{
  "Name": "RemoteCall",
  "Category": "RMM",
  "Description": "RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://www.remotecall.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "rcengmgru.exe",
      "rcmgrsvc.exe",
      "rxstartsupport.exe",
      "rcstartsupport.exe",
      "raautoup.exe",
      "agentu.exe",
      "remotesupportplayeru.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.remotecall.com",
          "*.startsupport.com",
          "remotecall.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/remotecall_network_sigma.yml",
      "Description": "Detects potential network activity of RemoteCall RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/remotecall_processes_sigma.yml",
      "Description": "Detects potential processes activity of RemoteCall RMM tool"
    }
  ],
  "References": [
    "https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Rsupport Co., Ltd.",
        "certificate_thumbprint": "3E3B0B3E214A4549446257C92C06839F92DCE444",
        "certificate_der_base64": "MIIHyjCCBbKgAwIBAgIQDSe264XyjRcsVC2OmotjNDANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MTIxNjAwMDAwMFoXDTI4MDEwMzIzNTk1OVowgdIxEzARBgsrBgEEAYI3PAIBAxMCS1IxFjAUBgsrBgEEAYI3PAIBAhMFU2VvdWwxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRcwFQYDVQQFEw4xMTAxMTEtNDM5ODg1OTELMAkGA1UEBhMCS1IxDjAMBgNVBAgTBVNlb3VsMRQwEgYDVQQHEwtHYW5nZG9uZy1ndTEbMBkGA1UEChMSUnN1cHBvcnQgQ28uLCBMdGQuMRswGQYDVQQDExJSc3VwcG9ydCBDby4sIEx0ZC4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCvxYBBtfpn3U+4PbVtgqgg35bZA0uixzR4GdbEC3q6fCZWBu6JOXur/NB8WJ/+8IY5JBiSGUWFKVf7FrHaeSqhD14714iLCtGmn7CjC1M4xg5z4mQdoVc1yGkslEYYPDcJ8GEh7vC6fvZfGtcGPhezOcopLOa1SVsFtNyqscxgvtkMJPTxleqHy/0425uHwK6lf8X2WV98GVsNH/g0tHOJeNZbqIds+LJKOOO2oQabqfpBFm2SrEQAOeAsEcomeUWV16kTrFdywGkAx5XWBcklr3u2Jfzlo/Wvv1+RBbZs30XOanMdhmOK+ChgZ+aYsFSLpzZmTMRJJVHwqKkFMsV3ORkQbHjG2W3JYIaBj6o76Yd1oE7C5J3dTGmHP0VlswAIxJixRfom8Q8VTApY+XsK5RJAzi39XyLfsBB0GXPExQ+OqmGI4mdNKlr+enOL8hC3tdJzTtD+heRGmciOd30u81Ki69grdo82ffxXbA9qlhm29aHOEYCwVzMJWGIP18a6UfgIxmvTnzJGz5aHD3ffixTGsTWZOM+5tKz/tkyQwYHssvq0Psi3PXmU2i9yw+FbShwh4TAhARL+hO95rcYNnzQ9nCSYwmCIEiChUnxMQulGSL6V/vJ534u4+tFY6qWdmuFAdPi/afFcY3O1Cb967+/JgZkFF9yPHu0JEskwrQIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFKJG5p5JQVRQaOTdAHsZ3ujFE3RSMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggIBAHYT5Km/Rgx4yzza9xm45cFRBeA0w8BtFUkdqd5C4ZAlCgjrU56npOz5fT0gCi8cmsuwJMiZpPAKqbrXJeBgSlPJpUgjN4ofgQxI5Vin8JCdii1GVZlYahINhZcaZebqsI/h3+u2nlb63u1tHdTjhiZZbTcfVPXTu0dfJ7l15Uv+3eJK5UkB4CaMySURshdhwTcQofheHInuvhPPcV35hjVTha4X5f3PdhyosEGXyae1oTygcHicuQx09hZ1hkp74Yg1TlkciOV4MYzKYIN3my2e/Kcua8jXgY5PLwKJrwxEDSindm2QJ8KA5+oXBNVxH1y0Fza3ZBecIX9j38OS7WpMcdv8jU4iWHk65Tj3H9ORCAg4EzF2gMyZMHYFdXhUcp6uFanEtpBCPZR5SLDKvEo3/mdybTUy78C1myikYSxvOfHfxpBMyq4ESCHp7ThpSBVfgkNiahdEmesVIs2kc4sOAO8EMKgAmzhQDzsxN/VvcWhRmN9hzp5Daos2UKiVlPqCl2ZZtuamVSabjx9EWgnHIsJNp6+YVLJgw0g52MtWixYt9aaS5VPnqYDqbrPq6WpNjwyaxWEkNBL4OBISjdRhFcLZ6+8PlNMZN3CcH6xy8jxeSCDt8WXRU5+d3DtrircpOGeIp+fhZSdXesW0TdEZVCobW438nh4xdTLDnfsA",
