File scan report
Verdict Suspicious
Is rustdesk.
An unsigned build presenting as the RustDesk remote-desktop tool, flagged by 4 of the 72 antivirus engines that checked it with generic labels, including two major antivirus…
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Do not run this unsigned copy unless you know exactly where it came from. Get RustDesk from its official signed release instead, and never let a stranger connect to your computer with it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 72 flagged
- Flagged 4
- No detection 68
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
4 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This file presents itself as RustDesk, a remote-desktop program, but carries no code signature. DrWeb and Trellix flag it with generic trojan labels, and two engines from less reliable or shared sources add generic detections, for 4 of 76 in total. Unsigned remote-access builds are a common tool in support scams, so obtain RustDesk only from its official release page.
Four of the 72 antivirus engines that checked it flagged the file, two of them major (DrWeb and Trellix), but every label is a generic bucket with no named malware family. The file is unsigned, while it presents as RustDesk, a remote-desktop tool. Unsigned copies of RustDesk are what community detection rules single out as possibly unwanted remote-access software. The sandbox summary shows the expected RustDesk application files being unpacked, with no named injection target. The high-risk technique mappings it recorded lacked the artefacts they describe. No host-reputation or reference-database result was available, so the mixed evidence does not support a clean call.
What We Detected
4 of the 72 antivirus engines that checked it flagged this unsigned 64-bit program, first seen on Jan 9, 2026. DrWeb reports a generic trojan signature and Trellix a generic reputation detection, Skyhigh shares Trellix's engine, and Bkav adds a machine-learning label. No engine names a malware family. Community detection rules match it as an unsigned RustDesk remote-desktop build.
Threat Behavior
In the sandbox runs the program unpacked RustDesk and Flutter libraries into the user's local application folder and launched the RustDesk client. No injection into another process and no persistence entries were recorded. Technique mappings for injection, encryption and defence tampering appeared without any matching activity. The program did connect to two external addresses, but no reputation check of those hosts is available.
What To Do Now
If you did not deliberately install RustDesk, or someone asked you to run it over the phone or by message, do not run it. If it is already running, end it and remove it. If you need RustDesk, download the signed release from the official project page instead, and keep your antivirus enabled.
Where this verdict could be wrong2 caveats
- Sixteen major antivirus engines, including Kaspersky, ESET, BitDefender and Microsoft-class scanners, did not flag the file. The two major detections are generic labels that are often triggered by large, compressed application bundles.
- The sandbox recorded the normal RustDesk application files being unpacked into the user's profile, with no named injection target and no persistence entries.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Sixteen major antivirus engines did not flag the file.
- The sandbox recorded only the expected RustDesk application files being unpacked, with no named injection target or persistence.
- Two major antivirus engines, DrWeb and Trellix, flag the file with generic trojan labels.
- The program presents as RustDesk but carries no code signature.
- Remote-desktop tools like this are often abused to take control of victims' computers in support scams.
- No reputation check of the hosts it contacted is available.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 9spawned processes
- 2network contacts
- 34filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
rustdesk.exe
59e9e842608536f1037bd03d90b0bbb666a26a792882cc0402275d763689f95c
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
rustdesk-1.4.5-x86_64.exe
"C:\Users\<USER>\Desktop\rustdesk-1.4.5-x86_64.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
taskkill
"taskkill" /F /IM RuntimeBroker_rustdesk.exe
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
desktop_drop_plugin.dll
C:\Users\<USER>\AppData\Local\rustdesk\desktop_drop_plugin.dll
Test run - Evidence 5 of 7: Written fileSeen in the test run
desktop_multi_window_plugin.dll
C:\Users\<USER>\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
209.250.254.15
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
49.12.46.241
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
17MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1106
- T1129· Loads modules
- T1202
- T1486· File encryption
- T1497.001· Sandbox evasion
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
9Programs the file ran, with their command lines.
