RAT
Chrome Remote Desktop
Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context.
Tool overview
- Category
- RAT
- Research authors
- n2x4
- Created
- 2024-08-02
- Last modified
- 2026-09-01
- Privileges
- User and SYSTEM/root
- Free / availability
- Yes
- Verification required
- Google documents remote-access host support for Windows, macOS, and Linux, and Google Chrome Enterprise support confirms that no license is required. Chromium's current macOS installer source confirms the privileged helper bundle, host binaries, launchd files, and configuration paths. The current Google Debian package confirms the Linux service and /opt/google/chrome-remote-desktop paths. The Windows host sample and Google LLC signature were verified through VirusTotal.
- Supported platforms
Linux
Windows
macOS
Capabilities
Executables & installation paths
- Filename
- remoting_host.exe
- OriginalFileName
- remoting_host.exe
- Description
- Host Process
- Product
- Chrome Remote Desktop
Installation paths
remoting_host.exe
C:\Program Files (x86)\Google\Chrome Remote Desktop\*
*\Google\Chrome Remote Desktop\*
*\remoting_host.exe
/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host
/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service
/opt/google/chrome-remote-desktop/chrome-remote-desktop-host
/opt/google/chrome-remote-desktop/chrome-remote-desktop
Code signing
- signer name
- Google LLC
- certificate thumbprint
- 607A3EDAA64933E94422FC8F0C80388E0590986C
- src file sha256
- 1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140
- src file path
- downloaded_files/chrome_remote_desktop/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140
- src file company
- Google LLC
search names
remoting_host.exe
company names
Google LLC
signer names
Google LLC
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files (x86)\Google\Chrome Remote Desktop\*\remoting_host.exe
- Description
- Versioned Windows host process.
- OS
- Windows
- File
- /Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host
- Description
- Primary macOS remote desktop host executable.
- OS
- macOS
- File
- /Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service
- Description
- macOS host service launched by launchd.
- OS
- macOS
- File
- /Library/LaunchAgents/org.chromium.chromoting.plist
- Description
- macOS per-user launch agent for the Chrome Remote Desktop host.
- OS
- macOS
- File
- /Library/LaunchDaemons/org.chromium.chromoting.broker.plist
- Description
- macOS launch daemon for the host broker.
- OS
- macOS
- File
- /Library/PrivilegedHelperTools/org.chromium.chromoting.json
- Description
- macOS Chrome Remote Desktop host configuration.
- OS
- macOS
- File
- /Library/PrivilegedHelperTools/org.chromium.chromoting.settings.json
- Description
- macOS Chrome Remote Desktop host settings.
- OS
- macOS
- File
- /Applications/Chrome Remote Desktop Host Uninstaller.app
- Description
- macOS host uninstaller application.
- OS
- macOS
- File
- /opt/google/chrome-remote-desktop/chrome-remote-desktop-host
- Description
- Linux Chrome Remote Desktop host executable.
- OS
- Linux
- File
- /opt/google/chrome-remote-desktop/chrome-remote-desktop
- Description
- Linux host management script.
- OS
- Linux
- File
- /lib/systemd/system/chrome-remote-desktop.service
- Description
- Linux systemd service unit.
- OS
- Linux
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- *.remotedesktop.google.com
- remotedesktop-pa.googleapis.com
- *.remotedesktop-pa.googleapis.com
- remotedesktop.google.com
- chromoting-client.talkgadget.google.com
- chromoting-host.talkgadget.google.com
- chromoting-oauth.talkgadget.google.com
- Ports
- 443
- 3478
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/chrome_remote_desktop_network_sigma.yml
- Description
- Detects potential network activity of Chrome Remote Desktop RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/chrome_remote_desktop_processes_sigma.yml
- Description
- Detects potential processes activity of Chrome Remote Desktop RMM tool
References
- https://support.google.com/chrome/a/answer/2799701?hl=en
- https://support.google.com/chrome/answer/1649523
- https://support.google.com/chrome/a/thread/154474130
- https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome
- https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh
- https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist
- https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb
- https://github.com/magicsword-io/LOLRMM/issues/230
- https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140
Acknowledgements
- Person
- n2x4
- Handle
- @n2x4