{
  "Name": "QQ IM-remote assistance",
  "Category": "RMM",
  "Description": "QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "qq.exe",
      "QQProtect.exe",
      "qqpcmgr.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.mdt.qq.com",
          "*.desktop.qq.com",
          "upload_data.qq.com",
          "qq-messenger.en.softonic.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/qq_im-remote_assistance_network_sigma.yml",
      "Description": "Detects potential network activity of QQ IM-remote assistance RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/qq_im-remote_assistance_processes_sigma.yml",
      "Description": "Detects potential processes activity of QQ IM-remote assistance RMM tool"
    }
  ],
  "References": [
    "https://en.wikipedia.org/wiki/Tencent_QQ"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Tencent Technology (Shenzhen) Company Limited",
        "certificate_thumbprint": "0F55B47074C6B8D76B79ECF07EA9FC92BDA8B87D",
        "certificate_der_base64": "MIIINzCCBh+gAwIBAgIQA/z0Ea1W8atH6MJQLOioMjANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MTEyODAwMDAwMFoXDTI2MDYwNTIzNTk1OVowggE+MRMwEQYLKwYBBAGCNzwCAQMTAkNOMSMwIQYLKwYBBAGCNzwCAQITEkd1YW5nZG9uZyBQcm92aW5jZTEZMBcGCysGAQQBgjc8AgEBEwhTaGVuemhlbjEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xGzAZBgNVBAUTEjkxNDQwMzAwNzE1MjY3MjZYRzELMAkGA1UEBhMCQ04xGzAZBgNVBAgTEkd1YW5nZG9uZyBQcm92aW5jZTERMA8GA1UEBxMIU2hlbnpoZW4xNjA0BgNVBAoTLVRlbmNlbnQgVGVjaG5vbG9neSAoU2hlbnpoZW4pIENvbXBhbnkgTGltaXRlZDE2MDQGA1UEAxMtVGVuY2VudCBUZWNobm9sb2d5IChTaGVuemhlbikgQ29tcGFueSBMaW1pdGVkMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxKLg8gXKpdmWtQ43edjDpTzSxe9Vl/8g9wkOO7nKxtd6fsE4IJHY3RN4yC/ZBds7Db5hOP8sPBDcZM5lOQKW8/OHL9EmRRHYKpPxMdcPVscoUX/eBp0bG60nX9uDAlJu9p5P757W7EA3vxwP/RJ7ksJ1CHAgz1jDRZPcElMwLotiu1aE49+N4ZX9HktN4ZXyc86D+/pzsLKMMXN/emEZTJZe2k1Y9nicMfhCz0ipI8HFRJqKMdhQzxfYcH6n6kvDB52+hqFtnVlqSLJ4hztUz8W4ickndPrBQ6rxKWm5PVG6WDTlcBe2HO8wijMC9qJ86itSXGwXmbBv6ViH593dR0SKKBfj46Ioe9W7H+ahtQqO+JXnOiV6gYJ7EAy+pg0kKR66uAONmJK+Ob3vIyeInylnD0cruNyYQTv4VYGMyFHVsdkt+7JhaEtB7bnQ/4wf9SBan0TemY4vurJFdoaC0OMrqDn68H5mHS9NsjLERON50PzmkMQHjxQCLozcbE3m6zAvKA9RgmozivabiXXi8FYZXOt2q8K1YzXFmVlT1qrwpn3h8REtdrEFlWdzihKDILAqzGYJjViAkxca7D2P8AtQZb3KxQiUMSrE2LJw+NPeHwZPjVeIL+8PHsv4vjykSsLRSuZhqNkFraTXjMaDRiITwIb9lyFuTmNiJNJESPsCAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBQdqi6z/TwjK2wA33wLN8aK+hi+UjA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBxkf40BcGMLe5sycFB/ihF5pbTaCCxCH+lJWmB2rpLiRydQgA+Owv8LxsmscTo3P8P0kgH3PI9SSOM/CEszlzdRCi2gc+GZnYpBLQBJxBaloBKU9RXfAIvvFletIbmNO0mj0Q6RYVeiNb4tSQKxVpQCm4CJdOtDaomTlpwlaDx5bOSAzsoBjW9OF4xOToxUQsfW7IN6wXfxvgGlaR67gkOva5CWmco5wUIeqCM156fpXkTV422NtjBhQbthZd33Up0S6xypUxx23vMMHiuYii8rz7II8QSEfaiCv76mrJrWpikZZE8YLqbvjjsXKF8F2rhmTjhERdx+C9iLIpZNjq7nx9TqFb23dEIk8vQQBI+8uTbafpkQlAa8NcWIwab89KQLkRmov/aqSOYsqQBYkmOny7X0jIiu/eT57tCufQ/L3arxkALoEV9b9+YUt3ZwGcii32JTCjzz4K3G/JxBz1LJDD6JoP3eAGcw/Au2n0nUEQHZbXiJiwxRrO1oQD2y9aCkSVQoYVYvW2GXE0MU2s5h2IMJlrWdjw4Kw4C41j6o6FMb7WmL41UjPH6SjkjuelpJbtuAkAciaqNkIJrIusXn1ws/P7acECfyMdJK5/z0W5CjNdeVw3/8oHOSdXtcUQ9t7BGdX2YO8FcOTXS5BetiIgn3WfX9SlQ03fs8D4QTw==",
        "src_file_sha256": "ade688d199df2896a0fb1c1242cc3cbca8c779c9e6a99f067a0e3ca07de136d0",
        "src_file_path": "downloaded_files/qq_im-remote_assistance/ade688d199df2896a0fb1c1242cc3cbca8c779c9e6a99f067a0e3ca07de136d0",
        "src_file_company": "Tencent"
      },
      {
        "signer_name": "Tencent Technology (Shenzhen) Company Limited",
        "certificate_thumbprint": "902745066D65FB8841D5EAD85DB9CA125C21CF42",
        "certificate_der_base64": "MIIINzCCBh+gAwIBAgIQBjTiPX9yvrkTyispwpdw5jANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI1MTAxNDAwMDAwMFoXDTI4MTAxMjIzNTk1OVowggE+MRMwEQYLKwYBBAGCNzwCAQMTAkNOMSMwIQYLKwYBBAGCNzwCAQITEkd1YW5nZG9uZyBQcm92aW5jZTEZMBcGCysGAQQBgjc8AgEBEwhTaGVuemhlbjEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xGzAZBgNVBAUTEjkxNDQwMzAwNzE1MjY3MjZYRzELMAkGA1UEBhMCQ04xGzAZBgNVBAgTEkd1YW5nZG9uZyBQcm92aW5jZTERMA8GA1UEBxMIU2hlbnpoZW4xNjA0BgNVBAoTLVRlbmNlbnQgVGVjaG5vbG9neSAoU2hlbnpoZW4pIENvbXBhbnkgTGltaXRlZDE2MDQGA1UEAxMtVGVuY2VudCBUZWNobm9sb2d5IChTaGVuemhlbikgQ29tcGFueSBMaW1pdGVkMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAk4nHyT+Ue697vL1Vyj6Ave/JN0ikKPYyg58cSUDJI5Ems/hW/fIyV0n1ZP6Y2flVb6Pnl1rLqcGt5