{
  "Name": "SpyAnywhere",
  "Category": "RMM",
  "Description": "SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://www.spytech-web.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "sysdiag.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.spytech-web.com",
          "spyanywhere.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/spyanywhere_network_sigma.yml",
      "Description": "Detects potential network activity of SpyAnywhere RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/spyanywhere_processes_sigma.yml",
      "Description": "Detects potential processes activity of SpyAnywhere RMM tool"
    }
  ],
  "References": [
    "https://www.spyanywhere.com/support.shtml"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "北京火绒网络科技有限公司",
        "certificate_thumbprint": "951553728DD3DE4E8F93F5A60FC4C54C12F66835",
        "certificate_der_base64": "MIIG9DCCBVygAwIBAgIQfat58pikwY6By3+fkJlV/DANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMS4wLAYDVQQDEyVTZWN0aWdvIFB1YmxpYyBDb2RlIFNpZ25pbmcgQ0EgRVYgUjM2MB4XDTI0MDIyMDAwMDAwMFoXDTI3MDIxOTIzNTk1OVowgdIxGzAZBgNVBAUTEjkxMTEwMTA1TUEwMDVDSDQ4UjETMBEGCysGAQQBgjc8AgEDEwJDTjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdhbml6YXRpb24xCzAJBgNVBAYTAkNOMRQwEgYDVQQIDAtCZWlqaW5nIFNoaTEtMCsGA1UECgwk5YyX5Lqs54Gr57uS572R57uc56eR5oqA5pyJ6ZmQ5YWs5Y+4MS0wKwYDVQQDDCTljJfkuqzngavnu5LnvZHnu5znp5HmioDmnInpmZDlhazlj7gwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCuvHY2ak2Vn5mAcrP+W3fmpZXljNU8HZNrLGUp/67VVd662zNqkncH96tV03kqsLeenOmOhdDZkOYhRpzING0XFUhK/RKWTu+1XSlMHBIX49QB20zj04FiNYxoADHPggUNSGGiR8t21FfjLtCkb7C3EiXwpakzdrdGodkhhhAUvEXhLr/NtDBbC3Fyhv+rmI9IyiJlkH0yiA5THg2nlt5hwFh7/aa8gTzt6I1mUX9MmEJa9abuz5SGMZLMoxEPdxXzDJ/o0A8Wpc3D/S5LwiTCGTrpGCssi1i1A6ourfO95hIFT/Z313p89aqHUlJymJanZRTxWoI1y2u/8F5Do8jlODKkY9Lclu/d1PfORE0UhAdfxVNzWWXHzVRiikrHCJPZ/Mub4KzC9Xo38tPkKmc/w4DGeNpRa/qzsd5S8RvKCZM9MfugNHEKZIpqfSv5WUfheKkJoLXCze01B8UHK3D8JSVheEfboQmH3napY490+R48iuVTK0zDkhqTnbpJ1PvGcunGYCyeodsDS3n9wnMgmQOBQV0yeoMyCzd6GDW1veSlTMrH/NAQcHJZl7OoUzKSnWv1IJ5bXAXyHp8l5jAinDbn9hSEC0YyKZOlkrLcz3BkeTc2ObziCfBLQFvF/M4qGaxtrZEJ9GwUwRHK6VqsyUuENp5CFxM3zzwR8frZBQIDAQABo4IBvjCCAbowHwYDVR0jBBgwFoAUgTKSQSsozUbIxKLGKjkS7EipPxQwHQYDVR0OBBYEFE6cqPK+2pfGOZg/ntb8qICf3X2lMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMEkGA1UdIARCMEAwNQYMKwYBBAGyMQECAQYBMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAcGBWeBDAEDMEsGA1UdHwREMEIwQKA+oDyGOmh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5nQ0FFVlIzNi5jcmwwewYIKwYBBQUHAQEEbzBtMEYGCCsGAQUFBzAChjpodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNDb2RlU2lnbmluZ0NBRVZSMzYuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAwBgNVHREEKTAnoCUGCCsGAQUFBwgDoBkwFwwVQ04tOTExMTAxMDVNQTAwNUNINDhSMA0GCSqGSIb3DQEBCwUAA4IBgQB9jaDdDBcZH5gRFMYHytmyxQ84JgSRljSnC0MLChnYf6zl98K7yVX0/QoHQoxfpp3ETk37ZBXOI4ySu5y82+SHzHA1urZU8OczWpFP8uHWbbhvnzx8voL9BicAQjuwyixAbgsZovSN0gAU3GqWF97Y0yvme7JO1hSAAP/0p8riqtuWExVOcQmBDc9T6KcJ0o0Wv++Ewo1AJDMjkdM6ZVZ585br/nfRivn6s9YSRbsaErSn0UMWZ/qgOLvkvuDkffNuwkO+3aA2ES9xKGm1IFtl1M7a5omYD172sDxEXQGZnWAQj685LmpY0McGjAgvSvQ0nOHkgALWWo3y+Hqz3SwK4QQ7GzBQQ3sfzJky7yHwGT1rMyuFpDTMeO1YxrFkkzNg2CoddwuOF+GqS4etOqigtStSoer9Vm4GDHbKB4Zeml+DLQnWL4OR/QSIwnFYJw7MrsTDNpXDq7KyqmtrGa7FhWnHwOZ6/1K4/wh4+QUDkmbDTv+JLW0aVhAy1ntAA30=",
        "src_file_sha256": "d77eb49917751cfebc42e468bf023e3a2b86b68a73e292ea651d8869aa2650a4",
        "src_file_path": "downloaded_files/spyanywhere/d77eb49917751cfebc42e468bf023e3a2b86b68a73e292ea651d8869aa2650a4",
        "src_file_company": "Beijing Huorong Network Technology Co., Ltd."
