{
  "Name": "Remote Desktop Plus",
  "Category": "RAT",
  "Description": "Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://www.donkz.nl/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "rdp.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "donkz.nl"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/remote_desktop_plus_network_sigma.yml",
      "Description": "Detects potential network activity of Remote Desktop Plus RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/remote_desktop_plus_processes_sigma.yml",
      "Description": "Detects potential processes activity of Remote Desktop Plus RMM tool"
    }
  ],
  "References": [
    "https://www.donkz.nl/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Plooto Star Inc",
        "certificate_thumbprint": "2347883329B8455D0A0F0D207A3A2279B339DFE8",
        "certificate_der_base64": "MIIG7jCCBVagAwIBAgIRAPf0WVyfpIB6tB2s+IutETwwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDEuMCwGA1UEAxMlU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIEVWIFIzNjAeFw0yNTA4MTQwMDAwMDBaFw0yNjA4MTQyMzU5NTlaMIG1MRAwDgYDVQQFEwc1NzY3NzcyMRMwEQYLKwYBBAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCERlbGF3YXJlMRgwFgYDVQQKDA9QbG9vdG8gU3RhciBJbmMxGDAWBgNVBAMMD1Bsb290byBTdGFyIEluYzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAN064DdYD/tJ9gYfyalopSAa+3j4g32PD5gs0WdyPY6jVjR368vi/naeLft3UZ9EbTPw7naaeKizmvsUq4A9ArfJkCNhassmUhIzLEd3xDiRh7nr37JozfhSosTfMSEkTzvIy1D0vXjKaI6oQDuufE3LyKPyFBLm1v+A1/r/zidfihSpbsFG0m9EUclXEZLHTcGSIzgNBiKNFn8OCG9S5MimWsCr84WCft0Ne9kpQlQHWBATPbtNm7IlYNmzAuBezg9XNPhrEjMjksRVor3MBpKuPWb1fYDUSdOHreeVaGN5OVaA2qrMUg6jpQQv+VZjGlp1hXtGthueMyJBN4hImJ/PH1xbRCRkNlY42j0wbYH0KGs8U6OveaN4L72f8B6t2I8mZur5qZa9f5pFy5xQp33ZWX8qQrLud5KGXvYM9U8u0IbvwKYLnMiW24TXqGEZh3upzB/iN414Ou37zc2Hpz6Ogg8aAOdzuy/Hj2Pfa6thmNX7eA8YFNkUFnFWPjS/xnsygD0uHsLdLfrAYh5fuiCvoW3ilr+GYiGjTh3IqstQ9juuAIfnhM6opp0WE/rZFGRUiceJd58NxeyodNLL6V+jilrww0IssHMclGwUzQVa/ig7nH5goWomNITPdU5fJMLVq2Fsog6BUftpKzHJTuNtMZFSktAzAW7kpSoJ2rALAgMBAAGjggHUMIIB0DAfBgNVHSMEGDAWgBSBMpJBKyjNRsjEosYqORLsSKk/FDAdBgNVHQ4EFgQUpu6ahBY3kybEQ/p3JsyOq3NYWKkwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwSQYDVR0gBEIwQDA1BgwrBgEEAbIxAQIBBgEwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwBwYFZ4EMAQMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQUVWUjM2LmNybDB7BggrBgEFBQcBAQRvMG0wRgYIKwYBBQUHMAKGOmh0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5nQ0FFVlIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMEYGA1UdEQQ/MD2gIwYIKwYBBQUHCAOgFzAVDBNVUy1ERUxBV0FSRS01NzY3NzcygRZzdXBwb3J0QHBsb290b3N0YXIuY29tMA0GCSqGSIb3DQEBCwUAA4IBgQB1pHp6vpJZZxNhol1xMb3oIBIO202kMvneSra+g0uvuPBiGHYsnImK/bXA3tc/ZUE55JfPIGXQXl/ZPWYi2ruGefxFYep0FOrUCbgXattDo7LrhJ5Ow6wC9PXhLuqh0Xyz1rwZtRfgHTdb88b7TZx8+0OUwzaJDf9OiEqKs+0EvThh953CIfVApyYnbWn1Qr4ovsHPgC3eZ3MUMzVP18DBxXjpektCx0E8MKDn4riIB71Y1jKx1KgjXV8DP85COT7Jcn0QSeGdbg9323EhEgbfpTIgJueHzR+/xHFHfnh1T+U5ejonB9m5UAnt74nq9aPMyKCwAC3N+M77YMkCoLs6sco6cQOyP0V0TRN8QlwND13MZZ+T+i3DPK3Nx2yVbZz/Ks+a1d/YJvJR+PkiPc+vVAzYXS5PcPFhPXyy0KZNyzU3JG/XfwZuASyf5B75bQp5HD8ydYuTqOCEG+GygZn0qmwi4+80ja2ockCMZ0JbFCvxq+cRHiEaj6ARFC3s4DQ=",
        "src_file_sha256": "44b8093cc6cee4dc28ac779675983f2cbdc74fc33837a16758f988163794bd97",
        "src_file_path": "downloaded_files/remote_desktop_plus/44b8093cc6cee4dc28ac779675983f2cbdc74fc33837a16758f988163794bd97",
        "src_file_company": "                                                            "
      }
    ]
  }
}