{
  "Name": "Royal Apps",
  "Category": "RMM",
  "Description": "Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://www.royalapps.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "royalserver.exe",
      "royalts.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "user_managed"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/royal_apps_network_sigma.yml",
      "Description": "Detects potential network activity of Royal Apps RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/royal_apps_processes_sigma.yml",
      "Description": "Detects potential processes activity of Royal Apps RMM tool"
    }
  ],
  "References": [
    "https://www.royalapps.com/ts/win/download"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Royal Apps GmbH",
        "certificate_thumbprint": "564F13E13238C21A522EAC9D8903CBA13F93D7A4",
        "certificate_der_base64": "MIIH4zCCBcugAwIBAgIMNKRGN590h7Pf4UEdMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDEylHbG9iYWxTaWduIEdDQyBSNDUgRVYgQ29kZVNpZ25pbmcgQ0EgMjAyMDAeFw0yNDAyMjcxNTE2MjRaFw0yNzAyMjcxNTE2MjRaMIIBIDEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xEDAOBgNVBAUTBzUzMTM2NHYxEzARBgsrBgEEAYI3PAIBAxMCQVQxFzAVBgsrBgEEAYI3PAIBAhMGVmllbm5hMRcwFQYLKwYBBAGCNzwCAQETBlZpZW5uYTELMAkGA1UEBhMCQVQxDzANBgNVBAgTBlZpZW5uYTEPMA0GA1UEBxMGVmllbm5hMRgwFgYDVQQJEw9HcmltbWdhc3NlIDM5LzMxGDAWBgNVBAoTD1JveWFsIEFwcHMgR21iSDEYMBYGA1UEAxMPUm95YWwgQXBwcyBHbWJIMSkwJwYJKoZIhvcNAQkBFhpzdGVmYW4ua29lbGxAcm95YWxhcHBzLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOfoGjxQ7itvAWsi9Mb1H8oXTUYQnfxtaj8YpTCXKPrRjkVos0T6L5Tg4ln7B+v0XL5fmfb4ctRmuSswamTrCYziJToLYgwacfFfuBtE2xhpniHuxModnSD1G9nHQD8OfF/3HnhlnS9Bi3dxf1XIsQ1l8CKA41QuFpfACmJqXlJdTbfktfG24h8Rx/TwT1TeYDkGS8Tuibnb2BGp2Nn07Uvgtm7AmxFt2dcrYsjde2v01qVQptG8iyHSE9fnR1Z5p1gT4k7Yzeq+3Mis4EbYwe3fXB342VhzXQJSIenZqbAfosltqV1BBsA11NmGbYhl5scQFB0l3iqnx8w26U2BBGDTxW1O2PDQbPP364saxt57qKBp6TZNt+/E/+3FeZveFQs+NdaksO7ZQiFSXSSi2tYuK1YFYRKRC5jupKozPSYAD0wR5Nm7lQnqoY6TRYEFH8iY+ThuJHJB8Xjg5614r87v+MYlTr9m+PL++sUf7umnK9jiwicWUDY+VsgI437T6P/6XNgJE0A0PJkKCu0GnstKF2ORmU1TZU5IKR34xDwBDieyt/o07sP+5uFgzou722WECqS2IpnjQadii25/077HU1s+gd4VHNQRMZ1c3Tfue12TXrXekU/R873Q6g5F09cN9MkF3dKxRXtif6c8OIfvaqOyKeNvXLiAmGlKiLLdAgMBAAGjggHdMIIB2TAOBgNVHQ8BAf8EBAMCB4AwgZ8GCCsGAQUFBwEBBIGSMIGPMEwGCCsGAQUFBzAChkBodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2djY3I0NWV2Y29kZXNpZ25jYTIwMjAuY3J0MD8GCCsGAQUFBzABhjNodHRwOi8vb2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3I0NWV2Y29kZXNpZ25jYTIwMjAwVQYDVR0gBE4wTDBBBgkrBgEEAaAyAQIwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQMwCQYDVR0TBAIwADBHBgNVHR8EQDA+MDygOqA4hjZodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMC5jcmwwJQYDVR0RBB4wHIEac3RlZmFuLmtvZWxsQHJveWFsYXBwcy5jb20wEwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAUJZ3Q/FkJhmPF7POxEztXHAOSNhEwHQYDVR0OBBYEFL5i91y/tCITck8CG7xPJOlWZFS+MA0GCSqGSIb3DQEBCwUAA4ICAQBNuxXWm+YEdOY9MxV6oMHLe2n8vfsBvxCGBHuzsb7sIt3QQmpPeYFsg/CyEdm0v6pKWnO6u5jd9QBY5xSyHu/tSD9B7P954NwR7KmS+kGeuQFkI9KQV3zid4RGpaPZjUEtEhlaRdUAKmBz/2cpg1vBW6VoqB3yXN0qBoe1F24gvAQOepm8WPR/u0rFX0gVlOpfVACNKDFmWGV7VUZX6LI3x+QKuMES99U3pwO6DQsudg1oVAG5SxevaIt+JrG7j6Gw9tsimWaJiv4PAq885a4avcFvutaQYKsnZSX7lwo7gXM3RqLGPB0rTXVZ8jhtcw7dP3mQUEgi6QdkMIV3rrbzTi0fe22LQ2akQM0UtJ1doncEVzb2YuIwXtJ2RmOmsw8u2+QUnalFDsUq5byBnE+ymxp/6qgmmswTsEHSWBQZI4nl2xoOog5r/yXJhyanJg3ysD6V8ejxLIw9ZlpAeSDZt6p649aUL9/l4FKXhfXA7qnr+M8uFMTT7eZulN+Kxu9gkTLCA6DXVwJSQjnSOTxBPtFROBf7LKdjMnqDptYli7VjdCcMeRBIo7Eo60VJ6Amudeh1Xt3ujqftYG74MpEy2e8pK5PWvpe2msUvlo93oQZS3fYNREO9y5A48v1Bp3Htq8XSRp9vqqGXy/wlwFRhz/EupjprvWmZbsSgkKYYsg==",
        "src_file_sha256": "fdb7e23f6a02780def665e6ea428cd9cd59f115cd33d9dc7ba2b63a5fa8e1b3f",
        "src_file_path": "downloaded_files/royal_apps/fdb7e23f6a02780def665e6ea428cd9cd59f115cd33d9dc7ba2b63a5fa8e1b3f",
        "src_file_company": "Royal Apps GmbH"
      }
    ]
  }
}