{
  "Name": "Supremo",
  "Category": "RMM",
  "Description": "Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.\n",
  "Author": "@KyawPyiytHtet",
  "Created": "2024-08-02",
  "LastModified": "2024-12-02",
  "Details": {
    "Website": "https://www.supremocontrol.com/",
    "PEMetadata": [
      {
        "Filename": "SupremoSystem.exe",
        "OriginalFileName": "",
        "Description": ""
      }
    ],
    "Privileges": "Current User",
    "Free": "",
    "Verification": "None",
    "SupportedOS": [
      "Windows",
      "Linux",
      "MacOS"
    ],
    "Capabilities": [
      "Remote Management session"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "*\\\\supremoremotedesktop\\\\supremosystem.exe",
      "%USERPROFILE%\\\\AppData\\\\Local\\\\Temp\\\\SupremoRemoteDesktop\\\\",
      "C:\\\\ProgramData\\\\SupremoRemoteDesktop\\\\",
      "supremo.exe",
      "supremohelper.exe",
      "supremoservice.exe",
      "SupremoSystem.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.supremocontrol.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/supremo_network_sigma.yml",
      "Description": "Detects potential network activity of Supremo RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/supremo_processes_sigma.yml",
      "Description": "Detects potential processes activity of Supremo RMM tool"
    }
  ],
  "References": [
    "https://www.supremocontrol.com/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "1ssi28.exe",
      "supremo.exe",
      "supremohelper",
      "supremohelper.exe",
      "supremoservice.exe",
      "supremosystem.exe",
      "xdc6h.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Nanosystems S.r.l."
    ],
    "certificates": [
      {
        "signer_name": "Nanosystems S.r.l.",
        "certificate_thumbprint": "D16BC32A1444D341CC91025A4D7183AF5EAAD30B",
        "tbs_sha256": "F437911CEA37149CDE7F297D4086B2C11B2FF9BDCF803EB5217DEBEFF946AFA2",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIIIjCCBgqgAwIBAgIQAXhEUYpXMYiPY6dpG863dTANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIxMTAyNjAwMDAwMFoXDTI0MTIwNDIzNTk1OVowge4xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYBBAGCNzwCAQMTAklUMR4wHAYLKwYBBAGCNzwCAQITDUFzY29saSBQaWNlbm8xFDASBgNVBAUTC0FQIC0gMTExOTk3MQswCQYDVQQGEwJJVDEWMBQGA1UECBMNQXNjb2xpIFBpY2VubzEWMBQGA1UEBxMNQXNjb2xpIFBpY2VubzEbMBkGA1UEChMSTmFub3N5c3RlbXMgUy5yLmwuMQswCQYDVQQLEwJJVDEbMBkGA1UEAxMSTmFub3N5c3RlbXMgUy5yLmwuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAmlGkR1kDigH4IBCSl4WcdhG25IsOFz7Lp4EUauaopjq5HSmWMEmag1onn128rheWx2TCaMB5tfe/ktW2nvGMOS3K9Kc716gKa9usa0cFMnYgiU8oemN00VYpw1d8m/xFAT504o9znXIXBP9oxgjru3Q3hOy6dwluv3K6AJZYURlFK/JivlsRa3Lw6t20sME+kOQjHo+D6y0qoglPs9guejPfeiucO7icYN4gCMDDKH3iskHdZj/hZ1zqMt2W7a+OkSEQTOuNS/DEaVtBG9BSK81nbiilVJomgt7PRSBWndNbyPoeEkJBfzRUPpRUVvW5Igbl2f6gWllR/aNEFdRYjBoE+U+fSlwGtfciXlDDnBU6ChoZRF09ydIOPIN1fvkdz7wWGqMq/VVsmmRF3Jwymb/qBlMc86Qe46bTFY0siWzY3QpAlrv5pOwPPoeGL6S2nEHWbakJ2jLnc1+tGPm6qmnYDgzDBxfbs4bT79eUDDigu7qgoFBR4I8KfL6fyIKFpjroi+qpYVAr3gF4zaLTWHaJzmK6s2trzT2VT50NrIwMXGSohGn2k+ci9Jr07nCMysOFFq39zLqhVN7iE0t91pfwC0uwa+6CxjRIWe+h7tSReTPqNp89FdfNh8B/WgwcF2