KrGG+PzUnb3qot0k5PfolBCqjVUhcFHCHAmivuOQe/pAu3SztZ4/Z3mvQQPG+bOrFpb/PSDY+iHSiIMhvlEIk4heLNqDVxbm1Az9KTPzzqChXbwp+3ssi+iueT8mcvuamOKQsA/IbnpD9RetSBUpQSiU7Hacns0W1KJFAfhMAT2mcB6cEmQPPwOcxQwZpYYY5+QSKo6O+eq93zgDzdQpGsUp6tGVO+tRWU/2yv99NbPaxAXOEsKooyV4CF13pQ7zz9IbX+ONdcuDYhDvEtJCY1qaLoR19k2MCtOeybbOGHdxTyxtrgaDxZbYVByORZ8LwqLdY2mLZduy1dXYIPk4VnMwvae8bYaY62TPoUQe6HblIIHhzi1DUuSu5sHOb2269xgrOxVe1AWyX8kU1QPhXZ8Q3NtMleaBovBEFp+2yuvtGr5hrOdAw0oyAlKW21fDn3I3O+2H5ycmwbAJSu1NUhvjLxpzKK+CFucU8L23ltp+0FEUDxf6jTzL12vvbynlnMOMvjL1SvQd8kQYOPgYpDbG/UV09Yz4jrUP2Cpg1hzzsjD/NIDFWX3hbYSdE2MRNvlww6yfKE0hjIU6rLSPzMEduH6LrMCAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBSHeGLds3z7dBUCpGS9olsGv/agJDA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBWlbV5ZGLHzUteFEd5CaiFfp7QQkRwr2FhnnQBBkfHYdqomxMvBnYzn6c5LAvsxsLSdaZBvogb07y1QAVtqBRRe3cykBiRCQCfix0ikN3N4QowTcIuQc/p/wgkCN1anjPH+M5FycEQTi544aLw2BnbJNqLOMhDXMt4et2q81dJNmavPYM0uhx8uD77qyZAfgvcHWdXVG8hWIBLOaiLvMzo75m+wZDqkgBGp9l1LygWJLMScK69ZBjKumCmeqahT7CQaX8IV4uXpv0yzoSnMNaDRAb421b4keqGHEjZYcfkn0drgMc+JvZ4IjCMxDZzu47lvuyxZclI/c7f74PRrMXR2/UoHJCaP95KY3MMS/tuFh9Niif6VVW0tKLyqIF3rJu9p2tZ/R37S+PqLnh6ddQUqWGJWq1x0TF15dckgxyPqBFOYpwjS3GswWgZfkEo1UmmWT7oOLeENmZr392fm4SDj/id/SUOXvDHKsqWJzOt/xl1nnWD0Q9zpiDtcsM8ROh3zXQl+eLHkjYuvqemyEVdflSgi0Bul4j0f4U3hRcum2w56vtMMrVH1Y2oAMtd7JeGw6OCVrJbxsCIFDyuUL5Gx4S4lH+2xEDeB0MXuV40WuXEoqrdMlaj2khEgqKw9FAQt2p6YWItnX1nKNZZRWHrjPP4MuvbMiWXm9ih7fbeBw==",
        "src_file_sha256": "efb865721cf7fe1483a9a6d1f54b65a83a85a064fa488d24b3c6a681e1ffbc15",
        "src_file_path": "downloaded_files/qq_im-remote_assistance/efb865721cf7fe1483a9a6d1f54b65a83a85a064fa488d24b3c6a681e1ffbc15",
        "src_file_company": "Tencent"
      },
      {
        "signer_name": "Tencent Technology (Shenzhen) Company Limited",
        "certificate_thumbprint": "4B32EB2444E6BB9144A088E59606BCF02B8F2613",
