RMM
HopToDesk
HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity.
Tool overview
- Category
- RMM
- Research authors
- Michael Haag
- Created
- 2026-01-15
- Last modified
- 2026-01-15
- Privileges
- User/SYSTEM
- Free / availability
- Open Source
- Verification required
- Code-signed by Sectigo
- Supported platforms
Android
Linux
Windows
macOS
Capabilities
Executables & installation paths
- Filename
- HopToDesk.exe
- OriginalFileName
- Not recorded
- Description
- HopToDesk remote desktop application (verified via VirusTotal)
Installation paths
C:\Program Files (x86)\HopToDesk\HopToDesk.exe
HopToDesk.exe
HopToDesk-Standalone.exe
Code signing
- signer name
- Begonia Holdings LLC
- certificate thumbprint
- 127CAC9785F8C5F1A88CE70CE1109A4CA3A4CA01
- src file sha256
- 99b2948fd10b23b6d36e035b60cb92b9b82fb0bd4003e6d28f950f0b227cae2d
- src file path
- downloaded_files/hoptodesk/99b2948fd10b23b6d36e035b60cb92b9b82fb0bd4003e6d28f950f0b227cae2d
- src file company
- Begonia Holdings
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files (x86)\HopToDesk\HopToDesk.exe
- Description
- HopToDesk application executable (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Program Files (x86)\HopToDesk\privacyhelper.exe
- Description
- HopToDesk privacy helper executable (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Program Files (x86)\HopToDesk\PrivacyMode.dll
- Description
- HopToDesk privacy mode library (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Program Files (x86)\HopToDesk\sciter.dll
- Description
- HopToDesk Sciter UI library (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Users\*\AppData\Local\Temp\sciter.dll
- Description
- HopToDesk UI library (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Users\*\AppData\Local\Temp\privacyhelper.exe
- Description
- HopToDesk privacy helper (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Users\*\AppData\Roaming\HopToDesk\config\*
- Description
- HopToDesk configuration files (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Users\*\AppData\Roaming\HopToDesk\config\hoptodesk.toml
- Description
- HopToDesk configuration file (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Users\*\AppData\Roaming\HopToDesk\config\HopToDesk.toml
- Description
- HopToDesk configuration file (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Users\*\AppData\Roaming\HopToDesk\config\HopToDesk_rCURRENT.log
- Description
- HopToDesk log file (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- /System/Volumes/Data/Users/*/Library/Logs/HopToDesk/hoptodesk_rCURRENT.log
- Description
- HopToDesk log file (verified via VirusTotal sandbox analysis)
- OS
- MacOS
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- Description
- Service installation event for HopToDesk
- OS
- Windows
FORENSIC EVIDENCE
Registry artifacts
- Path
- HKEY_CURRENT_USER\Software\Classes\HopToDesk\shell\open\command
- Description
- HopToDesk URL protocol handler
- OS
- Windows
- Path
- HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HopToDesk
- Description
- HopToDesk uninstall registry key
- OS
- Windows
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- hoptodesk.com
- api.hoptodesk.com
- signal.hoptodesk.com
- turn.hoptodesk.com
- download.hoptodesk.com
- www.hoptodesk.com
- Ports
- 443
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/hoptodesk_network_sigma.yml
- Description
- Detects potential network activity of HopToDesk RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/hoptodesk_files_sigma.yml
- Description
- Detects potential files activity of HopToDesk RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/hoptodesk_processes_sigma.yml
- Description
- Detects potential processes activity of HopToDesk RMM tool
References
Acknowledgements
- Person
- Tyler Schultz
- Handle
- @shockwave_ts
- Person
- rcKillam
- Handle
- @rcKillam