{
  "Name": "Duplicati",
  "Category": "RAT",
  "Description": "Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://duplicati.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "c:\\Program Files\\*\\Duplicati.Server.exe",
      "*\\*\\Duplicati.Server.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": []
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/duplicati_processes_sigma.yml",
      "Description": "Detects potential processes activity of Duplicati RMM tool"
    }
  ],
  "References": [],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "duplicati.server.dll",
      "duplicati.server.implementation.dll",
      "duplicati.server.serialization.dll"
    ],
    "company_names": [],
    "signer_names": [
      "Duplicati Inc."
    ],
    "certificates": [
      {
        "signer_name": "Duplicati Inc.",
        "certificate_thumbprint": "7812DFC61915A4BFC049834D63DBD2E9340D82FC",
        "tbs_sha256": "437C2E9C10A4C6176D49821EB04EA42E3AA33A1562071306529B8A5F9620DBF6",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFpDCCA4ygAwIBAgIQbRV7ZSVixkz8drvzia9N9TANBgkqhkiG9w0BAQsFADB7MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAPBgNVBAoMCFNTTCBDb3JwMTcwNQYDVQQDDC5TU0wuY29tIEVWIENvZGUgU2lnbmluZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIzMB4XDTI1MDIyNTIxMzY0OFoXDTI3MDIxNzIwNTg1Nlowgc0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRcwFQYDVQQKDA5EdXBsaWNhdGkgSW5jLjEQMA4GA1UEBRMHMjk1MjE4ODEXMBUGA1UEAwwORHVwbGljYXRpIEluYy4xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRkwFwYLKwYBBAGCNzwCAQIMCERlbGF3YXJlMRMwEQYLKwYBBAGCNzwCAQMTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEONNVCvIITZI8h9H9VTK7M3tUWeWeEFBsNIveBV1J3OHC/oytZQNgPN7KWFEkiBkKpTDa3De4+UaE6HWIVMNSzaOCAZowggGWMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUNr1J/zEs669qQP6ZwBbtuvxI3V8wfQYIKwYBBQUHAQEEcTBvMEsGCCsGAQUFBzAChj9odHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJDQS1FVi1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMy5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMFAGA1UdIARJMEcwBwYFZ4EMAQMwPAYMKwYBBAGCqTABAwMCMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNzbC5jb20vcmVwb3NpdG9yeTATBgNVHSUEDDAKBggrBgEFBQcDAzBQBgNVHR8ESTBHMEWgQ6BBhj9odHRwOi8vY3Jscy5zc2wuY29tL1NTTGNvbS1TdWJDQS1FVi1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMy5jcmwwHQYDVR0OBBYEFFbYH++ZUZPOSHc/EpvuggHp0rbRMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAJDcvg9H9v9sAFpASq+6HcYoSo/MWKDXz0XtwdvSDcnLKjRAq/5XhW4VSzUmLH3UkDUwRwhTfOjj1OMvvMKeTUyf/uvRys+MwMELFQVsHUM0tFSl/ibIZ9x/32QZL7zaD4ENBrn1C7XyEQORR3HSukV1NOGKsYo35ZXxmRqRZPGyGffbyiF69KqUEOJqM0pZNJFuE7PFFRyt5veEvQqPscyxZU+XxT2Zyuo3mv94kyAzENhu2hpn+ExLJvlF+v2ckKD5SIJACac8HOxmJW+Dtz4YZ9oF1x+rfH2CNEy/PUZIUgjCn2Eiq/fTBHs8B/5bYC0OUNvfMEMoE0sceekNnUVm6Bgcsy9DLI6ZbYtFYF6YT4YBw6PbJgJdnorzO63ZIeJDzGXhLwf4sm8kvPg6Q3vleimg2JbYFaXhJklObCPRw/Gx2GrgaT0KmrOHDluYQZFgFuShT+ZzzQHPsQO0PRG4wMUJtuwi320bRcA4VCmffeWezhMLh77xH8NWAGwTWgj3sID2P3KP2KJwEPkpBUwU6F0k5M7EEz0i5B9iOSAdEhUzJXolP9n3GlMw7hepONFmKK3DHJTsVfYBhQidHKDUM9gHerTfAxbNjtQrHIocQhx2FvBnAz1TVC0jv0e6FSMmeO0KQEOMveHOwOVHIv7GS/huaok6GPgNnUozd5hc="
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "Duplicati.Server.dll",
        "sha256": "2547A6F8A0C31719CC8D2202547FF00D446A2400F6BCA11F3A7DCBB071FBEB57",
        "sha1": "FD602EC1C5098A4A21B587A3029510DB40FD2FF7"
      },
      {
        "file_name": "Duplicati.Server.dll",
        "sha256": "B11ED82E95C15D709C08A31EFB38F2B4E92B98F99710FAB3DD7E3C4D99EAB6C2",
        "sha1": "40ABED77FDBF060BA7D77B22C7069B940C2FB9D1"
      },
      {
        "file_name": "Duplicati.Server.Implementation.dll",
        "sha256": "43988D047C1940A40453746B55F5A725F2243DA4BEFD1A4B45670B26DBB30EF0",
        "sha1": "5A1DC12993FB1D73A15D717B94544C89388D6282"
      },
      {
        "file_name": "Duplicati.Server.Serialization.dll",
        "sha256": "14781D33797B0802037AD4F2A73646082AF535B8473E322CCC96F33E0CC5ECBA",
        "sha1": "244230F2649B1A73F352AAB242BE6F46C62AAE31"
      }
    ],
    "page": [
      {
        "file_name": "Duplicati.Server.dll",
        "sha256": "194BBDA8F9E081C1941910B4500BD0EC7DEBF08E7DE4F7BE12FCE228EEDC600D",
        "sha1": "A426713EE6CC6E24D2D8A17319590CD47FC4F7C6"
      },
      {
        "file_name": "Duplicati.Server.dll",
        "sha256": "17D244EE5C8D3D04ECF58E941D74867BFCFC2116F780B4CCAD9387744F36F586",
        "sha1": "D713473A24B07488CB120EDC6B3E3C88601BC09D"
      },
      {
        "file_name": "Duplicati.Server.Implementation.dll",
        "sha256": "97FFA4D85D49A7370496544CD6F840B8E112B2FD24BFF251BBDBF260E929C267",
        "sha1": "EC8AFF5C5DB11F27C803182D36C3D03ABE283779"
      },
      {
        "file_name": "Duplicati.Server.Serialization.dll",
        "sha256": "169368BB3D8E3DF1DCA70D0C00C5D3BC8C47B2AC201FE2B22D019929AA815EB7",
        "sha1": "2D52248DE6CEBA14E03EBE4E4604C537D798448D"
      }
    ]
  }
}