{
  "Name": "Netop Remote Control (Impero Connect)",
  "Category": "RMM",
  "Description": "Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://netop.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "nhostsvc.exe",
      "nhstw32.exe",
      "ngstw32.exe",
      "Netop Ondemand.exe",
      "nldrw32.exe",
      "rmserverconsolemediator.exe",
      "ImperoInit.exe",
      "Connect.Backdrop.cloud*.exe",
      "ImperoClientSVC.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.connect.backdrop.cloud",
          "*.netop.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netop_remote_control__impero_connect__network_sigma.yml",
      "Description": "Detects potential network activity of Netop Remote Control (Impero Connect) RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netop_remote_control__impero_connect__processes_sigma.yml",
      "Description": "Detects potential processes activity of Netop Remote Control (Impero Connect) RMM tool"
    }
  ],
  "References": [
    "https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Impero Solutions Limited",
        "certificate_thumbprint": "E1A00BFD8338A6C9EADC315BF89568DB43DD2220",
        "certificate_der_base64": "MIIIITCCBgmgAwIBAgIMEbPwXTIyCNIdALudMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDEylHbG9iYWxTaWduIEdDQyBSNDUgRVYgQ29kZVNpZ25pbmcgQ0EgMjAyMDAeFw0yNDA2MjUxMzQ1NTdaFw0yNzA2MjYxMzQ1NTdaMIIBUjEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xETAPBgNVBAUTCDA2MTA2MDEzMRMwEQYLKwYBBAGCNzwCAQMTAkdCMQswCQYDVQQGEwJHQjEYMBYGA1UECBMPTm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHEwpOb3R0aW5naGFtMTEwLwYDVQQJEyhTZXZlbnRoIEZsb29yLCBFYXN0IFdlc3QsIFRvbGxob3VzZSBIaWxsMSEwHwYDVQQKExhJbXBlcm8gU29sdXRpb25zIExpbWl0ZWQxHTAbBgNVBAsTFENsb3VkIEluZnJhc3RydWN0dXJlMSEwHwYDVQQDExhJbXBlcm8gU29sdXRpb25zIExpbWl0ZWQxNTAzBgkqhkiG9w0BCQEWJmVuZ2luZWVyaW5nYWNjb3VudHNAaW1wZXJvc29mdHdhcmUuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArcsppnFqy566RK8J9IsIAtiqpp1QgZ5G+qJqsMMcwNR0HhckGUVc04RPIWiPF5t6TOr2hGJtdyRUTTRSAeR4/nqMpqZSYCPBmT7tPGOIvXoNfxGkOFXDPl/4/QiRPzfA7hQY3xQ6IasmM2PD6RrveGuBsMPCylivU0hooLbFEHK4NGFsHihT1bl7+AhpJGLbNUAblUAGimm0FR9MVC/8mlUVsQGJsOgRsBDWrSGTCghZJ0o4mc3rd+aE5qhHcOEMPWR/YfOQ5MfpMX4+XBJPuFvaMwJcozD/Kdqbay4yIH++H3tX0SvN9L2X9uaORPpcivBEJaoMlb5zV2SLLWVUIi5pEy3wNPTTlZaTv1IfcShoSNyGKq6AM42T++dZqXuE8UaolUKQEItuopnnuiYtjpLz9QzUWaOk+q65NDLe7232igOo9cBvWTqgIP1K5E91ODok4V0xDNBKSpfu5/eZHHPBNYG1VFkcjWh/hoZMh1iHGk532in50ORtOax/yuoJLDtKjGTSxsbDtRj3vE9Ye4c15Dj9rplUnhO/G91aSnIa06obkt9OcoZrRr5oEPKrlA+0Gx2b1nduEVpcc2xSPDuysljvjsvWpPh9LkYnCaui1NUWnnp2X7D50xEWNBpTBqC3B1zgeslK7DO8yVrUHBtT2zcSlXvuRN03yAn/rU8CAwEAAaOCAekwggHlMA4GA1UdDwEB/wQEAwIHgDCBnwYIKwYBBQUHAQEEgZIwgY8wTAYIKwYBBQUHMAKGQGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMC5jcnQwPwYIKwYBBQUHMAGGM2h0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMDBVBgNVHSAETjBMMEEGCSsGAQQBoDIBAjA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAHBgVngQwBAzAJBgNVHRMEAjAAMEcGA1UdHwRAMD4wPKA6oDiGNmh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NnY2NyNDVldmNvZGVzaWduY2EyMDIwLmNybDAxBgNVHREEKjAogSZlbmdpbmVlcmluZ2FjY291bnRzQGltcGVyb3NvZnR3YXJlLmNvbTATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQlndD8WQmGY8Xs87ETO1ccA5I2ETAdBgNVHQ4EFgQUY3co26vXOCF+FgFCE4iz+lo06aowDQYJKoZIhvcNAQELBQADggIBAGtrXPyx052BGgyRf+9LMMojjpa6rtNqHRICDq6rDTvrj9RQtck4az2HuxwjIHTi7uhzqPcb2LMe21tinEQ807ATlL50u8LbDINT28Zkg9MT+iTL8aC1u23Ik4HQmvqVmctKusXJR0S5H2/ZBEDQqF9oRXGZ1jv3bJnwITa0Ki+NplK0mK0vXHYZiJbbMYXu4tUbva38ZwIMU9XabLlwJBqe2Ht+UtmRrWWcZ2z7F4leobQu2pCumluWOzVqsmcVG5kHtVOfu+1Ta/S9lhb4RFW8wyFJ/24WNNyLp94SsynbJpKriYM8h1sAPBYZHQRdzR6QeOvOcxsXeJmqbzLfg+xDsy2LvsZFV1S79YjBnKfipSBJTxa4BJL4jTA9Ovvrbgku/CRbuO4IVsdDVYXvW6mEzz49w8mv/W4dekDdsRkkRmTwQw5HBGYyo9op2+3aQ/4gDBrkzPyYJ/zM/S0RUMmVZXOjcmDNsDpZLlZapIhqLPJ8SwhyUvw42aM2JLhybGQR3n8uF1qvTAhn3ms2W6XCcreiKcFbeySmjfcS3s2TQvVomqDB8HQezu6nY3gtuYYcCMrdubJ+u/smwS9XOE3GYoSNQcBwtCl9+iNVYzt44W41Sx4O8wuYjiASsDTf7bNRID6ar3RIgAmKqZVBlf8AemIn9h4CKUpX9sUz1vp7",
        "src_file_sha256": "2ef170a512ba3763050cca4f64055f658ff1df5bdf45784dae8b51256bd3c07c",
        "src_file_path": "downloaded_files/netop_remote_control_(impero_connect)/2ef170a512ba3763050cca4f64055f658ff1df5bdf45784dae8b51256bd3c07c",
        "src_file_company": "Impero Solutions ltd"
      },
      {
        "signer_name": "NETOP TECH SRL",
        "certificate_thumbprint": "311FD401E4AA27E856311EAE5D80C31CDE46A67C",
        "certificate_der_base64": "MIIHyzCCBbOgAwIBAgIMDACKCO9kIrQ6l7swMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDEylHbG9iYWxTaWduIEdDQyBSNDUgRVYgQ29kZVNpZ25pbmcgQ0EgMjAyMDAeFw0yNTA2MjQxMTQ2MDVaFw0yNjA2MjUxMTQ2MDVaMIIBCTEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xFjAUBgNVBAUTDUo0MC82NzU4LzIwMDYxEzARBgsrBgEEAYI3PAIBAxMCUk8xCzAJBgNVBAYTAlJPMRIwEAYDVQQIEwlCdWNoYXJlc3QxEjAQBgNVBAcTCUJ1Y2hhcmVzdDEqMCgGA1UECRMhU3RyLiBQcmluY2lwYXRlbGUgVW5pdGUgbnIuIDQ2LTQ4MRcwFQYDVQQKEw5ORVRPUCBURUNIIFNSTDEXMBUGA1UEAxMOTkVUT1AgVEVDSCBTUkwxKDAmBgkqhkiG9w0BCQEWGXRlYW1fb3BlcmF0aW9uc0BuZXRvcC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC8VHVCcnFSviQkiQ1DDTz4A5Qw+c/hEcdeVePKLjM85ofv1LsqcSQB/RauAlBY2HsdPGxO13lYibsWQfq4a6NzGONkqFN4b4UR0ezGhQftDOQA+9VnTDBViOPElAsDvd4Jm09nE5uUEXUTmk5Lii2YyHOl3v+ATcRGndFQWsxs33bT3qZp1K8t1xOsfn+Eb7d8rwhdo6xBEYsAVz+n+HwK0LU1cVwl1wdtzWrHgTHHLwH6nweOnpsUvsK1KX6o8mV4xA2x93EbR03LohXzrvtkb4ynT/z6fTi+vxPWuKPVL/GKj0dRVpZVQfjCKOUCMk8gbzTjuYOrNExBmZvykmGFg8534OrnG1AnUNqXjXTdVt0U4HCSRAPhVSADCFNRFNIc3DQUl3v+dKdjS/yk7/bUXkHWCiTLr8q/eK+UQkhmSxGkNu9dx482zPdH+lZyQqeFjnY0dF47pEY1GQC6L6FK7/89OHmAGS/vW3CWeUxoG7t207W5LZlvueTEXjYsEfZXaCnAzUiiDJL6dvie5J2Wi/1PxKmuo4OqzheePIXRDr1163418A6BkkqswcOTmrwHUrk9WimJ7qd3vfEh4OCRmHzOiYPX5PboBagvU7iVsZKOjpapB/8czo0cGBL6LsDqSg/5TGOYvXWolL9+kHW+6lpGqVigoNTpDKD8emjx5QIDAQABo4IB3DCCAdgwDgYDVR0PAQH/BAQDAgeAMIGfBggrBgEFBQcBAQSBkjCBjzBMBggrBgEFBQcwAoZAaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3NnY2NyNDVldmNvZGVzaWduY2EyMDIwLmNydDA/BggrBgEFBQcwAYYzaHR0cDovL29jc3AuZ2xvYmFsc2lnbi5jb20vZ3NnY2NyNDVldmNvZGVzaWduY2EyMDIwMFUGA1UdIAROMEwwQQYJKwYBBAGgMgECMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMAcGBWeBDAEDMAkGA1UdEwQCMAAwRwYDVR0fBEAwPjA8oDqgOIY2aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9nc2djY3I0NWV2Y29kZXNpZ25jYTIwMjAuY3JsMCQGA1UdEQQdMBuBGXRlYW1fb3BlcmF0aW9uc0BuZXRvcC5jb20wEwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAUJZ3Q/FkJhmPF7POxEztXHAOSNhEwHQYDVR0OBBYEFODI7vdgpWZuRNV6CcVfOi8FwJQ4MA0GCSqGSIb3DQEBCwUAA4ICAQClnUdzXOjxR3/qvY+jo+aC2wjV3DnfNj1r2VcPr529NHXTDTOuKvQ0FU/SGq+BOF3l4rusQFkWFnNr9OSmmias7wOqmIWBbReQQ+SqygvSKGdcYmjUqgeiVVIzW8yS9CHa/dhorH+jdNUp3//nFHuuexIFooB4HmKV/tQo2J+v75seFcYCNIGCFxfWvcmSxr5fZLbCfeZ9DgbxL7gsvQJUJqGgBhkhDdQ1SoQW7qvfVJ4l2of6g/I29p3zoSXV+mU3f0mra3vzh9jZZjxghxWWtB5/dx2LCP1mzUcAGV5o+kRsHm09DHgs7/4Gg9dOE5aTysRtuYrgT7YkxPR01Rv/K5VxM2zh6WExuGpCYqKkWoVxKYIQqy0DVt9jQYag9fm/ROlnB/sKEyE39UG4gfeG7gImO78QUaagZKxKznXH/HL0h6h2L0jPOETuxnJEuZbBIJXxuuuBF235pi7nFFgSX43MK4UteIw3XBe8Tevz/UeFkrcR4aXObaGXZmtK3QwB2LvjQsZwcdsfADSwcZE3ETPrtL+BQXVSOxL/ZWh3AJuhqnf+2jxt+NE7EGX5gDUP9v5F0+4ik6sFApKEfWlKVq0kB6JW91tWHWvhvAYpGhq+6kC0LA5qyuuV85AmW1NoUHZu7dinoo0HVAQ5Y/aF8gFliUekAEL7wC18pkjWRQ==",
        "src_file_sha256": "bdb200d53531c7c66b74b36f622981de8eae40c7833cbea6190877eea10a8cb0",
        "src_file_path": "downloaded_files/netop_remote_control_(impero_connect)/bdb200d53531c7c66b74b36f622981de8eae40c7833cbea6190877eea10a8cb0",
        "src_file_company": "Netop Solutions Limited"
      }
    ]
  }
}