{
  "Name": "Neturo",
  "Category": "RMM",
  "Description": "Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "neturo*.exe",
      "ntrntservice.exe",
      "neturo.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "neturo.uplus.co.kr"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/neturo_network_sigma.yml",
      "Description": "Detects potential network activity of Neturo RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/neturo_processes_sigma.yml",
      "Description": "Detects potential processes activity of Neturo RMM tool"
    }
  ],
  "References": [
    "http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "LG Uplus Corp.",
        "certificate_thumbprint": "A6AFB7E544982EE2CEE2348C20F90C403973868C",
        "certificate_der_base64": "MIIHXDCCBUSgAwIBAgIQAcRZ1Gd1s3mGlyhYFt7WSTANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDQyMjAwMDAwMFoXDTI2MDQyMjIzNTk1OVowZDELMAkGA1UEBhMCS1IxDjAMBgNVBAgTBVNlb3VsMRMwEQYDVQQHEwpZb25nc2FuLWd1MRcwFQYDVQQKEw5MRyBVcGx1cyBDb3JwLjEXMBUGA1UEAxMOTEcgVXBsdXMgQ29ycC4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDI+1JOnDsX1yYvOOaQueaPV5QtllDyTTzf0/JaGZZs/7h+jbuhaXLI52BlS2fXm3hfnWE8qjPS5bX7XA8ofsDv9JxHAt5eI9OsoOq66pig01G1EcPmAwhQUKvxZeuE/JfPubqHI6h2P6OAxcmmBBRLjGEPYzRVLsgvmvc50Svhac+LDY1xmCGv6FLWpCuUaQGZv/CjR2TIkV0fRMycbI8OXPIdG185Li0/odKs4aGKHV207iJ1HRgwJzXtjp0nvYxBVyWC+yUoirAoa8HvU/ujY0dmSJuigTn2GGEzhiN+HGIK6H2xI4zt291t9fXV1wHAXpk9SvKjAkBsf4crX4DeZ7x/4AlLMgz0bKEmdr6X+eDjABo5E22vFqjOIeH3twxshH9zk0DQWBSa3IqWTMyEwJVnFF92w08tLG9Ng3oMQ2xpUzpKTal2NFGEivRUNUKiw+xLFjJurHD6ssnMDdfi3uzP93APuwOZgVNZGpu+oOo2GRWnV/uKLqmb8Zcloxuk1AhgJ2zzLb4Mn1IW0i+Df4J7BmwMgwpUE7Blh2B1+Tsfi6jI3be8Y3E1ZmHYeahECHwQ+UxHpxScllWrrJzp+9F5+nm111aTd419bqplk9XSiz2g/166gVpcZqFVXovZauaFKGDnNsoai4LOWsjo/fwa8vG1+3LTacyeBLsH1wIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFBTd9ZPvs18XQm8bBMxG8iJhgCdmMD4GA1UdIAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCTtbG+nuWMh+EosGkvKaC88EPY2kooTcxMc2pF2tjpHyDVHM9Dl32xR38a33RTg3LtNpa04NNEp+gXBUceTAgMCqll4L2KdBaCu5rwvWK/QeEpFCm22qzgb8+oRRFnkzcDcg4L91a4WFYjC1Mcm3YPHopOCplgjO+pRIhYWEP+jzoQe5oMZUw1aR0WHMWAKrsHk8Tm890HFfwu69Tqze2x27CYkq/G3MRK63JkxnCBjtxfn2jBpkXom697RKI4XdxzuwFFUK83Vxr22OdaUjnb6nBw7+FFJabu/aBmtjpuT489jq1PW5iSglQdt488ARxy3nlAEdywx4B0ickeZ7Yh1McDpp7k6bhvo6prPWJRcnVql6gPYgaQlGizd7oNFBi42bTog3rH6kCrUWZ8RJ92m+w/hlfYmpVbrBJY2Z1iLlRy635jaqlPrLCiX6dzed/zaz2lYUPh1MXtt5l3MnWUqTT2oF8ZP0vhSqRNtk1SstiP46I6lZWGdybs/24+nPPDuH/WXMs8NoGDUSCVZVj4QR5vju7RdVQ+dKKY81KfnFGYXVY4jNs7raG8xhCukD6Z6Qzog+fI6KFBaJ93e2I48eQifd4SZt1gfE5EGGXtX+LMphd0XMpe2xDsPcvxEopyn1xDr4X6CJwCKjyxl59zw6N9ZMt96wVQElbe329LTw==",
        "src_file_sha256": "8f58e4840aba88c7bbf69f86139498f6a6ab92d317491f729a79c5ed12c1d046",
        "src_file_path": "downloaded_files/neturo/8f58e4840aba88c7bbf69f86139498f6a6ab92d317491f729a79c5ed12c1d046",
        "src_file_company": "LG Uplus Corp."
      }
    ]
  }
}