{
  "Name": "LogMeIn rescue",
  "Category": "RMM",
  "Description": "LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2026-06-16",
  "Details": {
    "Website": "https://www.logmein.com/products/rescue",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "support-logmeinrescue*.exe",
      "support-logmeinrescue.exe",
      "lmi_rescue.exe",
      "C:\\Users\\*\\AppData\\Local\\LogMeIn Rescue Applet\\LMIR*.tmp\\lmi_rescue.exe",
      "C:\\Users\\*\\AppData\\Local\\LogMeIn Rescue Applet\\LMIR*.tmp\\lmi_rescue_srv.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.logmeinrescue.com",
          "*.logmeinrescue.eu",
          "logmeinrescue.com",
          "rescue-list.*.logmein-gateway.com",
          "rescue-data-cetner.logmein-gateway.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/logmein_rescue_network_sigma.yml",
      "Description": "Detects potential network activity of LogMeIn rescue RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/logmein_rescue_processes_sigma.yml",
      "Description": "Detects potential processes activity of LogMeIn rescue RMM tool"
    }
  ],
  "References": [
    "https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [],
    "company_names": [],
    "signer_names": [
      "LogMeIn, Inc."
    ],
    "certificates": [
      {
        "signer_name": "LogMeIn, Inc.",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "67C14D5CC02D94BB4380C3473FC9100FA8567975638F84D82B58773A2AE74DEE",
        "tbs_sha1": ""
      },
      {
        "signer_name": "GoTo Technologies USA, LLC",
        "certificate_thumbprint": "33023C0243016946C78CCB9B15AC6C203882E5D9",
        "certificate_der_base64": "MIIH2TCCBcGgAwIBAgIQDq06P/pwwKIK4jaBiZNRUzANBgkqhkiG9w0BAQwFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI1MDgyMTAwMDAwMFoXDTI4MDgyMjIzNTk1OVowgeExEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc1OTg0MTEyMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEPMA0GA1UEBxMGQm9zdG9uMSMwIQYDVQQKExpHb1RvIFRlY2hub2xvZ2llcyBVU0EsIExMQzEjMCEGA1UEAxMaR29UbyBUZWNobm9sb2dpZXMgVVNBLCBMTEMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXBnwWFr1Haugt1kOHarj31h9QgazDGc0Ijs8ownMkZ9WxjYhDNd1AfzNc6Rv1IWM52EYnFZfsP24vfDSXsMWQVPqNSAeP6HcNF3zZ3vVVNpydrbX43l2ZqIs3WIw1Y9QFJxRiDgJaPHC8S3XmXvrEGIWMGEUidteAm5c7lAEkklohrxWWnvYZQ6Bk6TrVAqkDKzlXovqL39ERdX1b3vprbudHhZHQAyax5sYb24nlA4y9NpzYKAY7KivhhOQNDJ46TjMCsGfQuyo0Ni21+KjNvMcRcVOh3G/VSSEpg2AIUV6GWa3/XQXBuXyTPj2h5wf6x84d2wzV6XJ9GyxpD8eZLf/9QxMoqAxS0/tlOKpPgEVGh9BhlFyLVaX4AolLE48qhZSL6tIs74965yyrp0OzRierAh2VXoF79Cp5wKdu9id9ztlP72sY5Qf0EUSMFFEe5aS9RY0Fu2PxT5CR2ZdKtSBtYK1nwagYYPjmNW8bO5FC89JiZlcLDVeIyQeAPo3ZSuMhZCz0S12t2QpktFZvEJ1VIayQTC63N9S4VrQRnusnlxJLImrrfu0bI8F9fUoaUwJo14/2lwSczOdmfZxo3bKqQSkrMSBeNixUWeiyrPUczLe5DfgUdzmtJ4fJOTkEQEkNaQ9ed+u4ItEZACUX7ujgYZsJ8a8ClUmrx62yPQIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFLYSDl2IK7QIyBrxGqwuqqHXUmXDMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEMBQADggIBALVnUZsOeb8GoGLjBT3VRdyLnQEuKwn41b8I6fWfIF5jnYtOzW/dJqOuIXvs0LSQ8FHHpvWYUPqjL94pp+SHWCreuCZ6iLrt/tXCmWYUkhU4DY2m4ddNEAvuJaqzcwg8xjrzlHvpyKInfeB8jUujc8Rf/oWVLsgPaI/mp9wkSmVwytA9vnS8mi/BH14/wICihbwuNN9N+uHbeJowiw8NZGxteanaHgoLTZ76adJEOGoHkbtyXDZL7YII8d1HUvwMjB1h1ZxEtFtpYZesvRfSa99pt+jbyeYOXXTxYwyHGtDqTmX3RAKTETtPEsqlY/IZ+MPqLZs/YQORlVrUEC3VCWdUvQvCZpItxAX9Y98bBQzjCAUSqFP7RznSbvtwJwmQaXR1ul2sn22rV2HUpF+C4JuWd1Aq/aD+UQcZcqtiQVag+vBVmXYevdPRFr7v+TauGPIqdSH/igbj2vl/mAV6aG49VSYgz9GMNM33CoLSzydASa2ifgybt4tDsmlqjP2FE1JKVSXN6YxrhEOC0YOi7eugU1JSJrHubaUvRCiUBD5qfN8HOzR6CzOy82FEAurAG4EB56H7W+L1rQhqG5J8/gkPK50kZobrCS/cQ2iK3S7735myNL8zkXfjrwjFuFqpy69crtvDqmlYWsBxlkYdg8EKb/yTlCAicCQyCG5Y4YD3",
        "src_file_sha256": "093e4af5f61640e64799539e8f3418e0890a3fe0aa3e33613de3d62936ee2f20",
        "src_file_path": "downloaded_files/logmein_rescue/093e4af5f61640e64799539e8f3418e0890a3fe0aa3e33613de3d62936ee2f20",
        "src_file_company": "LogMeIn, Inc."