UYgyq25lJu5Tl6eKGIa8dSKfjrC0cdqZ4dE8/DSf0CAwEAAaOCAj4wggI6MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBRc3K6kncLX7fLJRiwc8k8VBiCswDA3BgNVHREEMDAuoCwGCCsGAQUFBwgDoCAwHgwcSVQtQVNDT0xJIFBJQ0VOTy1BUCAtIDExMTk5NzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQC1LPut0U9rV6tGe529tU/VX+I1ODdQkpyc7EBp9qsdxDFs9oNpniwAgSXpqwJ/NXjR7UeRZxJemcuE/0TG4F1MZwMO7AUVeCpF+1K/+OHQUYFfA+hUCowD+GpQy52RLdO9HkiEkURSqDn/TkJWWMqtS9pLWPaGiWznBOK5/ppBFQ283NLHagTg9FOlOhHwmv5/TFOQJTXwbT7F6YTC2ExxryQz3shGi9XM9uSQY5KNQfYG5nF+pt0iQzpJe0lPWBCKgIFh0b55OkrAbA5qIuLZpUZr8oN0f4rIkOxzTtDA2Z+tTaeneibQNFk9pZzk1MnuzsjIVuclPkxaqZjulFwisJLhqlJJvQXfN9i+LSPZcgETTd4FtA8zjyYFrgdphjBgwG5NzE175yritvwaB0BWY3Qfyz10kH7Q4W2vlPR58RU8Z1H7J8rQquMgmRoryekS6bbKfZNy9nnbeOxmi9gA7nwjv5o1TX9aPy8rSq7h2roqpWp4ZLUaJ6+aMQd8T4gFU2fjPpW24csLCZwRW2MuPxw0/uCIlPrwc9rDKNnNxfRmZaf/jjImRKiy/V4d0NDOszCYhAHJ3kPJwIG0g00bgDEIN+dsvA0Su4spPx+f/0rYOWjgwQKFuckMo4XfPF4dEW4AAajTLGn+rMIfYNG8s7Y1d/Wmfp3igs+3Shrpgw=="
      },
      {
        "signer_name": "Nanosystems S.r.l.",
        "issuer": "CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1",
        "certificate_thumbprint": "C96F520883FA154431F134ED7BFAA91C09D22934",
        "tbs_sha256": "B62C60F9FAEEAC5190D79A9F01E44BB29347738FD23382EC7CD9D09AEF49D859",
        "tbs_sha1": "3D5BD403031A8328CCE535FF7794A8B62540335F",
        "valid_from": "2024-12-09T00:00:00+00:00",
        "valid_to": "2027-12-08T23:59:59+00:00",
        "certificate_der_base64": "MIIEdjCCA/ugAwIBAgIQB2Zcj1srRFnLSLtu0lAYvDAKBggqhkjOPQQDAzBkMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xPDA6BgNVBAMTM0RpZ2lDZXJ0IEdsb2JhbCBHMyBDb2RlIFNpZ25pbmcgRUNDIFNIQTM4NCAyMDIxIENBMTAeFw0yNDEyMDkwMDAwMDBaFw0yNzEyMDgyMzU5NTlaMIHhMRMwEQYLKwYBBAGCNzwCAQMTAklUMR4wHAYLKwYBBAGCNzwCAQITDUFzY29saSBQaWNlbm8xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRQwEgYDVQQFEwtBUCAtIDExMTk5NzELMAkGA1UEBhMCSVQxFjAUBgNVBAgTDUFzY29saSBQaWNlbm8xFjAUBgNVBAcTDUFzY29saSBQaWNlbm8xGzAZBgNVBAoTEk5hbm9zeXN0ZW1zIFMuci5sLjEbMBkGA1UEAxMSTmFub3N5c3RlbXMgUy5yLmwuMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEEgEoCGgWP35CV0lqFEvC8b4xBYjgICVLhJFii+MJWe/+aOojgWuHoppGIeN/nRN6NzjE8DYIgBSZsdDIYRY/zIewe/OI14F+iBvtaXx126DX4fBsUdpTMl1Q+D0kuxgmo4IB8jCCAe4wHwYDVR0jBBgwFoAUm1+wNrqdBq4ZJ73AoCLAi4s4d+0wHQYDVR0OBBYEFP7n7KncGVJbvxaChi9f1Fq74DZwMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBqwYDVR0fBIGjMIGgME6gTKBKhkhodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxHM0NvZGVTaWduaW5nRUNDU0hBMzg0MjAyMUNBMS5jcmwwTqBMoEqGSGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbEczQ29kZVNpZ25pbmdFQ0NTSEEzODQyMDIxQ0ExLmNybDCBjgYIKwYBBQUHAQEEgYEwfzAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFcGCCsGAQUFBzAChktodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxHM0NvZGVTaWduaW5nRUNDU0hBMzg0MjAyMUNBMS5jcnQwCQYDVR0TBAIwADAKBggqhkjOPQQDAwNpADBmAjEAv9Bdka5r+3FYnkeSJIvaMvlt60MokIt0CKwPBUjN6CwAavmKoeqzyHNg7XpXsSYiAjEA3RwgKo6+hfPC4fH/904xpcUPi8DMG3haB/m/CSV2QCysxoT+0yvv7NGOlnTBTIZ9"
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "SupremoHelper",
        "sha256": "A4FF9D77D7D2C42E8EDD3D0FB83C26B88A4B79DED4051E8048F3835BE4C6F8DF",
