{
  "Name": "Chrome Remote Desktop",
  "Category": "RAT",
  "Description": "Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client.\nIMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context.\n",
  "Author": "n2x4",
  "Created": "2024-08-02",
  "LastModified": "2026-09-01",
  "Details": {
    "Website": "https://remotedesktop.google.com/",
    "PEMetadata": [
      {
        "Filename": "remoting_host.exe",
        "OriginalFileName": "remoting_host.exe",
        "Description": "Host Process",
        "Product": "Chrome Remote Desktop"
      }
    ],
    "Privileges": "User and SYSTEM/root",
    "Free": true,
    "Verification": "Google documents remote-access host support for Windows, macOS, and Linux, and Google Chrome Enterprise support confirms that no license is required. Chromium's current macOS installer source confirms the privileged helper bundle, host binaries, launchd files, and configuration paths. The current Google Debian package confirms the Linux service and /opt/google/chrome-remote-desktop paths. The Windows host sample and Google LLC signature were verified through VirusTotal.\n",
    "SupportedOS": [
      "Windows",
      "macOS",
      "Linux"
    ],
    "Capabilities": [
      "Persistent remote desktop access",
      "One-time attended remote support",
      "Remote access to applications and files"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "remoting_host.exe",
      "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\*",
      "*\\Google\\Chrome Remote Desktop\\*",
      "*\\remoting_host.exe",
      "/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host",
      "/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service",
      "/opt/google/chrome-remote-desktop/chrome-remote-desktop-host",
      "/opt/google/chrome-remote-desktop/chrome-remote-desktop"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "File": "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\*\\remoting_host.exe",
        "Description": "Versioned Windows host process.",
        "OS": "Windows"
      },
      {
        "File": "/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host",
        "Description": "Primary macOS remote desktop host executable.",
        "OS": "macOS"
      },
      {
        "File": "/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service",
        "Description": "macOS host service launched by launchd.",
        "OS": "macOS"
      },
      {
        "File": "/Library/LaunchAgents/org.chromium.chromoting.plist",
        "Description": "macOS per-user launch agent for the Chrome Remote Desktop host.",
        "OS": "macOS"
      },
      {
        "File": "/Library/LaunchDaemons/org.chromium.chromoting.broker.plist",
        "Description": "macOS launch daemon for the host broker.",
        "OS": "macOS"
      },
      {
        "File": "/Library/PrivilegedHelperTools/org.chromium.chromoting.json",
        "Description": "macOS Chrome Remote Desktop host configuration.",
        "OS": "macOS"
      },
      {
        "File": "/Library/PrivilegedHelperTools/org.chromium.chromoting.settings.json",
        "Description": "macOS Chrome Remote Desktop host settings.",
        "OS": "macOS"
      },
      {
        "File": "/Applications/Chrome Remote Desktop Host Uninstaller.app",
        "Description": "macOS host uninstaller application.",
        "OS": "macOS"
      },
      {
        "File": "/opt/google/chrome-remote-desktop/chrome-remote-desktop-host",
        "Description": "Linux Chrome Remote Desktop host executable.",
        "OS": "Linux"
      },
      {
        "File": "/opt/google/chrome-remote-desktop/chrome-remote-desktop",
        "Description": "Linux host management script.",
        "OS": "Linux"
      },
      {
        "File": "/lib/systemd/system/chrome-remote-desktop.service",
        "Description": "Linux systemd service unit.",
        "OS": "Linux"
      }
    ],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.remotedesktop.google.com",
          "remotedesktop-pa.googleapis.com",
          "*.remotedesktop-pa.googleapis.com",
          "remotedesktop.google.com",
          "chromoting-client.talkgadget.google.com",
