{
  "Name": "CrossTec Remote Control",
  "Category": "RMM",
  "Description": "CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.\n\n**IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://web.archive.org/web/20220811150547/https://www.crosstecsoftware.com/remotecontrol",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "PCIVIDEO.EXE",
      "supporttool.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "user_managed"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/crosstec_remote_control_network_sigma.yml",
      "Description": "Detects potential network activity of CrossTec Remote Control RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/crosstec_remote_control_processes_sigma.yml",
      "Description": "Detects potential processes activity of CrossTec Remote Control RMM tool"
    }
  ],
  "References": [
    "https://www.crosstecsoftware.com/supporthome.html"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "pcivideo.exe",
      "supporttool.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Microsoft Corporation",
      "Microsoft Windows Component Publisher"
    ],
    "certificates": [
      {
        "signer_name": "Microsoft Windows Component Publisher",
        "issuer": "CN=Microsoft Windows Verification Intermediate PCA",
        "certificate_thumbprint": "5C4D0AED88959C9D30C1B30F9AA916BE57544CF6",
        "tbs_sha256": "DDFD99125B30665247E714C0B2A4D17908F2228DD04FBA2EC311249F9BFB678D",
        "tbs_sha1": "2169D040A744D6C45E0214C48517B372289D79AF",
        "valid_from": "2005-10-11T23:24:57+00:00",
        "valid_to": "2007-01-11T23:34:57+00:00",
        "certificate_der_base64": "MIIGBDCCBOygAwIBAgIKYRDDUgAAAAAAAzANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjE4MDYGA1UEAxMvTWljcm9zb2Z0IFdpbmRvd3MgVmVyaWZpY2F0aW9uIEludGVybWVkaWF0ZSBQQ0EwHhcNMDUxMDExMjMyNDU3WhcNMDcwMTExMjMzNDU3WjCBhDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEuMCwGA1UEAxMlTWljcm9zb2Z0IFdpbmRvd3MgQ29tcG9uZW50IFB1Ymxpc2hlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOM0acw9GELvutSbWGagdFj3zsaWTgAEwL/TOKjVfgShZNYnT4mudJmsAC5F6/NdmNXZRDA0UDyjvo9Kq7+O250nEaL66YfvF/DSJ2xqRGBh9wi9OF0hO1S+vNcCrvTkv9qBpCQLmNqEiHX0CJBv3Mp2k/shdxd6fb1RcKxO3XhLrfJSH2a/WKSGbzizk3CTwG41yTb+43U8cNcabxFKj4Qlm5p+jpjlhOTlSl55wUMqJHqV06bQS0pTeTc1glMPFRMClm3WoZxaCKc73gbyNZPiBLhYNRRFXnlJ+SSsu93v8eBky3qA01ujPZKxROrW4N3qezTx4z6lFiFhI1+bNECAwEAAaOCAmowggJmMA4GA1UdDwEB/wQEAwIGwDAdBgNVHQ4EFgQUIbHZusF1p8SphRo6Nh48Z/RWS8AwHwYDVR0lBBgwFgYIKwYBBQUHAwMGCisGAQQBgjcKAwYwgakGA1UdIwSBoTCBnoAUi71bM+FBDLv6QnJ2V2+6gyVTes6hdKRyMHAxKzApBgNVBAsTIkNvcHlyaWdodCAoYykgMTk5NyBNaWNyb3NvZnQgQ29ycC4xHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEhMB8GA1UEAxMYTWljcm9zb2Z0IFJvb3QgQXV0aG9yaXR5ghBqC5lPwAAbqxHaOqG23+yIMEgGA1UdHwRBMD8wPaA7oDmGN2h0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL1dpbkludFBDQS5jcmwwVQYIKwYBBQUHAQEESTBHMEUGCCsGAQUFBzAChjlodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY3Jvc29mdFdpbkludFBDQS5jcnQwgcYGA1UdIASBvjCBuzCBuAYJKwYBBAGCNxUvMIGqMEAGCCsGAQUFBwIBFjRodHRwczovL3d3dy5taWNyb3NvZnQuY29tL3BraS9zc2wvY3BzL1dpbmRvd3NQQ0EuaHRtMGYGCCsGAQUFBwICMFoeWABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAxADkAOQA5AC0AMgAwADAANQAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAQwBvAHIAcABvAHIAYQB0AGkAbwBuAC4wDQYJKoZIhvcNAQEFBQADggEBAA3inZB8cCv7Cb9+qniz0YxsfpXd8A/AnEdA0vYFpebpqJ7tlbGt/2uTHujtKw7cHxrc2f+NKLNAyBeXGexSeBIfaZBQNOO7kwXf3I1A7UPjPTHSfRreqEBmCAnfABJOq7MiiGnkCeH3+gQ4pF3wbTCzfn2J0ryovfj21LCLCMaIzkt4s8CKzQ7c1dP34XQUkNKdFJ/hxyMlU4Zh4OyWD3K7qrLGqynjM7OEWUuYpqiA472iDwoel/pgQpBM96daT26JbJuHK/D4h3CZmn553Ba5xHVA9sgRaTdKBbNj4TFMZE1uA8o1xBfqaaypM5s4i3OhMwQ3AZJHd/cJK74tXig="
      },
      {
        "signer_name": "Microsoft Corporation",
        "issuer": "CN=Microsoft Code Signing PCA 2011",
        "certificate_thumbprint": "62009AAABDAE749FD47D19150958329BF6FF4B34",
        "tbs_sha256": "E17764C39F2AFD7114F8528D2F9783D9A591F6679715EECE730A262CF5CFD3B3",
        "tbs_sha1": "3D07186A55AD7D7691B88AC4D130F2002F664B16",
        "valid_from": "2019-05-02T21:37:46+00:00",
        "valid_to": "2020-05-02T21:37:46+00:00",
        "certificate_der_base64": "MIIF/zCCA+egAwIBAgITMwAAAVGejY9AcaMOQQAAAAABUTANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMB4XDTE5MDUwMjIxMzc0NloXDTIwMDUwMjIxMzc0NlowdDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEeMBwGA1UEAxMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlVrGhmlHHTQe8VXDZnX2YlQYWBRnJ/CjKsYDSLzmVjR/SWEC7oR4ZieUViEstaHst807sai25BwHZm3lPDRTKOPT7+9TICEvSBvxLasDh+7qWp/pSKujTnMOXzujrPtdkdENvDMxp/t8uxdpig56KVbtLBLn8uOd4Mc9ejPGwMOPkF7r+/n0fVs0SdgqVOtsECmIhUDH3sOlYeX7j6F5aDd5OvkJc+84HE+GEZsc8e4zFaT/7ryurGXAcUN1oAf1pMlx4MWmNfSAMy6tkIj4l9mK8okeRLGAat+QT+1NeQ5WbaUrNsCGE5JAwcYTySAyYKMGbuRsoR3aq7Ldzo5EkQIDAQABo4IBfjCCAXowHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0OBBYEFFeCGq5Kue3rGoLuhVAW9u9GYo3PMFAGA1UdEQRJMEekRTBDMSkwJwYDVQQLEyBNaWNyb3NvZnQgT3BlcmF0aW9ucyBQdWVydG8gUmljbzEWMBQGA1UEBRMNMjMwMDEyKzQ1NDEzNTAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAFoPgK0uAJ6uyq6ILJSEJ6DB0l1D6/0ajiISV/t9jm7mNzBb3ZURJW0rEica0cvzggmXUrHvn9gKkPhf9mmMAQ5lEG3jAfJ9KWC2Zzj4n6nu/EQR9n1WbL18cn4s2x7m1lqFHzVvxSZWZS18CZhdwaC/BNqdPSt4WoMM/6LXCrUNfkOPg2jmF1pXqiayVLJx7PVIi3K1RdJXi/0NVeW7IaG9jk5WatKs0nazAy1nYcq1DsZ2fqI2e1HU2OFZwrqIG2fWbPbMiW4O2VEvUlYGJKMEbFr+Y1eJW6kw/rRuBc4TsHEUMHW+gPM6djZ3frO1XQrmBbBoCONbnA/KMVX3ADIxfWF+TdrOJpbZKp1Ht/4bVa58SigwMEmJYmrsdi+4CsPmw9ZBGf+aMy0Zyd44w5KJk6z3LaJGPymmdarm9DVJ5jih/t8VCv6ZViSvATkGLlO4CmB+2MvVkijZT+6So+ouNe/tzWv36yJ45wZCkQif3mE7wR/rOYLns6X0FrVOGzaP4/EMNr6U0PcO35YR+/EZsHd9ffmE5ob+03MQ21pcrXmo+EStsJN6WNaEs9iTxOTzbjZnfRpn+qHj2YMuyIvSSy6vEp1C1e2/iD9FF0WPavhnUYzNgBF+prGb7zwiKBtGmB0LvcGbChCto6r1ovP8XXnnkiPRTeitcOKFUDOD"
      }
    ]
  }
}