{
  "Name": "Bitvise SSH Client",
  "Category": "RAT",
  "Description": "Bitvise SSH Client is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://bitvise.com/ssh-client",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Program Files (x86)\\Bitvise SSH Client\\*",
      "*\\Bitvise SSH Client\\*",
      "*\\BvSshClient-Inst.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": []
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/bitvise_ssh_client_processes_sigma.yml",
      "Description": "Detects potential processes activity of Bitvise SSH Client RMM tool"
    }
  ],
  "References": [],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "bvsshclient-inst.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Bitvise Limited"
    ],
    "certificates": [
      {
        "signer_name": "Bitvise Limited",
        "certificate_thumbprint": "1BEF6CEC736EF3478E54549018A96C8273ED7C78",
        "tbs_sha256": "4AA456A8CA2FC6261D9596F2B1E5CB59F3F573F35ECE6B2BBFAD9457E8C76978",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFsDCCBJigAwIBAgIQCuzfQN7DfNtwTjBKZG0Q+zANBgkqhkiG9w0BAQsFADBsMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBFViBDb2RlIFNpZ25pbmcgQ0EgKFNIQTIpMB4XDTE3MTAzMTAwMDAwMFoXDTIwMTEwMjEyMDAwMFowgccxEzARBgsrBgEEAYI3PAIBAxMCVVMxFjAUBgsrBgEEAYI3PAIBAhMFVGV4YXMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRIwEAYDVQQFEwk4MDI3OTU5NzgxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIEwVUZXhhczEUMBIGA1UEBxMLQ29sbGV5dmlsbGUxGDAWBgNVBAoTD0JpdHZpc2UgTGltaXRlZDEYMBYGA1UEAxMPQml0dmlzZSBMaW1pdGVkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtjIffLXOnEDuPJHT41U2Biqcc1tcI3vpWjQbzj96qjrruuMWjQyGzeOmOWEr3ynnJGco9AgYcMHHwXUGjq906jjQPI7DpblHQskqCry8KD2E7h2oCNzmdxQmVY0AYKtYh1goUlk06naLCh9IoW7QMiiH56Nthix0Ksh/cAB/Mk9UMKCnQoo03oWb4zNx5zcelWo6pSAWIKw9CfpessOxvjuwJb1fsyTVzcWeeZikXEctVRKJxZw9EBkuQCKlbdpLi2pmHQCrDKJrLcc36N7LyYcugFC5d3kKOpVqMpFQHni0uisYYnQ2WIYjLHNIf9T+G532zb5b1+vac4/3lB1H1QIDAQABo4IB8DCCAewwHwYDVR0jBBgwFoAUj+h+8G0yagAFI8dwl2o6kP9r6tQwHQYDVR0OBBYEFPO+DcnnP1nVD7JEulhWUFcwIhGwMC0GA1UdEQQmMCSgIgYIKwYBBQUHCAOgFjAUDBJVUy1URVhBUy04MDI3OTU5NzgwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9FVkNvZGVTaWduaW5nU0hBMi1nMS5jcmwwN6A1oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9FVkNvZGVTaWduaW5nU0hBMi1nMS5jcmwwSwYDVR0gBEQwQjA3BglghkgBhv1sAwIwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAHBgVngQwBAzB+BggrBgEFBQcBAQRyMHAwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBIBggrBgEFBQcwAoY8aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0RVZDb2RlU2lnbmluZ0NBLVNIQTIuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAH1FR6+sSmDySKjKAhB6ZXP4jsptE4wsNom3lTU2qmXul3IHST93T7YKVJs7Vvf+DSSxKyPSNw7bpIXAvDRT4GPg9wF+0QhKEcOO7UfzltBBgjHkYScu4MTp6LS+IKQ0KvLXCJw1a1nOEof/jC3gEUItTVMeX9AF8fUNdgN0D/vSfLCtJr2a95dNa/psuDXHUl6nENdUkremKnQ4YIFcB+B7gISYVtWtll2bhF5lTrSQ4OtZcbwXfxQWtWF2omlDkxWky9RTNpbK6+ct+tyDKbc660bwHYr6g8hgYJG22lLIFguB8HAY3CBgQAUfaksopwEFoRLI4o9KDhakNqPaXkA="
      },
      {
        "signer_name": "Bitvise Limited",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "",
        "tbs_sha1": "58502E7360285E16BBD2936E1B393F81BC1D18BF"
      },
      {
        "signer_name": "Bitvise Limited",
        "certificate_thumbprint": "A6D37D7FDF19B73DB3E3A8D6D77B67DFD423BB22",
        "tbs_sha256": "30837BDCFDE3280CB0F47072C70F662E99396CE61F83573854A4107C24D9ACF1",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIHvzCCBaegAwIBAgIQA/2YzXlPmo5tePprQMTjWzANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIzMTIxODAwMDAwMFoXDTI3MDExMjIzNTk1OVowgccxEzARBgsrBgEEAYI3PAIBAxMCVVMxFjAUBgsrBgEEAYI3PAIBAhMFVGV4YXMxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRIwEAYDVQQFEwk4MDI3OTU5NzgxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIEwVUZXhhczEUMBIGA1UEBxMLQ29sbGV5dmlsbGUxGDAWBgNVBAoTD0JpdHZpc2UgTGltaXRlZDEYMBYGA1UEAxMPQml0dmlzZSBMaW1pdGVkMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAoLHDGqEam2+5mi9Ty0rEtnH5HzM0m5dxvyI2N9Uwza8frEJNTMb+9gvSObp/YHm2co9gVddFIpXFhf9/nv87aqbEbdWy7uj25IUDy73ZMyYiZ5pthhWPd6lp1lqIOiYzLJXJFzu1Dgyo75tECLpR4aX80xYA8l0caX3oQkYcjxOgHotZGUestxd+OBXKln1I9C3rrRYQyG0jWsMIqWy9wWkq+drKdObWX7MsUK4/pud2uVY3wQEF/8Hva+9+8f1/0p5x/hIOSWyM8xb6UsjORErZpyX+es0h93Y3543QDMyXRbgsZEBEIxQb+lD/krgdWLzrvCEA/CCbeUgX8ew3y23kObx+BRK+Zbd+iHV/WxjJaVFoqInij1zqpIWP4kZuJtFfOD3KSz66DEYB09/mJ8WsFQzwidunhp/gu0RahvabnEKBf4AAljH60eMfk/vEsnUgmos7Mdc0YQDJRAfFqCtKXhVHp58pbVgwCGS6cU9uizVIHvROw0ymjLvhTx5IBr7HpU61mOq55jznFy+pSr5tDONXwZxPtFQEh2elpRBbEzaN3OqfJJ8m9z2jFOi7UQ7Kud5DnU81CTfzWwtnXQdoC579dJkFvygnIxkaATJBQ2XOoIVyKp3aWSsfGOoRPhKfusl5xjDom4vPQnStizdaHgnvwkOS93QRt+z/XR8CAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBRYKAAk1XNwx++ZZqRb9NXCKl/B9DA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQA6NzC26Ri5I0GlbA1Flby29eNERFmWNmkFUSfvCchGvETUMoeeX9Ktt6PsYe89sNUlyKt8Led1MzcBAypOpBm9OREYlz8eQaXaCCKRLBy9HTOjmsCdLoZqlREj7nFJuKaV/ptPEHjpoD2ztUrvO+knyVJ9XLRG9gpBg3vNxIbANU2jB/2jMRye4S4Dm/b1JqjJb7Mw8vwgEc3bazLycEMbRHcHTij/0r7KXFukbgy7hA+OTQIOahVlnAc4Lz0WgjIru1FtuFB6K7/DWg+qcHowPjPK1STOw82s1jw78E5iS/gIYGplgsgcAceigV57L4uf0S1BqDoo1xd8FjUTnpnlZ2Y0AQllMhTI/d9B2Zd/hQq1UaSjMQ7SjJzQtlvhubuHDmrv0dz+glRNMHLFefs29ygs1GGyGBZ7K/qtK/GS1X+au/eFmSWOSGcTIJNu2ByqGqjWTplJ/FvEv5c2w8Zzl5ebgXTXedAt7G7AseY9niqw23ViOw31xihpetfg301d1EzxU38NP2xhlYNaakdxoRZl1UXuDsaVBnJMPXWGEXZPCv5zAir1TaRMIsxeskOKICF+JRFdcSfLTczXZBvYSpQYpbIliasIrU9VaoAMm8Rr2WLb0uRlKoQ4NOXZiEM6DD/n49R0Tg1/ZOgIAAQFKy1qBMZ2pFKNcTaQ9SnOOA==",