      },
      {
        "signer_name": "GoTo Technologies USA, LLC",
        "certificate_thumbprint": "ECC24BFE100B96AE619D81554ACFA0439146410E",
        "certificate_der_base64": "MIIG+TCCBOGgAwIBAgIQDAvTdPsd2g73FxYaZRkp0TANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDUxMDAwMDAwMFoXDTI3MDUxMTIzNTk1OVowgYAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMQ8wDQYDVQQHEwZCb3N0b24xIzAhBgNVBAoTGkdvVG8gVGVjaG5vbG9naWVzIFVTQSwgTExDMSMwIQYDVQQDExpHb1RvIFRlY2hub2xvZ2llcyBVU0EsIExMQzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKb08AUlm0DbHj08M8dHPLG13kYNWfQb+TLOWCid+il64NImFeEtLDy0mI9Sw1dw70LeXcixgBZxKRtED7HiOJ3tFYnKneOLnVNZIJYTxoODzYdLSo2A7Y/9Y+XLczSstbOI0u26sAz/xhzjfb5n1AdYJ71lZjU0h/ZY32ACdWYMdml0H4oCDFNuoalIs/C0RXS1pKAG49sLMuYyrMASAEwA/YzaDOqmD+gbuTVVMbXdpNBY9COIg/eJBezyOJ/N04p19NcUkR7EE1C7DLtjNdlxzOs9mHOKF/yVz9bQk6FTCFkBFPe8xZILH0Zn9pYoi0roJpLcX9l8+KEMbOrQJf126aAU6fIlG9e+SLAh2wyVNbVEDGs8dzRDRtkZ9sUWP3oWSQAZN+knsou6/JWmlMK4NjH+H+mtr5t0z/TFRq5Kv0Jb9Abd2TstbMdMM5hGOLcsg9wLqrRJGQxcvFB9mx6ygLdmA8v3REhsjWkmJdWmhQL4gT8GjXi1VfXECdiAxwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFFylwpIc1GCn+bkThzCDUCDm0KfTMD4GA1UdIAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQDBavqjVRxVXxHX2Yo5U/rySxEZa9NFk2O4C29xA53v37ZwwfSJTRu2LgLOofSp82d1BT8zOgbdEiIL9UrD47P+7I2PDPl6hVqED0BuAKV1nBReENZBH9bjoz0LWQ+Qrd5ykZL9PVmjC2H1HFGUDNbKZssFvSBu1pn63mxrnc0Q/o7ZXu1+5ockmTQPr4+1GZ+oAaA+GhnSR5Ggk79e/Uq23mvOHODH0AU7zZxo3JKxCBS/jaPhTFah2Z/59cTTXx58p1YfbAURWIQOZyWnSEFE9kZu6d8gd45DGHJkBxAYpDEkd6Y5IWyzXQpLxrRbxKMxYxoyz6hnI97TjyAgmGA/K8xwN2qLXOAEvizwWp36npVSAK7KZk6txkPrMbCQT5TYvaP/PvPwh0cjjAPn7i+iM1anoPZflg+EVArJyT09b2+jpF5hDQL9+nSbPWMIQbrixHpB9hjIMiyhdHtohfz5yeCa/ewDdYtxmvvkQN4CjN0quSWMiUm0e8Va9fnk1SC2tjEG9FO215vfrdluZPMAzclH3LHJ33AKqDoDwrFXs6fTePr8An9lbEP80uzgsHfmZo1H1aPn8ISEFgaq39++DKI8pkDcez9ZQijlrgNsSh4amEL2s3wx7/Btz7G00K5PEWRUYyCRClQLUXEmjxebRaEecH9o2kU7FEGTyga+Sg==",
        "src_file_sha256": "50efac7eb47a1ff1deb0b5e037251cbd800513a8e0306659ddd212b5a5a45c25",
        "src_file_path": "downloaded_files/logmein_rescue/50efac7eb47a1ff1deb0b5e037251cbd800513a8e0306659ddd212b5a5a45c25",
        "src_file_company": "LogMeIn, Inc."
      }
    ]
  }
}