{
  "Name": "AliWangWang-remote-control",
  "Category": "RMM",
  "Description": "AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://wangwang.taobao.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "alitask.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "wangwang.taobao.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/aliwangwang-remote-control_network_sigma.yml",
      "Description": "Detects potential network activity of AliWangWang-remote-control RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/aliwangwang-remote-control_processes_sigma.yml",
      "Description": "Detects potential processes activity of AliWangWang-remote-control RMM tool"
    }
  ],
  "References": [
    "https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "TAOBAO (CHINA) SOFTWARE CO.,LTD.",
        "certificate_thumbprint": "AD2801EFB6FD0006B0985EBE79011B5855E1A6F8",
        "certificate_der_base64": "MIIIDTCCBfWgAwIBAgIQDGdXIdLdQB5bMQOAJnP42TANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDcwMjAwMDAwMFoXDTI3MDgyNzIzNTk1OVowggEUMRMwEQYLKwYBBAGCNzwCAQMTAkNOMRowGAYLKwYBBAGCNzwCAQIMCea1meaxn+ecgTEaMBgGCysGAQQBgjc8AgEBDAnkvZnmna3ljLoxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRswGQYDVQQFExI5MTMzMDEwMDc2ODIyNTQ2OTgxCzAJBgNVBAYTAkNOMRIwEAYDVQQIDAnmtZnmsZ/nnIExEjAQBgNVBAcMCeadreW3nuW4gjEpMCcGA1UEChMgVEFPQkFPIChDSElOQSkgU09GVFdBUkUgQ08uLExURC4xKTAnBgNVBAMTIFRBT0JBTyAoQ0hJTkEpIFNPRlRXQVJFIENPLixMVEQuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAlsu3tjU/+YSuvGG5NA3gaxea4HM4QGl7new/Iw5GyZeLMg08Cdsy2DBi1Okk1kjS/GoInrL2q4B3eTrP+sjYMiVsHXWnOkM2rVK0HdRYKoAbvlM4+nq0x+bAEj5WDyzqDAMv/U6tufIZtDeo509UKgtiawV1KqDXXlt+f+dLgNIVHyANQ9DLddGue1aBq59Lr+5F4qPS8ific8j+h6/Btv+lhgG6e3UyaXLxO1IiRUOJq3nWGrquKxQirM9+XPHNjp3qm+o2lY8dib949My/cHBWAaNpausjfcG13j/8AQkWzwD1UPr+GidiTJnZmjTeo1rZoVUh/lNsRXg6kvnYZ2vlJADA1jBSY5zxALUkrvaRhxjMSrvpZbhCmSl+0HksSVsUjp/1cTygB0cyPz6b3sCSHzr4wLFD7fmbxnu8xO39KQSeFnBFzjrxQ2BKaDFUC6ObuZoa58CigDUyQTfGI/x2r0gKyI7fJLjZ8Xx3PfKwZ8NQqMZG9g3Lc9d5/HoulWfHh+3h9PGWFmA0jQRjPENzPiNbtiMjTaz5l7HJkhBXKQ3Zi6Q4VEF6cdx0n6tnkXWJMiWFwATsWof8WcInYtx6AEG/xuCzCGwHM20yM7ENsbbuake1GuWSyds98Eyj0V6W5TDkzwETquh0kfS4uOBNIaeg/GPb7iJpoJz4gR8CAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBSz2iX6xRQD75M0CiEbY3vco0XWxTA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCjxlwf3C5M15N2WVyY5uqiBDe0sv+zucAtec6xNNXaitfb6s5DUwNhM1mF35NeUxZL0XW7jG8FHxuHkDvQqN3Ln7zTBSHEIxdDkfrif73LvpdiD/YPFRVrY/sJowIgCeKT4YBCb9v6rF0FAmYb8tcVhi0umD+qmfgJaPOuFeW3bF6Xn5mvZmJwYrhJ0Fehng4Ij0AXMX2ENALOk5Dvplz12sp7/2szXruHuXAOywi31NSfgdgCHbcgjmmQTttsUiyq3dV2y4SkS75/JRBA9HfrB+iDCysvbtHB5k8o75txJCPqbYlboRyLpPr/2qb0O9ipIgov89WGoZ+8vh6K01c29WAWGJkmRAFDhycpX5h6AAfL8gknUc4dcxm1sq/keM6lhVheoJ68s15mQJg4hy3/DuJI1X3TXud3bDrKWatOgWdaPZAM2pjC1CXZZWa+Z6qRkoTlW23to5iuJqTrBezblP1BjphNt6Fb/wzeI8cmMJUOWjBZd2LFyq0PVK1yFVvYWqrDDlT/PzC+Ons7rVAGQ4tHAPZvseSP2BhDO4Ey2xja6+wKHyrEhd5v16lNr/LB4ymCOeQYja7GDq4PymGLNWwbHTnn2ObhJSTj4xFq2Eu+lobnB7oPPsX9LeZHF8LRVBUACRnE3Ft8FteAcpGT+f+fKu1FPiSqdDvxQRkadg==",
        "src_file_sha256": "e9bf9575e130de921b6d04e3717c609292ab86ffad1f64cf73ecb94d15c5be91",