      },
      {
        "signer_name": "Spytech Software and Design, Inc.",
        "certificate_thumbprint": "0F999A1FAF749C55BC095242AD221637850EE6AF",
        "certificate_der_base64": "MIIHETCCBXmgAwIBAgIQBM8yxx2IgNuYuMbbfCqd5zANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMS4wLAYDVQQDEyVTZWN0aWdvIFB1YmxpYyBDb2RlIFNpZ25pbmcgQ0EgRVYgUjM2MB4XDTIzMDYxMzAwMDAwMFoXDTI2MDYxMjIzNTk1OVowgdsxEDAOBgNVBAUTBzEySy0zMDUxEzARBgsrBgEEAYI3PAIBAxMCVVMxGjAYBgsrBgEEAYI3PAIBAhMJTWlubmVzb3RhMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlvbjELMAkGA1UEBhMCVVMxEjAQBgNVBAgMCU1pbm5lc290YTEqMCgGA1UECgwhU3B5dGVjaCBTb2Z0d2FyZSBhbmQgRGVzaWduLCBJbmMuMSowKAYDVQQDDCFTcHl0ZWNoIFNvZnR3YXJlIGFuZCBEZXNpZ24sIEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDyiozbWhmX23R+PDAT+KRlT817QVxjDlKXpUZcE++APQFxZef2l7ICz0KUODpogFimsZ9ZTvTj5qGAzosEfXf1VIGwUlBpSTeKvE9vJ/thvgLHZ44NRfgpHOWRNlZzmlJ82yI2yk7BYIuIFYuPwludavQEZShUxRbxNnaP7p+MpDetK+RzOwtClFc9kG5+toVp1qeLkoZF0NC1cQOGcNNSQ3MyzQ+9lAQ8fDm0D6yvfBQ7A/aUHRpjnhrldOnzYoUkB7ve+SsKHWEp0aU2nJvswlccz878/WzNYe6Y2mkBCUeAdcfmnKTDi2s22aaK8fZsfckZ88r5pXMlykbpD8B9WoNt2PjWoIOkZ6oFW2blVchL78SsYRQJRqJqiSls2nQKOlwW9zg+zOYlrRMHFaK6qMWu+OUgH7xEJEa8EoB2tJmG1Gs1mqB0l8fG+ELsOgiFk6e3TJMk1Z1PgAuxU1MCewsKst/Ado3PZbB8F+mT6j6RfrKvqUSUf9R8Ya6YeKxWb0+9oQ7qV6TZ3MQ+gPufI0TfApQIcdYMLkGn5i9bGdyE0EW4utPy+nfKYSlHGGdjc/yIa4kkD2a0e++APZ4SH+TppFGRaoDccH2oDrgtR9DKuSSugJ3qQ9SpiiBDVJ1qtBdj51Gg7btWyZuFi6aA5DwSVoaZcJxNTUS1/+19ewIDAQABo4IB0jCCAc4wHwYDVR0jBBgwFoAUgTKSQSsozUbIxKLGKjkS7EipPxQwHQYDVR0OBBYEFLb015a3vcu1jzRqO5nmBCi1yXIwMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMEkGA1UdIARCMEAwNQYMKwYBBAGyMQECAQYBMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAcGBWeBDAEDMEsGA1UdHwREMEIwQKA+oDyGOmh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5nQ0FFVlIzNi5jcmwwewYIKwYBBQUHAQEEbzBtMEYGCCsGAQUFBzAChjpodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNDb2RlU2lnbmluZ0NBRVZSMzYuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTBEBgNVHREEPTA7oCQGCCsGAQUFBwgDoBgwFgwUVVMtTUlOTkVTT1RBLTEySy0zMDWBE2Nlb0BzcHl0ZWNoLXdlYi5jb20wDQYJKoZIhvcNAQELBQADggGBAHqIr6L/ayqJ7d3cGxSj2oL8ZAB6n9+NcRRveiPdD/faHw6oVxnIZ7nmkETh9hLFXyGSjkhTSSdYDznHnVnkOw4Zq/3TRtSRgkPvVDBtJ9GWo4iUBWVpZPfKn1Jau6BSTLjU+RfujA0eJhRGPFuojJrgXGSLXZI/KZUS0HixeuA3VBJR5NYRSmtVXc6CqnYPS2/GAOPUgec5Pu0dVzuX53EdqpOf2Op1v+/3UA+cizukz4TR8l1EzQsZQ5SzX7RSiEAYIOQIT292M+STcT0njInd2/Q/iwhO58li69h2uqd4WYk8dj4QoD7mrtRXzc1irekzFrl1GGgPsymYIZDVKplaA2sn3w8dOqwn0bVCKkVppkslICOMZspV1L7CxRd7V4LZRqGrsW6WwbYK5HlXfr/QRv7qg2RL0re7Vb9RSO2ENBtvwQo6OnaGwymSlxdw50c0snaktDDpogSr1eJsjMh4sfuTrTAIeps3kVVw+b661JgggvSJek4xZgNDn54NyQ==",
        "src_file_sha256": "8188c9883b46eceed07cc494ac29a02a1506934fcdd3841ea21d7f30fdfbf16b",
        "src_file_path": "downloaded_files/spyanywhere/8188c9883b46eceed07cc494ac29a02a1506934fcdd3841ea21d7f30fdfbf16b"
      }
    ]
  }
}