        "src_file_sha256": "d8d56802d3a0f12a33a9c014ca5edb075e7272bb38274fdcb0d4a8a95a4147a6",
        "src_file_path": "downloaded_files/remotecall/d8d56802d3a0f12a33a9c014ca5edb075e7272bb38274fdcb0d4a8a95a4147a6",
        "src_file_company": "RSUPPORT"
      },
      {
        "signer_name": "Rsupport Co., Ltd.",
        "certificate_thumbprint": "D5980651B93ED19EC1DB036FC73024C4761437BC",
        "certificate_der_base64": "MIIHZTCCBU2gAwIBAgIQBGghklMcCh6YE7yRgbTNLTANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MTIxNjAwMDAwMFoXDTI4MDIwODIzNTk1OVowbTELMAkGA1UEBhMCS1IxDjAMBgNVBAgTBVNlb3VsMRQwEgYDVQQHEwtHYW5nZG9uZy1ndTEbMBkGA1UEChMSUnN1cHBvcnQgQ28uLCBMdGQuMRswGQYDVQQDExJSc3VwcG9ydCBDby4sIEx0ZC4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCzdC7vp1iePN6hujQGcAU4X4oX0TGV6lMqtEj0HbIW+SUVmHca3O/6KTPoxahyjxPJH2ZWfr6jnhwvH54OO63r7qyfwYlBEtpnL/j0nu2B2fQi1jq0S+4+/0f1h4/sPtuKVPI4eH2Iicy6hri7L0YsXsegeJrYgIUQT19NBmg5zRWuRfM35r+VEEeDTEg+YUqG+es77MDFmWhEe70bSGcziAEqxfq7U+twL0LeZK6P+MyfidV5Y1TqkClcujbamI7BaZY7HDDxR01xbRQuDxbyVdQX+dflVKK3NgLGJZiq5f8No+90PnimAEgLppZQBsiZsyzUxLTPplVIvjVOpbJdNiq9p0GWwHU9U0A1POzrEZjLUui0O7+k/DcJVJFTesjHC7BNeyn7JLd50+YYzRB5pGRsTcRofURyybYeBZTrJl+Spcy7iAPLfEvnQABDrgJzJjyAvuqiTFTG5YGYhLtqToOGro6u5oWc/ZRrd5Hqb9h08qwAmsA2xGHougDZgOBQmtFwNcIyLlsP+LTxu3VRLQaKeiTb3mMV1fatvo3viyto8wV1OVJ0/9BDKjk/F4lmm4SEMojWbPZSk+WAOhD62nCOFBNHqaV0OrcY94oNHfVG6MDjTr6gTgBzBwXK/sATPPGJRlFSLAPpz49OxMy0ZPEEqKg/YpNc48jEvHPTfQIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFF1vWyO13SratWCKgRbAQ0Zu4ze/MD4GA1UdIAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCasWVK3s1zAOGUmPpi7n6USuQQd3xJViCoNx1MVyuJYqMKyKZbV2xrRyKsX8r/ZJlGIokiXsFq1mKxokZ+EEocJJNPOYXC7yVwo8dhUOlWNtfAWfIbSbMUIk0BYcbest1UoFAirETwj646AW7bkjpTwbItAIRytGo7la8+4402nCfd3dAvx2n1UtOyk7ATDxbReMQF5AYOByqkn/QntotJDw+xeGNvG0tR1cKerr5QWYeS5icRFg5ctrWuW9IJKG2m9/rgfDwVQ1DantJkWZ14AFIwKhyygLeD0PBbBBNKeI7JhgBYEURs+6Pv6YJbWnYJRZuqwa3KTMRL3O4kriFrZIA76zIPatONUhLzyMjy/AYce1bz8fAYeIGAT1ws28Ys96lma3iJjKyHVq6JnmjOq5c/y3rlLbAlQ2m6hPY+AVpupbS9cO5dVYDb8IXFlbed8WS/DqvHUtz5VRgnHfrLGihvcL3OLvAr/fENw9ZcX5xbIsC2hG6HeQrwv68N8sqaJV7DYmNSBXXJJm9qM0t3rOgN4hMyaq0gleiQBozIESn8b5knhefdZ9z806Byz3jKBtQHAuR52AX04IhbeYUL82H9v5p2/Z+hcSTBD9mZh5SjFeRDxRVqj0aCPmDWgQv2K0DQDN1CiqXVhc8lgib5TulGrNgQu3R1Jul6SjQORA==",
        "src_file_sha256": "47b4ff9f8cda6a49a31e1c1f9b42ed1a574bdb71f42f27c147bce48d1b48ac5d",
        "src_file_path": "downloaded_files/remotecall/47b4ff9f8cda6a49a31e1c1f9b42ed1a574bdb71f42f27c147bce48d1b48ac5d",
        "src_file_company": "Rsupport Corporation"
      }
    ]
  }
}