{
  "Name": "Adobe Connect",
  "Category": "RAT",
  "Description": "Adobe Connect is Adobe's virtual meeting, webinar, and training platform. Its desktop application supports Windows and macOS and can be used for screen sharing and remote collaboration. The application communicates with Adobe Connect service domains over HTTPS and WebRTC.\n",
  "Author": "Andrew Weir",
  "Created": "2024-08-02",
  "LastModified": "2026-09-01",
  "Details": {
    "Website": "https://www.adobe.com/products/adobeconnect.html",
    "PEMetadata": [
      {
        "Filename": "ConnectAppSetup.exe",
        "OriginalFileName": "ConnectAppSetup.exe",
        "Description": "Connect App Setup",
        "Product": "Adobe Connect"
      }
    ],
    "Privileges": "User",
    "Free": false,
    "Verification": "Adobe's current 64-bit Windows MSI was downloaded from the official Adobe Connect downloads page and inspected statically. The MSI and its embedded ConnectAppSetup.exe both have valid signatures from Adobe Inc. The Anti-Cloud Corporation certificate previously listed here came from a WireSock Secure Connect sample unrelated to Adobe Connect and was removed.\n",
    "SupportedOS": [
      "Windows",
      "macOS"
    ],
    "Capabilities": [
      "Virtual meetings and webinars",
      "Screen sharing",
      "Remote collaboration",
      "File and content sharing",
      "Session recording"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "ConnectAppSetup*.exe",
      "ConnectShellSetup*.exe",
      "Connect.exe",
      "ConnectDetector.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Adobe Connect service domains.",
        "Domains": [
          "*.adobeconnect.com"
        ],
        "Ports": [
          443,
          3478
        ]
      }
    ],
    "Other": [
      {
        "Type": "ObservedInstallerSHA256",
        "Value": "70e9cebbf2294d7805f6cda3ad8274aa20164005c8162b748fba6d1265c98c82"
      },
      {
        "Type": "ObservedSetupSHA256",
        "Value": "42a4974d93ae8593e0d5b59b8555aaa1e3dff60f48a41ff4d4dee20a6d211c29"
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/adobe_connect_network_sigma.yml",
      "Description": "Detects potential network activity of Adobe Connect RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/adobe_connect_processes_sigma.yml",
      "Description": "Detects potential processes activity of Adobe Connect RMM tool"
    }
  ],
  "References": [
    "https://helpx.adobe.com/adobe-connect/connect-downloads-updates.html",
    "https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html",
    "https://github.com/magicsword-io/LOLRMM/issues/234",
    "https://www.virustotal.com/gui/file/70e9cebbf2294d7805f6cda3ad8274aa20164005c8162b748fba6d1265c98c82",
    "https://www.virustotal.com/gui/file/42a4974d93ae8593e0d5b59b8555aaa1e3dff60f48a41ff4d4dee20a6d211c29"
  ],
  "Acknowledgement": [
    {
      "Person": "Andrew Weir",
      "Handle": "@mrajweir"
    }
  ],
  "CodeSigning": {
    "search_names": [
      "ConnectAppSetup.exe",
      "Connect.exe",
      "ConnectDetector.exe"
    ],
    "company_names": [
      "Adobe Inc."
    ],
    "signer_names": [
      "Adobe Inc."
    ],
    "certificates": [
      {
        "signer_name": "Adobe Inc.",
        "certificate_thumbprint": "B3E56EED6B5D6A685141BA37C60B2A616A79A77F",
        "issuer": "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
        "valid_from": "2025-10-06T00:00:00Z",
        "valid_to": "2027-10-05T23:59:59Z",
        "src_file_sha256": "42a4974d93ae8593e0d5b59b8555aaa1e3dff60f48a41ff4d4dee20a6d211c29",
        "src_file_path": "ConnectAppSetup.exe",
        "src_file_company": "Adobe Inc."
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "ConnectAppSetup.exe",
        "sha256": "ecae61572669a1571a82c3d150654704da3a2be4fac3c4432771547ccbe008dc",
        "sha1": null
      }
    ]
  }
}