        "src_file_sha256": "5aa0fd8c3c0c50e452569fbaef291f96b2ae3c9a7b52f80ed34bb48d63a8bcec",
        "src_file_path": "downloaded_files/bitvise_ssh_client/5aa0fd8c3c0c50e452569fbaef291f96b2ae3c9a7b52f80ed34bb48d63a8bcec",
        "src_file_company": "Bitvise Limited"
      },
      {
        "signer_name": "Bitvise Limited",
        "issuer": "CN=Thawte Code Signing CA - G2",
        "certificate_thumbprint": "55D8B82CDDE540B5C74614D391CC82E8D281B14C",
        "tbs_sha256": "91B0725619F5781AE3B4E815758A6B77D61A3A7E252F87272C21325717DA7FFB",
        "tbs_sha1": "58502E7360285E16BBD2936E1B393F81BC1D18BF",
        "valid_from": "2013-01-26T00:00:00+00:00",
        "valid_to": "2015-02-16T23:59:59+00:00",
        "certificate_der_base64": "MIIEMzCCAxugAwIBAgIQJAfCCf3Hj1dNS5vyQGiIEzANBgkqhkiG9w0BAQUFADBKMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMuMSQwIgYDVQQDExtUaGF3dGUgQ29kZSBTaWduaW5nIENBIC0gRzIwHhcNMTMwMTI2MDAwMDAwWhcNMTUwMjE2MjM1OTU5WjCBiDELMAkGA1UEBhMCR0kxEjAQBgNVBAgTCUdpYnJhbHRhcjESMBAGA1UEBxMJR2licmFsdGFyMRgwFgYDVQQKFA9CaXR2aXNlIExpbWl0ZWQxHTAbBgNVBAsUFFNvZnR3YXJlIERldmVsb3BtZW50MRgwFgYDVQQDFA9CaXR2aXNlIExpbWl0ZWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsFFDzN3M9ZpceteuQ77kNnoXmSns0culCXwCA6N3YO1R8B9NjmigSiHbrDIKX1W5a8W/iEjMdmVpijyZvBcXun6d6lBK5ov0P+PiZEstUdDGhLQYNEjHwTfgFlHpjULyfX+6mO3CitLPrxSMXMFA7cNWKXUZTJDBDh2AYLj/TmaYF7fJS+FlPy3SrhBJOnMhWhv4VK6QU0tYYKXo9oQU3EEjBjUoAuwR/8sldf1Pt5lvlUaoTH4SYRC4g7I+v0X3PJhlJFIFJ6ijX5XCRgMgEgjNwVhe0XtfMrQ97X27zpP5D1yIX43A+34cYFuKnvQENt2+dW8DMsuWxfJyZgJvrAgMBAAGjgdUwgdIwDAYDVR0TAQH/BAIwADA7BgNVHR8ENDAyMDCgLqAshipodHRwOi8vY3MtZzItY3JsLnRoYXd0ZS5jb20vVGhhd3RlQ1NHMi5jcmwwHwYDVR0lBBgwFgYIKwYBBQUHAwMGCisGAQQBgjcCARYwHQYDVR0EBBYwFDAOMAwGCisGAQQBgjcCARYDAgeAMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTARBglghkgBhvhCAQEEBAMCBBAwDQYJKoZIhvcNAQEFBQADggEBALGWYDLJTRkwB0d5BtxnlMn5dr4GfK70c8iuZ7LuJf05KP571TwBacCI//cxInGZhtqFO1Q8fqJwM3Un3uf/ulfZ1yzn9VkBGxcqaXCOVOBepAmOpc7lmmYmayqKj+zjGDab1EZACo63gFm5H44VDx/kqj4vfK3tNSFopZAfPQgHZk0b+r9McSH5o5aAv7E2i4uCrBAI6ZdFX0Dbk8FaMKJuJNBahEXt+Rr+zA75x04yO3nUbB+8BlmN3AoYFNH6qmb18GPUWUQWz+Qtt7HJjIxIFyVs7MHRgxa6D6MWLb2/QoY4ZGWV4bgFWufQhbpLfkj9ZOX7W3+bSDECxRJcK3s="
      },
      {
        "signer_name": "Bitvise Limited",
