{
  "Name": "ImmyBot",
  "Category": "RMM",
  "Description": "ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints.",
  "Author": "Michael Haag",
  "Created": "2026-01-15",
  "LastModified": "2026-01-15",
  "Details": {
    "Website": "https://www.immy.bot/",
    "PEMetadata": [
      {
        "Filename": "ImmyAgent.exe",
        "OriginalFileName": "",
        "Description": "ImmyBot agent executable (verified via official documentation)"
      },
      {
        "Filename": "ImmyUpdater.exe",
        "OriginalFileName": "",
        "Description": "ImmyBot updater executable (verified via official documentation)"
      },
      {
        "Filename": "ImmyBot.Agent.Ephemeral.exe",
        "OriginalFileName": "",
        "Description": "ImmyBot ephemeral agent for script execution (verified via official documentation)"
      },
      {
        "Filename": "ImmyBot.msi",
        "OriginalFileName": "",
        "Description": "ImmyBot installer MSI (verified via VirusTotal)"
      }
    ],
    "Privileges": "SYSTEM",
    "Free": "Trial Available",
    "Verification": "Code-signed with EV certificate",
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [
      "Remote Control",
      "Remote Access",
      "File Transfer",
      "Command Line Support",
      "Software Deployment",
      "Patch Management",
      "Script Execution",
      "Automated Configuration"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Program Files\\ImmyBot\\ImmyAgent.exe",
      "C:\\Program Files\\ImmyBot\\ImmyUpdater.exe",
      "C:\\Program Files (x86)\\ImmyBot\\ImmyAgent.exe",
      "C:\\Program Files (x86)\\ImmyBot\\ImmyUpdater.exe",
      "*\\ImmyBot\\*",
      "C:\\Windows\\Temp\\ImmyBot\\*",
      "ImmyAgent.exe",
      "ImmyUpdater.exe",
      "ImmyBot.Agent.Ephemeral.exe",
      "ImmyBot.msi"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "File": "C:\\Program Files\\ImmyBot\\*",
        "Description": "ImmyBot installation directory (verified via official documentation)",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\ImmyBot\\*",
        "Description": "ImmyBot installation directory for 32-bit (verified via official documentation)",
        "OS": "Windows"
      },
      {
        "File": "C:\\ProgramData\\ImmyBot\\Logs\\*",
        "Description": "ImmyBot agent logs (verified via official documentation)",
        "OS": "Windows"
      },
      {
        "File": "C:\\ProgramData\\ImmyBot\\Scripts\\*",
        "Description": "ImmyBot script execution directory (verified via official documentation)",
        "OS": "Windows"
      },
      {
        "File": "C:\\ProgramData\\ImmyBotAgentService\\config.json",
        "Description": "ImmyBot agent configuration file (verified via official documentation)",
        "OS": "Windows"
      },
      {
        "File": "C:\\Windows\\Temp\\ImmyBot\\*",
        "Description": "ImmyBot temporary files directory",
        "OS": "Windows"
      }
    ],
    "EventLog": [
      {
        "EventID": 7045,
        "Description": "Service installation event for ImmyBot Agent",
        "OS": "Windows"
      }
    ],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.immy.bot",
          "immy.bot"
        ],
        "Ports": [
          443
        ]
      }
    ]
  },
  "Detections": [],
  "References": [
    "https://github.com/magicsword-io/LOLRMM/issues/135",
    "https://www.immy.bot/",
    "https://docs.immy.bot/Documentation/HowToGuides/agent-installation",
    "https://docs.immy.bot/Documentation/Troubleshooting/security-software.html",
    "https://docs.immy.bot/troubleshooting"
  ],
  "Acknowledgement": [
    {
      "Person": "boredchilada",
      "Handle": "@boredchilada"
    }
  ]
}