{
  "Name": "Itarian",
  "Category": "RMM",
  "Description": "Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.itarian.com/rmm/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "ITSMAgent.exe",
      "RViewer.exe",
      "ItsmRsp.exe",
      "RAccess.exe",
      "RmmService.exe",
      "ITarianRemoteAccessSetup.exe",
      "RDesktop.exe",
      "ComodoRemoteControl.exe",
      "ITSMService.exe",
      "RHost.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "mdmsupport.comodo.com",
          "*.itsm-us1.comodo.com",
          "*.cmdm.comodo.com",
          "remoteaccess.itarian.com",
          "servicedesk.itarian.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/itarian_network_sigma.yml",
      "Description": "Detects potential network activity of Itarian RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/itarian_processes_sigma.yml",
      "Description": "Detects potential processes activity of Itarian RMM tool"
    }
  ],
  "References": [
    "https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "itsmagent.exe",
      "raccess.exe",
      "rhost.exe",
      "rmmservice.exe",
      "rviewer.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Comodo Security Solutions\\",
      "ITarian LLC"
    ],
    "certificates": [
      {
        "signer_name": "ITarian LLC",
        "certificate_thumbprint": "9D4297D5CEBB398B79354FA98031FB577884078F",
        "tbs_sha256": "2B3DE9FC259D3C485E40ED5B31E094B1EB24501EE25E9FCB9D02225E817F0DBE",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIG0DCCBTigAwIBAgIRAMWSTAJz/pDJEr/k9Q/xFIQwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDEuMCwGA1UEAxMlU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIEVWIFIzNjAeFw0yMjA0MjAwMDAwMDBaFw0yNTA0MTkyMzU5NTlaMIGvMRAwDgYDVQQFEwc2OTM2MTUyMRMwEQYLKwYBBAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCk5ldyBKZXJzZXkxFDASBgNVBAoMC0lUYXJpYW4gTExDMRQwEgYDVQQDDAtJVGFyaWFuIExMQzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMqkdCHE9pEcQN8VSu2EA7XjCCyOAWvW5uYCHsCyw+7tkxGovlZ1zFc6kT81DFir/k7KwFUPaCPxDuS8KizKIrhPehrU9FTVEctCXiU/iVy0PFPrY/EvDnMW3QLAdGPYhOXzll8dI+cQisPkFDJvW3UXBMgjH7XJris+kHPznEHk6IreES6YTETOH7yUA0eKo/bDWU8xlIMZ2n5GWRRnUNkP8tIXWaz3JM5wzZ4vED9bCti7zQaShOxE1zEMCWYC55Kl6i825Gv8UzX1wwYEHYnEPMHhyQA771fPF0MqR2JLEeRljwl8s/xuEjIJ9GfBqQpWjTpOf8d3tqhP+gwnpTRTkU7oaig5iavbKLiqusFP7bnM7BN0iiFLE+gzqycmS7iBgThf+/st94Z6Xua2OwUTxkP9UNfwcGsD89RxvB22ER3s424CcdHEnY96LoIzrb5jTx1+xXSUGEhUJj9cURLe3hJ82AakY3CEM0j7rBhIlCNlyrPQHZ9GriP8s/JFBenQrvOy3ef17AtUXgEGz+a2d1aMrxWqK0InDGxvASau+pSQbqKpLXM/mXl2RiNcS6BIyOqq8c3wSh63y6AG139SRhj4nbmlAoP5psXEej3QL65mFMWxIUN+vKG8CCLhYLT1iuzIQ/fgJnyxHhdyY8SmYvlSK8egdwzKj7xTK90VAgMBAAGjggG8MIIBuDAfBgNVHSMEGDAWgBSBMpJBKyjNRsjEosYqORLsSKk/FDAdBgNVHQ4EFgQUwt2vxygZgr/j4barvJ4m8hzCH4gwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwSQYDVR0gBEIwQDA1BgwrBgEEAbIxAQIBBgEwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwBwYFZ4EMAQMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQUVWUjM2LmNybDB7BggrBgEFBQcBAQRvMG0wRgYIKwYBBQUHMAKGOmh0