        "certificate_der_base64": "MIIINzCCBh+gAwIBAgIQC/BFcs3Yn27QCqvKBy+3nzANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MTEwMTAwMDAwMFoXDTI2MDYwNTIzNTk1OVowggE+MRMwEQYLKwYBBAGCNzwCAQMTAkNOMSMwIQYLKwYBBAGCNzwCAQITEkd1YW5nZG9uZyBQcm92aW5jZTEZMBcGCysGAQQBgjc8AgEBEwhTaGVuemhlbjEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xGzAZBgNVBAUTEjkxNDQwMzAwNzE1MjY3MjZYRzELMAkGA1UEBhMCQ04xGzAZBgNVBAgTEkd1YW5nZG9uZyBQcm92aW5jZTERMA8GA1UEBxMIU2hlbnpoZW4xNjA0BgNVBAoTLVRlbmNlbnQgVGVjaG5vbG9neSAoU2hlbnpoZW4pIENvbXBhbnkgTGltaXRlZDE2MDQGA1UEAxMtVGVuY2VudCBUZWNobm9sb2d5IChTaGVuemhlbikgQ29tcGFueSBMaW1pdGVkMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAswOOZ/ztWFMnbRncld/farW0FMczr8EWvSfC2przw6bLHaB7Qifm+DiUlP64IHlUoMp7yKVyeJm3myGwfFxskUr9yXAjMIeqloTdijGYf27gPERBZMy+e4GI1Pbksvo6zvz5JsvY8Qu55uVBFp3zlmV5/HuoH9IF3TZPAX5yi8GGCkM4oBcPVFtBiXfDG5qEc2kzQwyGIDIASVTxX9cuhT6dLy8m57Yb/TtT/+tDQ7nI1ivVSVddzmAq92Op+Hw0pujZcSpmmtE7H9CdNsqtyfxL6l/AkvsI+guNV2DeSZcpgMcE98LsFTGSrNRHcVgxG3wE/KsnpowuiobQTv8/pNB/KzPG4S9Gg75qO6NeNAFIdt0oStyyI6DiG5Z/ehvmf5JDzNecRgwOjO9pcCBzfe/bw8ZdgmGGm/uu3YsnO0WQaRQUJR8p4YHEY9hXqNzriuNirDxLbg+xKfk00+8ZjgXp/eeTy6GM2qh2aEC2iqAraH4Tm3Ms6gwAZ0AEdAHpdej6D0hvWKumpJ1inmM6bqeVttZUYDhAVulbQvNBwSLSRV0DhLYyYqxnXnRbfpMrD8FnaTt5EFkMeJ41MPt4iDuZe9b4+2mf8cVqnOm5aM8bAOujAqr3MID6ir0fnrGap7OvbtfOH1Z3Xd0eaH3NPZt8pMh0aP2NLFZ96Hby6jkCAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBT3WS2bRlyx66dKm9xr5mE7pFnonjA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBQcUsARnz3BtCHfsRea80S44guHg0f42bDKiYUTLqCIONP0mAJyxnOxddIlE6ejifVUxpT0vhwRSc8YPSFHXultLR8Nr5FMwgbXFQP+IjIpB/PDhzVVmzFBiYsB+f066zvrPQMk56BfTbbQC98VRrXOCZ4YqWB8zjRf+B1fLW5ESgNNppDl6kqguHXUXYJnbeS+QOCku3ExkUNdJ/wL+ZX6TRyllnsljOsSPHNZiDdAgtGT5+013SttuJtNwd6JneULWgutBEx+xLHmFSTXT5SWNK31oUYI3FxwWMJAi05b4V2WS4b3lFAT2sniCvQvCa2agG/whMBo1ApdiZrI7LS485xPzx5hTPIETth6gUmxb/SA4Vs+nKJSIm2dUpA+EQ93+A/91Bt7J7TzcwiHI27Oj71BhpMzJaCEGHiZML9WYl2PaHJEGQWkK29MBcXOzh1bDlCG3sSFMcxc7PIyvp1i4oUo9mwhZQXc2nyuu04bGV1WX+ODeB+9/fcnwPduvvXuXqbNHkN1Bp3p4NJbY781kOo4HwcGeQs7T7Vp0mlO/vHhVPO+oihk2yxVHMKoWLuCBB17iPeFSyYziMkewt2/L/OhiHl6tnPdq+tidOxesOSVtb1JmPhL3JEONciGHcwMi5F/QFx4SeDbqKbkf3n5nSUipcpMgQYOJFZnO/zww==",
        "src_file_sha256": "502e415e49b34695f487a733573019f07a090e885d01efeeb5b7dab229c03cfc",
        "src_file_path": "downloaded_files/qq_im-remote_assistance/502e415e49b34695f487a733573019f07a090e885d01efeeb5b7dab229c03cfc",
        "src_file_company": "Tencent"
      }
    ]
  }
}