.exe"
  $libserverPath = "$payloadDirLibserver.exe"
  
  # 1. Deploy a dummy installer (simply a copy of a benign exe)
  Write-Host "[*] Deploying fake RustDesk installer..."
  New-Item -ItemType Directory -Path $payloadDir -Force | Out-Null
  Copy-Item -Path "C:WindowsSystem32notepad.exe" -Destination $installerPath -Force
  
  # 2. Simulate payload drop – copy placeholder binaries
  Write-Host "[*] Dropping payloads..."
  Copy-Item -Path "C:Malwarelogger.exe"    -Destination $loggerPath    -Force
  Copy-Item -Path "C:MalwareLibserver.exe" -Destination $libserverPath -Force
  
  # 3. Execute installer (creates parent process)
  Write-Host "[*] Running installer..."
  $installer = Start-Process -FilePath $installerPath -PassThru
  
  # 4. Launch logger.exe as child of installer
  Write-Host "[*] Launching logger.exe (child of installer)..."
  Start-Process -FilePath $loggerPath -ArgumentList "--parent $($installer.Id)" -NoNewWindow
  
  # 5. Launch Libserver.exe as child of installer
  Write-Host "[*] Launching Libserver.exe (child of installer)..."
  Start-Process -FilePath $libserverPath -ArgumentList "--parent $($installer.Id)" -NoNewWindow
  
  Write-Host "[+] Simulation complete. Verify alerts in SIEM."

• Cleanup Commands: Remove the temporary files and terminate any lingering processes.

  # -------------------------------------------------
  # Cleanup Script – Remove simulation artifacts
  # -------------------------------------------------
  $installerPath = "$env:TEMPrustdesk-1.4.4-x86_64.exe"
  $payloadDir    = "$env:TEMPrustdesk_payload"
  
  Write-Host "[*] Stopping spawned processes..."
  Get-Process -Name "logger","Libserver","rustdesk-1.4.4-x86_64" -ErrorAction SilentlyContinue |
      Stop-Process -Force
  
  Write-Host "[*] Deleting files..."
  Remove-Item -Path $installerPath -Force -ErrorAction SilentlyContinue
  Remove-Item -Recurse -Force -Path $payloadDir -ErrorAction SilentlyContinue
  
  Write-Host "[+] Cleanup complete."