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5nQ0FFVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMC4GA1UdEQQnMCWgIwYIKwYBBQUHCAOgFzAVDBNVUy1ERUxBV0FSRS02OTM2MTUyMA0GCSqGSIb3DQEBCwUAA4IBgQAD3NpOKQI2Z/MltY6V44Y/rLSxR7Q2x8pZXVCLnKoVnjgX7uPXd3Yi788clgj9WHYwevrGFtp9uh9bRjlhbEQ+1iWQl++sGL/zvdwIgVwKlZAtugspInQDLldf++qZrqd4urh3X98OB2H0HIbTQlSqvpBH2gkes7yvCPvYl2E15b9q4E/Y0jlFhWWZxmfaCyLw5VDaDyPa4yLaSgc64o+BoBoqk/+Z8Z5eK6myn1GISLGDsMP71shxMBq2QczKvEcDFDh9ksiU0n6XZ6viPXL4YgF8SpdIbyoCTuNO8Q4RINDbqxXRpA68ue8OmIjIzK2nmSd6dVrnGhdC8thgLbJlPMBUit5qGYoLS30ZMp6+xI9Ctb0loWQ0Db39DE+yYMSmACicbWt9ILPuGRe54UGy9nXleL0lN/RUo7Pep/LP9lE6mLwLeQ+5snCcd0HVOPuQpkJjsByPk3dNA39y/X6qduBG30QGhut+2/D7OS2lcXMbCIhyttMjB6O3FmjT1BY="
      },
      {
        "signer_name": "Comodo Security Solutions\\",
        "issuer": "CN=Sectigo Public Code Signing CA R36",
        "certificate_thumbprint": "6A2DD5420C34A602C048F8D79BE52690F101001B",
        "tbs_sha256": "2E4765F85AE2822A8FAC2C12D791CCC86F74D8478B50D57B17E34B244D02DCC2",
        "tbs_sha1": "A280740D90D992EBBF302AC397DC06ABBDFB348C",
        "valid_from": "2023-03-17T00:00:00+00:00",
        "valid_to": "2024-03-16T23:59:59+00:00",
        "certificate_der_base64": "MIIGYDCCBMigAwIBAgIRAMeNXxTVR5B38ajsQUGoITYwDQYJKoZIhvcNAQEMBQAwVDELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDErMCkGA1UEAxMiU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNjAeFw0yMzAzMTcwMDAwMDBaFw0yNDAzMTYyMzU5NTlaMHYxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApOZXcgSmVyc2V5MSgwJgYDVQQKDB9Db21vZG8gU2VjdXJpdHkgU29sdXRpb25zLCBJbmMuMSgwJgYDVQQDDB9Db21vZG8gU2VjdXJpdHkgU29sdXRpb25zLCBJbmMuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAiWzDgKHw6jNNRHOhZyEpTDCy57Skd/8HTVMVpeCvynjy5EgDumJqDjF60tolqd751pmq4jwKQVbEusgexWaO36hSA0U0195jPaT1oW0TVGoCBYBv1+KzhyVJ5h7Fl0s8JbhTVYt5kHfliX74SZt40/xJgQ802vYPvVmtnIWCcpprLtq6L2TUagkU2AOEYsfPCh1oFtVQ0apMnZSLzW7F1lWcz/kC6NrSW02vIjG1RaXJh6PzL5VRdn7sR79/Q0ZeX7pLYJ3ji03jf6unckS5Sg+36qRWwNpwB4KhWOoRR2V62arp2NWMS9TYNOi6rdMFRnKXYWNQPrMzES77XNU+TiAHc6YzVvdrS8CsG1XRQb07mNZpQbvf1M3IBN0KMTnUINWQViukB7QMJRkOIJtHUBTSXlgptloclYnLjlAjc9QOVOIoNv/Zpq0AAiNsOfCm1biMGui1dk1BDPTUMHQtXhM97zXfmuoL8zcBs6M0Ayp14xsnV/lzBxfDtZRyw+SZ0U3PximvPlN8RLa/9JXcWzegZaAq452IMyHj2qusz7LebgaS7P6xOQcM1sr+YQpvYWrnXNA2IqTd7rTrAZfOcOCp7FZ4+ETICeqqipsz1GKR9HoG+WRhinKWX8NGXomUYfaA552nadzgauMVZ7kHVaVPslvsfLGCloGHr9YbCqkCAwEAAaOCAYkwggGFMB8GA1UdIwQYMBaAFA8qyyCHKLjsb0iuK1SmKaoXpM0MMB0GA1UdDgQWBBRPGeWUOE6BzJ9d2+z1cvGtXkX10zAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAzBKBgNVHSAEQzBBMDUGDCsGAQQBsjEBAgEDAjAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAIBgZngQwBBAEwSQYDVR0fBEIwQDA+oDygOoY4aHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQVIzNi5jcmwweQYIKwYBBQUHAQEEbTBrMEQGCCsGAQUFBzAChjhodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNDb2RlU2lnbmluZ0NBUjM2LmNydDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wDQYJKoZIhvcNAQEMBQADggGBAAsuL90Z8oLAiu4OZ/8e0YbnOfYmUCfhmc0JuqYt2XXiFGeDb25PEhu9dZETlmRBy3C9RW/xtf9E5N0XQ6PD9FN7z/f25JNea9IltFzq39wK96u7WNmJE8M2m9hT7oXunrQMO/t9cIgEXmcl//nGJ8uuj/8wNMiopXV6LsmyfjJ/p/XV6oXgIS3lRQy4jer3Fovyq8LI5XUPsirPmOxaUXDpe/g+EoWztosB2+EYtJ+u+1AvAvlRy7pfCVSMG9lauNOtgu6sf4V4SnPHFC9Yoz4aKPrI/kNn/1GZbDuesdUbr7iRcqPxKjgk+kqdAugcCffnjhm2VNiuK7sCuxPIX/O3f+1YwwvyMME67QyvAdbbRYFhHUhnNaQAZ/DSaqPiIMTM7lI26VXYXvO+StKNW7wQsEPFiXG21Y0PHj+Hlt2wGOUa2L/Box2/3y+gnhVWb2wS7tQ3wvVwe0UN8glW/9SkDwldUygLk7NdWpgk/m2WbnM5Vxwu6gATtw0D80EENg=="
