{
  "Name": "rdpwrap",
  "Category": "RAT",
  "Description": "rdpwrap is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://github.com/stascorp/rdpwrap",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "RDPWInst.exe",
      "RDPCheck.exe",
      "RDPConf.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "user_managed"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/rdpwrap_network_sigma.yml",
      "Description": "Detects potential network activity of rdpwrap RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/rdpwrap_processes_sigma.yml",
      "Description": "Detects potential processes activity of rdpwrap RMM tool"
    }
  ],
  "References": [
    "https://github.com/stascorp/rdpwrap"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Wide Vision Trade GmbH",
        "certificate_thumbprint": "6F64E6DF839023E363EC7A375AC7F447AE9DF793",
        "certificate_der_base64": "MIIHOzCCBSOgAwIBAgIQetk47hnMmlWkHY8TAZxNcTANBgkqhkiG9w0BAQsFADBqMQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMTgwNgYDVQQDEy9DZXJ0dW0gRXh0ZW5kZWQgVmFsaWRhdGlvbiBDb2RlIFNpZ25pbmcgMjAyMSBDQTAeFw0yNDAyMjYwNjUxMDlaFw0yNzAyMjUwNjUxMDhaMIHFMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGCysGAQQBgjc8AgEDEwJDSDEXMBUGCysGAQQBgjc8AgECDAZTY2h3eXoxGDAWBgNVBAUTD0NIRS0xMDIuMjQ0LjMyOTELMAkGA1UEBhMCQ0gxDTALBgNVBAcMBEFydGgxHzAdBgNVBAoMFldpZGUgVmlzaW9uIFRyYWRlIEdtYkgxHzAdBgNVBAMMFldpZGUgVmlzaW9uIFRyYWRlIEdtYkgwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9TpkQrct3cgpeACdfd8V2mdyIX5Wess2BNk0DSnswD+l6UqFybbQ5cjPgJUrHtq2HJZwI4syc0zPexlvJSy/nfsa6MwEeaXf/MoBfS4+FbD6ny8AFGs2jDAghtAvXz6OhrBZa5nrW/wOYhRlgvhAcpn7KQaK3nahd4C/1Qyt4i+AjdvvzxWVEcrw81ZAOEKph4ztSy99UyW3s/croBGmFNwkFQtOydg7rb8JUvAKx2r1ycvLCIGhLN9H22Vi5s/iHUGN8u6RhJumZo5CaEIS+qeA+BRPVeaZuUvuk5fiZCKgi+7eed81RnmgIgxtrUQQ6KlSo6yCfcTVSp1ujOtHZdCZvIF3yZykYLgWZx7D+N1SY/M/wlRj56HytVLB700UAn87rkcWyItHLDNSXNf4JlKND6zb2RwKWlRxkRWUSx8/ddtahntdSOuTnOven9BG2Px6aFqBc/EhEEE+bo3ZgmBD2EpNLYIZSmfDuldeWVCDtqr6Jr9dMMMOPmXHnXsJmy0+8H5JrOwRkgmdiUuqbaGPX8SvswpekIZ9I1NdGceWuqTXfIvtnoqmmS4SrF5SCu4wqMLFyHU0K3Wy8ia3/lIsALP1iEe/r0cF1hdMyqnSIlH/0Tz7zLoK5qc73DsIU7rIIVknPwuvzRRbpPMz9xmg601/4ywlVygfLwTPCHQIDAQABo4IBfzCCAXswDAYDVR0TAQH/BAIwADBBBgNVHR8EOjA4MDagNKAyhjBodHRwOi8vY2V2Y3NjYTIwMjEuY3JsLmNlcnR1bS5wbC9jZXZjc2NhMjAyMS5jcmwwdwYIKwYBBQUHAQEEazBpMC4GCCsGAQUFBzABhiJodHRwOi8vY2V2Y3NjYTIwMjEub2NzcC1jZXJ0dW0uY29tMDcGCCsGAQUFBzAChitodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY2V2Y3NjYTIwMjEuY2VyMB8GA1UdIwQYMBaAFKxXyggW3D/FMRwKTdv78d6ZJy00MB0GA1UdDgQWBBT1fKnk0Q9HyDf81aQwtlhbZkELFjBKBgNVHSAEQzBBMAcGBWeBDAEDMDYGCyqEaAGG9ncCBQEHMCcwJQYIKwYBBQUHAgEWGWh0dHBzOi8vd3d3LmNlcnR1bS5wbC9DUFMwEwYDVR0lBAwwCgYIKwYBBQUHAwMwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4ICAQAEWtzuPjk4piAIpl13FCWh0dhNuJx+JjscrU/8UmUkk4j0vz2TfN8KIAPrZtiLJR7EfTtOd5QSDNgkHeaSGK/ny+qYWI59alKjV8FQRd3/h7unVCAtUyvL16D1buHKz7hejcYzQ/D07LZo09OOeubSglL/TRKjf7P3foAE+Ts58eNvEwKLW5UtvWklEIY22mtNefBIYDyb5ht3LiNK1E7I5r1D/VE9JLsF0211gSrPA0Xc8IzGOvgC/Gls92hyrQoGtlHtnJBZa3T3T/+JIsPNEa+6igkf6AgiRrSlRZfDQgD1CNEycD2hUV2x7HRwcE1F8E+fe+KFRXRvUg04iRZy5pbgrPsBIRg6vdyPC7E2j1zk9oeDxW41Q/hyXreKiOLBXX44ubzFrliCMFDyzlhBjGpofP8ExJsKGzPWX4Vm32VXBH5QPPaJoVUnUlS1YD/Y8Pba1DyPy+ao3qdtI7pmoFCvLI18S+KzRPBjF12pXKSkqI+d2qwEN6rfGBlUuxEiGhLE3Ig/ZcKrGljyLfvcJob+rpMoL4lmHREUD0OBpLXCzxncfHnW8/8+R33ev1ITSEo2FvEMEKmkLlQat3vt9EGojPDYZ4BEr3Du1txym9ifIDnMJrL3R7Dh0rLKGB6b/i9JmRP87z2rqIWeEy9AeqnUMBCBGdwDqG5Reok8cw==",
        "src_file_sha256": "756c2904db70b5312ee968ec3d8f1d8c1fe403faa9096b809c2900a7a31de8b8",
        "src_file_path": "downloaded_files/rdpwrap/756c2904db70b5312ee968ec3d8f1d8c1fe403faa9096b809c2900a7a31de8b8",
        "src_file_company": "Stas'M Corp."
      },
      {
        "signer_name": "中移动信息技术有限公司",
        "certificate_thumbprint": "6705D79EFC937ADD45912EA396E978376126ACBC",
        "certificate_der_base64": "MIIDnjCCAoagAwIBAgIEAS/qWzANBgkqhkiG9w0BAQsFADA7MQswCQYDVQQGEwJDTjEsMCoGA1UEAwwjQ01DQSBJbnRlcm5hbCAgQ29kZSBTaWduaW5nIENBXzIwNDgwHhcNMjExMDE1MDY0NDQwWhcNMzExMDE1MDY0NDQwWjB3MQswCQYDVQQGEwJDTjEaMBgGA1UEBRMRMjAyMTEwMTUxNDQyMDM2OTYxDzANBgNVBAgMBuW5v+S4nDEPMA0GA1UEBwwG5bm/5beeMSowKAYDVQQDDCHkuK3np7vliqjkv6Hmga/mioDmnK/mnInpmZDlhazlj7gwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHdY/xz+rP6omr90f231BkamOViUeUfK9FWKZa0O8HEInD6jgGZwPHg4rGCebrpMKx440J+gvXRgQ+d629cKsuwES1lbk966X7iAOfFNWJONbo9E48+LODMJR60f3ukhAX33spdzYu7LfVbITjNE31k0EGbLRSQ4brWVVMZUR1tyNOlEolTd1/jjlH15jwGJBL3q1DMclagl7KKWScli/qmaXGPARg6ifkNK09GU2Y0TfS5DTjM5FmkTu7nDzDfDNytPtQ/sL6Hvbmn8tgZDzFF5dj2YA4xS8sRDwMfbtxdztuhOi3YhiE9nmsJSskHSeCX1kzMVXWNi2PZS9DFa8vAgMBAAGjbjBsMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDAzAfBgNVHSMEGDAWgBTgSlqW50x+SVjtB0FRv8JjZ60KfzALBgNVHQ8EBAMCB4AwHQYDVR0OBBYEFBf+xQgJq17DHppeiiSihScSnrAnMA0GCSqGSIb3DQEBCwUAA4IBAQBi7l28R1mdWGs+fiLasT5t63vY4LnT8wElP75t8NXgUjqy4cMIfDWziImQk9PHj0LnyBPG6ngyULaR38srHVDuojWoSqndRM8X+QuUv+6K6h7Vtpfjl3Q7CaiRKvgIcJfO7OcRK9moyL30BIclFgzPT8eHcyhaE9vISrqHqf6Zy0i+zaGMkZxH9YMyqxXLl/3Su0eSh+s9IsVWp5B2qBXAsqju8BkOgn3oe4u50C8ZXChK/zW5MQtBxacrBbSJeqgZ6ozfnN34Ixqhh3YFD2XQCkNPOJ+bmEC2G6k0Wx8x3OfaujtPUnitXZEUDmWt6IQ9UsYe+Yh9suIfBnRrGr7d",
        "src_file_sha256": "c36e92e4551c6f1db9c8261b9463fa817e67aa16f2e0394eadc6c3dfd165c385",
        "src_file_path": "downloaded_files/rdpwrap/c36e92e4551c6f1db9c8261b9463fa817e67aa16f2e0394eadc6c3dfd165c385",
        "src_file_company": "Stas'M Corp."