        "src_file_path": "downloaded_files/aliwangwang-remote-control/e9bf9575e130de921b6d04e3717c609292ab86ffad1f64cf73ecb94d15c5be91",
        "src_file_company": "Alibaba Group"
      },
      {
        "signer_name": "ALIBABA (CHINA) NETWORK TECHNOLOGY CO.,LTD.",
        "certificate_thumbprint": "7CE867B4E3F3F5CCBD7DCF8BFA3187D762F9EF00",
        "certificate_der_base64": "MIIIOzCCBiOgAwIBAgIQA6oieG/A4cRoNGbrO3LwaDANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDcwMjAwMDAwMFoXDTI3MDgyODIzNTk1OVowggFCMRMwEQYLKwYBBAGCNzwCAQMTAkNOMRowGAYLKwYBBAGCNzwCAQIMCea1meaxn+ecgTEyMDAGCysGAQQBgjc8AgEBDCHmna3lt57pq5jmlrDmioDmnK/kuqfkuJrlvIDlj5HljLoxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRswGQYDVQQFExI5MTMzMDEwMDcxNjEwNTg1MkYxCzAJBgNVBAYTAkNOMRIwEAYDVQQIDAnmtZnmsZ/nnIExEjAQBgNVBAcMCeadreW3nuW4gjE0MDIGA1UEChMrQUxJQkFCQSAoQ0hJTkEpIE5FVFdPUksgVEVDSE5PTE9HWSBDTy4sTFRELjE0MDIGA1UEAxMrQUxJQkFCQSAoQ0hJTkEpIE5FVFdPUksgVEVDSE5PTE9HWSBDTy4sTFRELjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOriHNxw/UTFgyJEnA0QRj21vP/IlsWbpDQJiC8OcbFOHuFnfWjQe73LYPqrw9uPZPA0frQ5PZFOqDqEcJSNy0YxMlut5nxHyTtxUDVn7bJF1hy1LO+1Ba4eNunqeGYHET/6OOPbRh/2gk2trz1mxrwUFJkd2NuuRktnPJU33j8iPYikYC7D5vm+DhdsG15WVsoy7fitgXeAFKH6Uf78KAy4ry9zTR+8Yu6wGL/7j0LOYv9Nr425suzShjgv39h6mxaM9OsdHP43/2BJ3+KYt7d4DyD0IpAJkuduc86hT3ViGwIhfhXgSgo63TOEfqbodxfjWBJ76SfS+i/6B/ctv6n1Lms6uSJFfwXvyhgtiDAFrtVsNCR1PukG4XO+kYJBXVVVH772UN2mBSW1UutwsbcMj9ZswCsMRjbfpT2DpnoD4Wu+y0VyZb3vYri8zGYXSQpV23AauQ7Iy0AmnpYj2BgV7PqjiBoZsOWQA/kJGu84usWQF/8urZUCx0x788UPp4usj4TrRd45qDYB8uCPQP/dlgg9FzEF11Rh0uKjh4VJKTsw2hTXkUzhZd4jebcN5VN0PejVm+BsAE3E5Tr2evWYzCQiXnhaJehUeWDxGCUh1wN+Qz3II4GTxE7GmhZCrx0RJFaQffZLw6ZMvPIH0d9fD3IwtJVY4ChbDoW4wYxxAgMBAAGjggICMIIB/jAfBgNVHSMEGDAWgBRoN+Drtjv4XxGG+/5hewiIZfROQjAdBgNVHQ4EFgQUgcMb5ezvQJ11hoeUZ5Hm/jFCooAwPQYDVR0gBDYwNDAyBgVngQwBAzApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMIG1BgNVHR8Ega0wgaowU6BRoE+GTWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFOgUaBPhk1odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDCBlAYIKwYBBQUHAQEEgYcwgYQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBcBggrBgEFBQcwAoZQaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcnQwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAgEA0mF6j9DI4HOcQk3kaDRRPISgm0hwg85jROI2d6QClreJf6aBoPfSn4AQYF6Gr1vZR3TpGiMWhIBmsszHLiMT70P8LHtDaZ+hds/dZqMa7oLFxH6zbuxQI3RceGFq4uyQKIUNkIounRMWco1KW9XhLKpDAwBYDb9TSR0UT892OK0gqDWmp8gaUoZFK6oUflCpiWyt9aAUbt4AJzjeh9oAfYf1tncEVX01Mqs5UNgJY5Jp3Mtb9hiDPg5q8PrGZ6KUjYr6X2wiY6RjNlLjQd7FeVQxE2KEjTQKi18MKgDT/ZKJptb2WgnNi4IxouBzv3lh9OHmRNpRL44tjyfmDfbZJbwVyzWmuQk+2n+ff9is3e5gFIo8lrw0mAk1weTO/I+GF/365XF4+OPSxwEshcpBTLOQbYaf8OoWiScg1lxV2eykuhVDFgQytzskChQTnUpZFmAcbC+2JZkdOW6WwiwvorxVIFDg/Kgjko79tosXEY6/eNbCNRNuPceu7N9cLL9vth5OKqwOweZzgjVFSUNnGKiueapdwcHLVls6AeMlsOuNsnQZk+czjC8YnRH2G73f+dinRXJOTAooM7CBEqQLtMwABPSJ6ba3X5Dd81eue9q6HFdHip7FDwhhYEz+cK2PijPG3l4/6PVIkKOpHqsGdM3AWuMPaDf75zrUOAm8ggU=",
        "src_file_sha256": "d3b2b174fe34f1e568333977c0bc23b3df3f68e47fbe503772becdeea6d140af",
        "src_file_path": "downloaded_files/aliwangwang-remote-control/d3b2b174fe34f1e568333977c0bc23b3df3f68e47fbe503772becdeea6d140af",
        "src_file_company": "Alibaba Group"
      }
    ]
  }
}