      },
      {
        "signer_name": "ITarian LLC",
        "certificate_thumbprint": "83684997F1ACE5AE105E670E8094EDB2AD0879FD",
        "certificate_der_base64": "MIIG0DCCBTigAwIBAgIRAJSlRogHl6mp7ZcLF+l7quUwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDEuMCwGA1UEAxMlU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIEVWIFIzNjAeFw0yNTA3MjQwMDAwMDBaFw0yNjA3MjQyMzU5NTlaMIGvMRAwDgYDVQQFEwc2OTM2MTUyMRMwEQYLKwYBBAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCk5ldyBKZXJzZXkxFDASBgNVBAoMC0lUYXJpYW4gTExDMRQwEgYDVQQDDAtJVGFyaWFuIExMQzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALfKqLU/Zz/Neja5r4Ww4gRnyu4dgJz9qCfo17DeoSd48EBYQTHiG0Sz0zdmZM/cMXX/2F/d8qC0xCOnZFOgeuPoRfG6ytP/ibraz5ocJOxK2SNc299l57grlqjjynC6u+SP9BH1cqQow0prYXutmuXkaBpfSnMGH5IOw6tJTAbGq8A74qkrRFcofiAAYdeA/D1D5Y4umJgeFHywZp65SFVZEo0/RsTh0PI8PFekMCBdobBAmVl6beOLfeT+/HEcCD+LfOpbhXi3PINYAV137OOuYSoCQ7/UK6c1imeb5nYjflHoHJM1oMHtCkeU87vnFhb6gKRcLir2hQCpZrGey8nKQDdYaAHi8LX9l9cdc9JwRKOfw+IyaOwvfd/sPhu4QBwVwPruL0hwkjF5KrAd0bplbMEDBsv80VN6JmHXlV+YoGxZGx6FfRWnIRxCkfj3btjn2Gvl+U+MsPfv7mczf2CwTYfqMB64sUoAd5COaVh28sqT+LoB6L7UIBFf4GwrvptNXrByiFlu2zImyJvuc/uuylOE9bbP/qr8i9vOtUVdsDJNC6GqFXRlVKWANnDZ/kxjuIJWRys8MQziO5nIx4NoJOkzYYGiuVWPFUIoBS1RzVSPdtL4kDy5mpL4L0e51ibWE3cuO6FCL6EPxd/e9QaBBV0OuMWckEy8Qs15hRpHAgMBAAGjggG8MIIBuDAfBgNVHSMEGDAWgBSBMpJBKyjNRsjEosYqORLsSKk/FDAdBgNVHQ4EFgQUk42poCZ7TUZTTzcCyISUhEB9Gt0wDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwSQYDVR0gBEIwQDA1BgwrBgEEAbIxAQIBBgEwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwBwYFZ4EMAQMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQUVWUjM2LmNybDB7BggrBgEFBQcBAQRvMG0wRgYIKwYBBQUHMAKGOmh0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5nQ0FFVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMC4GA1UdEQQnMCWgIwYIKwYBBQUHCAOgFzAVDBNVUy1ERUxBV0FSRS02OTM2MTUyMA0GCSqGSIb3DQEBCwUAA4IBgQAeInqUdGSNfL3GvkmY/SlvVW0UgLX9EVb+QrSCu/tbcBoofkpyUJOCRR9ausO95yw7FbK/n8sGoEm+FA/3OfisMS3T8ga6/8Dz+DoTJI0TtXO5lFOsj5u1gdh4Ep3d/udrPkYgn1UpXLQQEiaQWmsijJ8icNx3u1sm8Mme99vhtrK+HrRcUTcYyNyir1hbJxXa+N94a+fpZl8w8+JJ2HuFdi/fEtngHk+3TvMOo92qvm5TMBOP7Tm10GeiM34l6eloBSqikqkSmFaqmlq+/DnZqOJxTqiy79msoyyluKAQSpwl1aIMHqi/pKj2KSbHxmRQfmFzRJwVUzMqWtOKCXNgQAG+izZ69hKotLPHwOOSLGrW/UgddYicxlsCBeHWx2uRJQu/vPA4JTCgdhSnpeDrubHq9qe7C6ioClq9hwp/zq8//iollwtqPNtrNtwTLYpxwtKhumFX1xBBiC9z3Qbo7urohZ6BG4fQNPM73CePByB76asPQBQjhTakQiYReFI=",
        "src_file_sha256": "aa7edf0e682942968173fd8904f01cae187262e6952c3c8e24dc1f8b4f2377ac",
        "src_file_path": "downloaded_files/itarian/aa7edf0e682942968173fd8904f01cae187262e6952c3c8e24dc1f8b4f2377ac",
        "src_file_company": "ITarian"
      }
    ]
  }
}