          "chromoting-host.talkgadget.google.com",
          "chromoting-oauth.talkgadget.google.com"
        ],
        "Ports": [
          443,
          3478
        ]
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/chrome_remote_desktop_network_sigma.yml",
      "Description": "Detects potential network activity of Chrome Remote Desktop RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/chrome_remote_desktop_processes_sigma.yml",
      "Description": "Detects potential processes activity of Chrome Remote Desktop RMM tool"
    }
  ],
  "References": [
    "https://support.google.com/chrome/a/answer/2799701?hl=en",
    "https://support.google.com/chrome/answer/1649523",
    "https://support.google.com/chrome/a/thread/154474130",
    "https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome",
    "https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh",
    "https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist",
    "https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb",
    "https://github.com/magicsword-io/LOLRMM/issues/230",
    "https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140"
  ],
  "Acknowledgement": [
    {
      "Person": "n2x4",
      "Handle": "@n2x4"
    }
  ],
  "CodeSigning": {
    "search_names": [
      "remoting_host.exe"
    ],
    "company_names": [
      "Google LLC"
    ],
    "signer_names": [
      "Google LLC"
    ],
    "certificates": [
      {
        "signer_name": "Google LLC",
        "certificate_thumbprint": "607A3EDAA64933E94422FC8F0C80388E0590986C",
        "certificate_der_base64": "MIIHvTCCBaWgAwIBAgIQC1DPJGsmPv2FpykxUVjz/zANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDQwODAwMDAwMFoXDTI3MDQxMDIzNTk1OVowgcUxEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwczNTgyNjkxMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzETMBEGA1UEChMKR29vZ2xlIExMQzETMBEGA1UEAxMKR29vZ2xlIExMQzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALEbiH4H31sVTQxVJTBpKgRjwYubR+0ZwqBSXudeNE/vHfytN3fyutyz2lycUKCW6X3qPjK+zb3+uwbC2WkjRksqNNXqTQYgrBJuksJxRD+cSShaZG/7sJaey0R3WNa5wlAbBrZBAMwgZXaLX0YDr1NzcknsjCou4o7y6jh/0TjC0bo7wYsVKb0Pq1oN2zYwO48NaFeU4bNn7AgEwwYy6GVLoPtrziEq8TVn4i9kU6wRWyUNBmBRyyAoFsbcyQPnr7wp13PXs5sIy6FI85XC3/NTC881SdXClMJEpoQzgjj6BpJgDaiwhM6muReB1zReN4J2rPsuEwFxp/cSeCaE3bOj5+rSMe4H1gt5U+k9U1/pRe8jyJ9DSG7c3q18HIa3znV5I26DtG5D+An8iK1gBQpI1kPJyLttRePBjEwav9L7I6iSa2ygp2Aw8bhjmIFzdK68eBpAwxCNfhY4JUY6e6ors5F5zWqebwcCL2kFJxAYDLML1Gw625Jos/9Fop+VNglkuN4PKo/qYJaDRRqaNLl+5VkwCSakbIo0M03hMBEDUe0urQFzDqXxHAD1tvjiCwgyLL8eDa2Co7+QhZlblAFL7IKWri9GFBZ0RCgGQj+nA6r//FbYbU00PDgOKHjrJduad4gH6aRwG62MZAGxJcK+yfKxMs+zesiVzeTINs91AgMBAAGjggICMIIB/jAfBgNVHSMEGDAWgBRoN+Drtjv4XxGG+/5hewiIZfROQjAdBgNVHQ4EFgQUT17SRem6UfzmqjVYayx7xFZ0MjQwPQYDVR0gBDYwNDAyBgVngQwBAzApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMIG1BgNVHR8Ega0wgaowU6BRoE+GTWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFOgUaBPhk1odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDCBlAYIKwYBBQUHAQEEgYcwgYQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBcBggrBgEFBQcwAoZQaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcnQwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAgEAtWb9U46/Mxfbnpi8mtN8CdXLVl4tSWvsVqzs9HopC1jf/crM0cOsWNH09wcwd0RMXm9emge5jENyq7GOk0vqLLioFAktTqICdKqrkwp2csGIYyVMEDwBe5R3RQ0xr281+F0CFB2C38fmrHZXDPjLtb2AGIbvG5fY7oo9VIkmphrNTKsY9Pzv5g/pAjDjmoeyh266xmGNt8WaOyCjK2PQivipS1ewonKzCGuNTKo3g5XvyFe1A51diis1KuV9EGth6jKAujRPmCV2u9pZayhDTv/6eF+uKFEEzc0GLaLjiUw0CQ9JYYgb8Y74kalPqlfXlHTEmmwMHWGmnB82/I64FHXqU2QOjPUKRSdphndsOct8fjpkzhkXzMwLUBsgANOuXsb9IkDOR5b25jrFUfo0C0eH58J66eiQlsc9bnhctHaE5xZKGYv1n+OtO3zA0ownE+LvnEX1ejUaOWJp6lEy9vvQxrBOKZ07vCb+WxI3XK9moP5N/yaci73hUKRtdykpqbYNdpzonDuCFLRKPBFRPrguQK9SvHijXn0g3lX9WQSqzpzTv1dUBOjF2Y/N4W2EYnBADG7+hG8+wC/gjnMLdGLWvcaaTiU+ITNDLaH4rlMkayJjkI7RETBcRNxZiq+wJ7yMCjxzjo+33njjgLNJaatyXA55aijNcTH7f/PIimw=",
        "src_file_sha256": "1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140",
        "src_file_path": "downloaded_files/chrome_remote_desktop/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140",
        "src_file_company": "Google LLC"
      }
    ]
  }
}