rustdesk-1.4.5-x86_64.exe"C:\Users\<USER>\Desktop\rustdesk-1.4.5-x86_64.exe"taskkill"taskkill" /F /IM RuntimeBroker_rustdesk.exerustdesk.exe"C:\Users\<USER>\AppData\Local\rustdesk\.\rustdesk.exe"svchost.exe%WINDIR%\system32\svchost.exerustdesk.exe%LOCALAPPDATA%\rustdesk\rustdesk.exepowershell.exe%WINDIR%\system32\windowspowershell\v1.0\powershell.exe
Show all 9 entries for processes started
consent.exe%WINDIR%\system32\consent.exeslui.exe%WINDIR%\system32\slui.exewmiprvse.exe%WINDIR%\system32\wbem\wmiprvse.exe
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
209.250.254.15 - IP address
49.12.46.241
Files
24Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\rustdesk\desktop_drop_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\desktop_multi_window_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\dylib_virtual_display.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\file_selector_windows_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
Show all 24 entries for files
- Written
C:\Users\<USER>\AppData\Local\rustdesk\flutter_windows.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\librustdesk.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\printer_driver_adapter.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\rustdesk.exe - Written
C:\Users\<USER>\AppData\Local\rustdesk\screen_retriever_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\uni_links_desktop_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\url_launcher_windows_plugin.dll - Written
C:\Users\<USER>\AppData\Local\rustdesk\WindowInjection.dll - Deleted
%TEMP%\nwga122.tmp - Deleted
%APPDATA%\rustdesk\config\rustdesk2.2904_threadid(20)_1768066639677635900 - Deleted
%APPDATA%\rustdesk\config\rustdesk_local.2904_threadid(34)_1768066644197019800 - Deleted
%APPDATA%\rustdesk\config\rustdesk.2904_threadid(11)_1768066642439700900 - Deleted
%APPDATA%\rustdesk\config\rustdesk_hwcodec.2904_threadid(15)_1768066641843475000 - Deleted
C:\Users\<USER>\AppData\Local\Temp\nwgFFAE.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nwgB9FA.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nwg215E.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nwgC8C5.tmp
Registry and auto-start
13Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AB082DC-B77E-4487-BB5D-5DCB3A6C2B3C}\Capabilities - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AB082DC-B77E-4487-BB5D-5DCB3A6C2B3C}\Schema - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{892625FE-213B-4B60-95ED-A1CEFCAA365D}\Capabilities - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AB082DC-B77E-4487-BB5D-5DCB3A6C2B3C}\Date - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AB082DC-B77E-4487-BB5D-5DCB3A6C2B3C}\Documentation
Show all 13 entries for registry and auto-start
- Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{892625FE-213B-4B60-95ED-A1CEFCAA365D}\Package - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{892625FE-213B-4B60-95ED-A1CEFCAA365D}\Documentation - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{892625FE-213B-4B60-95ED-A1CEFCAA365D}\Date - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{892625FE-213B-4B60-95ED-A1CEFCAA365D}\Data - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AB082DC-B77E-4487-BB5D-5DCB3A6C2B3C}\Package - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AB082DC-B77E-4487-BB5D-5DCB3A6C2B3C}\Data - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{892625FE-213B-4B60-95ED-A1CEFCAA365D}\Schema
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Lsa_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\.NETFramework_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\UGTHRSVC_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\rdyboost_Perf_Library_Lock_PID_b58
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\UGatherer_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\Outlook_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\MSSCNTRS_Perf_Library_Lock_PID_b58\Sessions\1\BaseNamedObjects\.NET Memory Cache 4.0_Perf_Library_Lock_PID_b58
Sandbox background — not the file
8The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 8 entries for sandbox background — not the file
- VM host
224.0.0.251 - VM host
8.8.8.8
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 52393a53c147ab7e1900…faa698Not checkedno saved verdict
- 74b3152a28d4f1a4fff4…89ff70Not checkedno saved verdict
- 140aec3067d58ff56356…a8f041Not checkedno saved verdict
- 58289da261d1913b136d…e90448Not checkedno saved verdict
- 3feb445086c26cc0db51…e61522Not checkedno saved verdict
- b8520bb0397257021199…4f87c0Not checkedno saved verdict
- 4d6ecc2b455713825760…5b3488Not checkedno saved verdict
- 114b57c05ad15aa9f3e1…24b754Not checkedno saved verdict
- 76eecafc726720f274c6…c3bcc8Not checkedno saved verdict
- 435a7f4cf6e2fb449ac3…287d54Not checkedno saved verdict
Chapter 04
Technical details
4 of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- DrWeb (major engine)Trojan.Siggen32.18113
- TrellixENS (major engine)Artemis!83F669D202C3
- BkavW64.AIDetectMalware
- SkyhighArtemis
File fingerprint
- Last analyzed
- Apr 24, 2026, 5:27 AM UTC
- SHA-256
59e9e842608536f1037bd03d90b0bbb666a26a792882cc0402275d763689f95c- SHA-1
8c0aae1dbddf12aef03ded5bd36b11638138e744- MD5
83f669d202c3aa097aadeccd36791b13
About this file
rustdesk.exe is a Win32 EXE file of 24.1 MB.
- Type and size
- Win32 EXE · 24.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jan 9, 2026On VirusTotal.
- Submitted by
- 33 distinct sources
- Packer
- None detected
- Entropy
- 7.95 of 8
First scanned Updated
Verdict history
- Suspicious
- Maliciousafter a new scan
- Suspiciousafter a new scan
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
4 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 4 detections come from 3 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines2flagged
- Tier-236 engines1flagged
- Low-trust18 engines1flagged
View all 76 engine results
- BkavMalicious: W64.AIDetectMalware
- DrWebMalicious: Trojan.Siggen32.18113
- SkyhighMalicious: Artemis
- TrellixENSMalicious: Artemis!83F669D202C3
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is rustdesk.exe safe, or is it malware?
What is rustdesk.exe?
How many antivirus engines detected rustdesk.exe?
What should I do if I already ran rustdesk.exe?
What is the SHA-256 hash of rustdesk.exe?
How up to date is this analysis of rustdesk.exe?
Community
Member reviews and reports for this exact file hash.
