{
  "Name": "Splashtop Remote",
  "Category": "RMM",
  "Description": "Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.splashtop.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "strwinclt.exe",
      "Splashtop_Streamer_Windows*.exe",
      "SplashtopSOS.exe",
      "sragent.exe",
      "srmanager.exe",
      "srserver.exe",
      "srservice.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "splashtop.com",
          "*.api.splashtop.com",
          "*.relay.splashtop.com",
          "*.api.splashtop.eu"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_remote_network_sigma.yml",
      "Description": "Detects potential network activity of Splashtop Remote RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_remote_processes_sigma.yml",
      "Description": "Detects potential processes activity of Splashtop Remote RMM tool"
    }
  ],
  "References": [
    "https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "3irjc74zj.exe",
      "splashtop_streamer_windows.exe",
      "splashtopsos.exe",
      "sragent.exe",
      "srserver.exe",
      "srservice.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Splashtop Inc."
    ],
    "certificates": [
      {
        "signer_name": "Splashtop Inc.",
        "certificate_thumbprint": "D458B32F6946DBB682A9687076EB9209979BDF76",
        "tbs_sha256": "2E68D3458EA8DF79CAB66FF9E4EB68904491CB6EBF148AFBE49F7FB46761FC20",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIHwTCCBamgAwIBAgIQBtI6cGq4XDJJCDeVS55BozANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI1MDUyMDAwMDAwMFoXDTI4MDUxOTIzNTk1OVowgckxEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc0MTY5ODgxMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJQ3VwZXJ0aW5vMRcwFQYDVQQKEw5TcGxhc2h0b3AgSW5jLjEXMBUGA1UEAxMOU3BsYXNodG9wIEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCtgy9O1cjrcAJs1It6xVS2qq2ngTEhYZWBhjn7SbqUGw6Zs5oKbOkAHiXlAvPGx0XYT9L+ixlXrGRMpSpsbpRVW0vX8N6sT9lvLjSYVvC4z0knVgCeAQH03KJu4KsCBarNBFYrJYWbfDQq5moFbAxvOWRawNCvPzo2FXq4ffUkd24It4V6yo32pyuqOSAY8PijQpe7gE006bdnutelYGMwaWptSKObp6j8cxZF5g87yT4JoIKVBIs7f4TcoaoYHS5+z5hFMtwn+TjFXG2En2tDoEPIVNwHLFJl4eeaJ3+koCV80MWwQ/QFPmrkcE2yBXpsqMd2iSHemwEoYTINKujXejceqs68OKxRNNJauWyiYFB6f/DbgJmFiskTrTd3UPQvyVQ5Rnvk1EDK0EM3YYALSHl8YWnw7kZqn3vHrPZM2qWRzPvIjaNZ/l8NmBwVJf2ELgs1c19cnYbXk5wN0WZSe02tQiXnfA16Ah47Z2O76RR7xuUf2LFMZFa8JImqpgkTqnvIpTUNHibxNMMXwSesIUgRT2Qh8YWhzJbAvRKkXBGiCqptNBdRiIQFp0pro3h1CGe1gdagFQrgeTQlk14rRqETAvxm+TLMlALSeY8bdd7cEr93RUDrwlGKNO+BumTgTnI0nVjXAiQWk/cA9c+cXh7EmjOgaAvao9xOMZfXkwIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFPeCRV/b/V8X0ZEKBcemOR/1zhonMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggIBAKL9tbtCq5etewkHZ7JpC53EU8xYEUCQt+igKQVaTaE4A/gfPaDi+cPRfMMtFv7PU5l3XPHB41JZSI3i/GFcF1DIEarWUl5S0OQO69Ni6vhfcL7eO28ZW3PHouAotB/jOkDICvkCjgqU1b1Dmxd1LMT9U0ZkHqSOvunefkjcaoraKNqzjktcJhFMA6vfXFzuMcScX+6jmMgacFkm5ZyWQ3REVKYraJzGrSacI9molf+8dRxA9pm9ePaCIUhXW8u3H9/iAhfhOBCvCOmPkGXP5CsQSx7RferaKhLR9gMaemuMBqW7LdXO9LUVGdEAiPTW+0LRp3aPj9gSPoYl562AQVjJHOSZMmKbuq0qiPsyj4voBq2lv4jveFSCzkg/0SSXNqIvMAHI/k2+71FeRo/6QHeu4saFQ45JzA+ripJNP6a0qieyUboFMxskD9vBKT/sZpFms150Fo31LxMF5s3yYKjUWY5rwlrSdpNGNl6lgm18WbPwrIx7ByoZJudhmoL5j1hldOIu2QCpGkHfdDjrXlFuTccAxXlW2v8GuWy4SDBT9waSy51s27QioAAnnRhiO0z/SaSxaWaAt0PkHLW4fopJTpmwGcLwI2dyYdIPrQ3E4dwMTPEHPPzr+dG5nzbG54aB1KKR4FQXxf1EyrjFxGEA8Ntxf/k4ThFmRFfTNJC+"
      },
      {
        "signer_name": "Splashtop Inc.",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "",
        "tbs_sha1": "2978060ECCF9B8AB92257B03117DA21AEA5DA8A1"
      },
      {
        "signer_name": "Splashtop Inc.",
        "issuer": "CN=VeriSign Class 3 Code Signing 2010 CA",
        "certificate_thumbprint": "2D01A46E9147185A5771B5B96675A89659F98C1C",
        "tbs_sha256": "51ABFD3E018A65BA17A112836881266A247DB48816BB0F49C24DF2E31C64FF7B",
        "tbs_sha1": "2978060ECCF9B8AB92257B03117DA21AEA5DA8A1",
        "valid_from": "2013-09-09T00:00:00+00:00",
        "valid_to": "2015-12-09T23:59:59+00:00",
        "certificate_der_base64": "MIIFZDCCBEygAwIBAgIQMmca3nwN2HmqDvX6X5iD9jANBgkqhkiG9w0BAQUFADCBtDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEuMCwGA1UEAxMlVmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAxMCBDQTAeFw0xMzA5MDkwMDAwMDBaFw0xNTEyMDkyMzU5NTlaMIGnMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxFzAVBgNVBAoUDlNwbGFzaHRvcCBJbmMuMT4wPAYDVQQLEzVEaWdpdGFsIElEIENsYXNzIDMgLSBNaWNyb3NvZnQgU29mdHdhcmUgVmFsaWRhdGlvbiB2MjEXMBUGA1UEAxQOU3BsYXNodG9wIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2OUDxZE19MrenyVYPW2LuMazHLvdcYJl/7NiyiaIjs50HZVx0jAHGRul90X4j1dbepw+Bxpt4YHMH1kbcZWRwhjENFx6DYjHcDPOgwlpicUHhAekC3KSGStpD3TG3Bp73rPp5+qcROg2WMgBa1b5D05Zzid0MOSrXR/GX6wOE+3xIpxUlgAP9GH694oUvEpJAnaDs9114dP1wAuOp/SSnfKu7oP20xRjFlMpG/+DUl7dNVR4NZiHdfobNVf7kaTWIcZmX+VmKyrrH9Ac8eJyebVGlgYJgp643ZFeoin9QOlloC3RECB2gycx6usYbb0YI4nZKcbIY2N7TduNExpuLAgMBAAGjggF7MIIBdzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIHgDBABgNVHR8EOTA3MDWgM6Axhi9odHRwOi8vY3NjMy0yMDEwLWNybC52ZXJpc2lnbi5jb20vQ1NDMy0yMDEwLmNybDBEBgNVHSAEPTA7MDkGC2CGSAGG+EUBBxcDMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwEwYDVR0lBAwwCgYIKwYBBQUHAwMwcQYIKwYBBQUHAQEEZTBjMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wOwYIKwYBBQUHMAKGL2h0dHA6Ly9jc2MzLTIwMTAtYWlhLnZlcmlzaWduLmNvbS9DU0MzLTIwMTAuY2VyMB8GA1UdIwQYMBaAFM+Zqep7JvRLyY6P1/AFJu/j0qedMBEGCWCGSAGG+EIBAQQEAwIEEDAWBgorBgEEAYI3AgEbBAgwBgEBAAEB/zANBgkqhkiG9w0BAQUFAAOCAQEA1Z2TFDB/koYpae0p3RbfgS7+3wVob/HonCpXYUa8CaHYGFFrpMSQQbBQsBpEX6tN0RSINw3fDfF+JIUbuUfvZmEf7HMfWX1WA5mhReFEFwXlaayJrsQst69nedeiCN5pFeQpZa4ElITpmDbNzWWjwcmbdh7kzYeSMXHv3y75EPBvDXr2RamXdhL5bQ6o89Jys3ThQjnWnmXORo3jxfWmMq//QYcWjYLNxBDCxtAZtX8UM+dv7usD+dWk/3UGzyX0TevrOtsZDwr3KmtilpuXzXZq4HNAlohcgHhUtjlT0gE6hXmh5SImc1gXrKeOq1G1k+xFugkZQyQ6XbkGf2hM7w=="
      }
    ]
  }
}