        "certificate_thumbprint": "37A4D270989616341908354E3542171EAB364159",
        "certificate_der_base64": "MIIGXjCCBMagAwIBAgIQYvdOaLgZessXqhhCOSizfzANBgkqhkiG9w0BAQwFADBUMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSswKQYDVQQDEyJTZWN0aWdvIFB1YmxpYyBDb2RlIFNpZ25pbmcgQ0EgUjM2MB4XDTIzMDkxOTAwMDAwMFoXDTI2MDkxODIzNTk1OVowUTELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRgwFgYDVQQKDA9CaXR2aXNlIExpbWl0ZWQxGDAWBgNVBAMMD0JpdHZpc2UgTGltaXRlZDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKDUXqKOwbFRByrfyTGGWw3457TPAEdP0jfm763R9NiQzJupS+4mex5qR1XMfPDXFEBIRm2ytOZ5duYdL/L6lSqJ5OmqeI56GaNWjRrCwuPAuJmI39UkRxWyERJrRZdytU5khXpKDi4AOR3lJA42vWimRChO/5qdhYFkIBj9mYwPH6PY7viHY2QdTsdOwviwHdf483CEP9agLD447qVsayik3TtoZgG/k3UXa7P4ajEcDTVESkX0yxdN+mp9a464R+NxXls3otgJxSu7LQy+CHio8+SS22iBhJs+1G1glQnts3oDrjcg165iZriIfU2JolydcPGNDxMEYwwbyFOsvRHNIQ3Jge//NFAl20IRi25q2HF8ANx6VdzE0i7aXipvqoB6rOlkd+SY9NCr4JgN4mE3AgBTzV32BKVinSilOysLpvUJRBBu2nIR+YsuIex5UOzwRof5hJRrlLv0K7m9o1hqYCAc+okN7jPNuWqUFtx6PJtjXsTgwW02muzzBgpXJ87x4ckjjnXZk70iQ3s5BsBG+ftajJiYYVHCRqkT1yA4B6vEbX/OWo5wdvUxe4rOLkuHMfEmBXHM9KB1bYjAgeDb+Q9/av8gTx0RkLQDm22ITlz+Snyud4zZ2hQgyYghfNxsCNTOkUHda0Je7PrOpoJ9ryHDU6A0jp6XyKTm3gVVAgMBAAGjggGtMIIBqTAfBgNVHSMEGDAWgBQPKssghyi47G9IritUpimqF6TNDDAdBgNVHQ4EFgQUEovuYYSROQhN8eHQ9aguq33MdJgwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwSgYDVR0gBEMwQTA1BgwrBgEEAbIxAQIBAwIwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQQBMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5nQ0FSMzYuY3JsMHkGCCsGAQUFBwEBBG0wazBEBggrBgEFBQcwAoY4aHR0cDovL2NydC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQVIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCIGA1UdEQQbMBmBF2NvZGVzaWduaW5nQGJpdHZpc2UuY29tMA0GCSqGSIb3DQEBDAUAA4IBgQAitLFGtFqCHtT28o0QNs2azPbLD8zuGVLLyNgc2KvmEjAx1n8L5KLaYwL16w0OPzqWRKxg4nIy9MTal3LNqpibHyI+LjLWA/vhSOfq88k+VEMIi1acu0hK/LcpqjkLR9E6z0wfaIG3DfgikRU+vrEVkzpiN7OfftnyN8MCX+9YPT/thPOASSgILXOJ4Yfo2UEQDx2ri8zqc3INoKDQ+JjQSbQMYy0mS97uChKBfSAa4sP7Y3glpKcHrLj+gihpLUInB09MGoNXDiifY+B3HqgXB46cBCeO+zBz+Nq7Ap6nYXrhgdEI4+aarN9E9+MmuTrHB08TwUzxvzPVAYuJ2wZ9OTytHh4OdVCA7AdDyMsFp9JEg5/jqwnuPL0SMIJlTni2V3prwfVX2BbzvNv2I9FdYIIHYbc5NdBDrCZLD9c26lnnZmc+hU7rL1CQb9UmjfpyUT7agWZT8h6Mb8yrVeYSO9fRI4FZNYDmyrMDApmW/cZ+GKZKccGWiEpLetapOhA=",
        "src_file_sha256": "a68d7fe876f7968127050a8e42049f751ea2cf18f8965dab9b36433111c8d602",
        "src_file_path": "downloaded_files/bitvise_ssh_client/a68d7fe876f7968127050a8e42049f751ea2cf18f8965dab9b36433111c8d602",
        "src_file_company": "Bitvise Limited"
      }
    ]
  }
}