How real software downloads can hide remote backdoors

A Malwarebytes investigation shows how legitimate-looking software download sites can conceal remote backdoors. The campaign used a fake domain, rustdesk[.]work, impersonating the legitimate RustDesk project hosted at rustdesk[.]com, with a near-perfect visual and multilingual replication to deceive users.

The installer delivers a dual payload: the real RustDesk installer works, while a hidden backdoor, a malware framework known as Winos4.0 (WinosStager), is quietly installed in memory and never written as a separate file on disk. The infection chain moves from a trojanised installer to a loader (logger.exe) that creates a new process and transitions to Libserver.exe, which unpacks the Winos4.0 components entirely in memory to evade disk-based detection.

Once active, Winos4.0 enables remote access, monitoring, keystroke logging and the option to download additional malware, with a command-and-control connection to 207.56.13[.]76:5666. The campaign blends malicious traffic with legitimate RustDesk communications, making detection harder and underscoring the need for layered, behaviour-based defence.