      },
      {
        "signer_name": "Certification Authority",
        "certificate_thumbprint": "070FF09528D3EAFE04798403131D53D30E35C682",
        "certificate_der_base64": "MIIFljCCA4KgAwIBAgIQyzWnzN09F49M2DL+hjcNFzAJBgUrDgMCHQUAMEQxIDAeBgkqhkiG9w0BCQEWEWNlcnRtYWtlckBuZXQuY29tMSAwHgYDVQQDExdDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0yMjEyMzEyMzAwMDBaFw0zMjEyMzEyMzAwMDBaMEQxIDAeBgkqhkiG9w0BCQEWEWNlcnRtYWtlckBuZXQuY29tMSAwHgYDVQQDExdDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOVrMB4zzQZ2aaeLW7ht9Pkr6834LoEnfM+PttJqAJy1AuQ2Bb2mKmb3K/yOqHKkyJ+mBictDG2Kq+HFbrBSsVRdgRKPlnXEYmAiVpNqpn/sfmS/arUWh2vi+vw/RWHwmBjbmmVBNA3oiFyjHtzBVrO+hxOys7cQat8l9SE91QQ2QtUpMBUCUpOxsRA7vGnivADmnuJNg54gS+pEflcHkfm4QCglSVqC+mnm9Y/tfFR93rvrmB/B5buPb2p1wd8DKUqbdPYN0kYVBKOFo+DaGO9RcfbXmGTYnlvpAJ+ToIn3ny9P6l49rFP9pabykGyoFfwXplbP38yAX+wXZIFTqM/vQ9IcL7gvc97GPob9Ovg/TZWPfiNakfsmu9JHJXhQb38+rji5Gnu38gDglU8fwUSab0ZTkmoOzGaU9ClEwxJblWiFzhrTSNdp4Ft6ZlZUtG3Z/HjylGbkwAchd+uBZlWiC0w+7vMPxp1dltozhfKeH2gdnTfeaLutXkS1Bz0rDvJGDXuI8pomOU3O3T9jePHCCuQJ4Fk7fr7zaVKKL/K7qiuZ4m6qmLJ9pR4Nn9c9nN4/bs53KxjJmPawxxcO/1KQPtbPLan+jnkNZ1e0ymRBgBRZ+JWUf06XH2H8AINzL6qcofEeIMf0nqJyVK3UBh1kU7x8YaASYfh1TiHPsPn1AgMBAAGjgYswgYgwDwYDVR0TAQH/BAUwAwEB/zB1BgNVHQEEbjBsgBBerXmlhPrphbVhsgKieGJloUYwRDEgMB4GCSqGSIb3DQEJARYRY2VydG1ha2VyQG5ldC5jb20xIDAeBgNVBAMTF0NlcnRpZmljYXRpb24gQXV0aG9yaXR5ghDLNafM3T0Xj0zYMv6GNw0XMAkGBSsOAwIdBQADggIBANyDUR4jmaKreTZAw7NZT+y/DbFPF+2sXbHbtYFRq7uPZ55d/FaqBS7utaLQSO6TNKR3RR9MdhOBpyS//TDrfss6+9PYovX7YZLavY+ngzMpRQdmcAFgGjF7xVLZzF4WOCmQlyA+/V7iGage2pw3RZV6nVqrXhIyJZx0vtLca/2OhmmXkThNuAidXcHThz++9AzTd4BpRzhBK8s2aFsILpSK6Jqf4qJI/yl78CGfIGDz4u+Nu6ZrVar2TVqYwPrTEel6FMB39f5HjbkmerO39MTeO9qLvtxrBmX6u5rPB+OhdMSEGIdhVFcbR54IwrkAKPm73JJ/PG4FF0OWvPN5Mce/iBHeBPnL+NeoFBMklNOKZQLPhbtQkzVcHkkgA2kOvJlgMwBU6cuvaybvBMTbjGfQu44CjzHi3tPrqIpJQAN1Xe1hvbCPA1it4iqYi/wnwUFD1AjBGrcYsoxNW/hDpZJ/Lt8QqvjkPCBB11krrj7m1xZraiueTU2TLIP9+EgkKzr0yfhAFqkHITF/IgGf4jNFWRktdoGqaL3ia59r3A0Al8xb+v+1LbsMNYvyI6zhYH8djsOzi9PRsovqOEVVypVg3Wsz8sI7qyF/nlGtXFlyQc9w3GtduHXM7tlbLph7F8LnADFmac8xyg1acIwDf6Tck7ejqbcZEjLLdLoeLd15",
        "src_file_sha256": "30c22c221f033baf6c52f51f2412cd0aef335703762d5bf19c486e8ee7b8b72f",
        "src_file_path": "downloaded_files/rdpwrap/30c22c221f033baf6c52f51f2412cd0aef335703762d5bf19c486e8ee7b8b72f",
        "src_file_company": "Stas'M Corp."
      }
    ]
  }
}