        "sha1": "5EFA70D9F40D11A22E7955EF0449C49847CAB84C"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "4138192E207173D3E395C1FA7D18CDEB25B0CF7FC74669F5077800324A9B876D",
        "sha1": "41331BE6BF541B48FC968C0A95976F2393F1D085"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "954EA41E58B9D7D8ACCA0CEE7F8C2739516111EDD0716E16A5A92B49ED16314A",
        "sha1": "7E310392D889E9E5BA09515B876D7886BBCF397A"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "ECF9262BE1FBB07C178FDE8CC0A95FDB791EAEC56CAAFF317320D9533A46F303",
        "sha1": "DB25414C5BC82BE949DF93C617335715747B55FF"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "E3D7AF0561A153124480FBCB211B0871C35AEBEF17D67D8BFD2F2D35086C39A7",
        "sha1": "73A43745273D5F09D2327F9A6B0573BACC7AEF2E"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "FBBAE034BF0EA1D87F98EDC689791225DE258DCD9F4F8DA0A777D97F418029B9",
        "sha1": "2D457A135913858FC88D14C087A712E95E1A907D"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "5A9F54598326CD46D23B3A56739B75526480DCF68099721EA906C50CAB743200",
        "sha1": "C5839845056A26B1F8A4EBC750A8E4796344AEDA"
      },
      {
        "file_name": "xdc6h.exe",
        "sha256": "A04E22A4C15E1891CF7D2E13184B00CCE31F6B8B0C316716CE64FB14CE91FC17",
        "sha1": "D1519C61A3FC2A8A36FF4A51716E35BDA9901578"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "BBF3388180B8AD12ACA9017464C82130187150F2746C7E6F37C9102162B2D40A",
        "sha1": "5E24B307F2007AC742513DBD3B9A59C1A96566C7"
      },
      {
        "file_name": "1ssi28.exe",
        "sha256": "AB83573FE4C5210FAF7EA45816EA423FE671F5EADFF7BEAC9228C68D667ED2E7",
        "sha1": "8F365792E4CB02B376E7A87E21782080D34F31E3"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "C1FB482AF0CC3C3C15A66D5337121BC464541FD85691F563E05F88D302F7DF94",
        "sha1": "4D6BC8C64A6AAA746908798AC936A1F5C9CD3EAB"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "B5F794FF6325357A57EACF0F2FFBDC41117544B9B96E4509B0AB590958372BB6",
        "sha1": "2FA3D87B7C009A8E9F192AED1C22848C4DC60315"
      }
    ],
    "page": [
      {
        "file_name": "SupremoHelper",
        "sha256": "4F5B1008F9F1716D0B1A901809F88265188B521EAF5F5B69033A864544CF0E3A",
        "sha1": "F557D9FB6DE4665458A50C089DED7770BA0B63FC"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "976180ED7CF7536991CD96A8DFE21BB9F3CACEFD14E27FD2E7E206327160A3AC",
        "sha1": "6F90C4A5E9CDB5E1A4FE5D86809B98C9A7D96590"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "BD0027622910094ABF789EB4DAEF15663265A0D121ABDAD6CD2B8AA9B5917518",
        "sha1": "4AA193C15EA16A37A14C7A48A7F3B6880D04EAD0"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "5C7955E22A8EC8C6F1BF9F74A70D08766439444353C399924149C604DE8F83DF",
        "sha1": "F33B1E5D75B883C2F4D9CA3F937A3392FAF934BB"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "60AF89DAB29F81EEDE2BB3B4AA287BAA4FEED6E145F53777643073C4677DDE4A",
        "sha1": "FF82C5B53043CA1C60E51F9637FC231E060200CA"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "F50BD54B026EF91466C4279090032D3C6AD9E49D20CB80BFACAA11373C324207",
        "sha1": "FAE7E2788D1B95D8E8A69FC6DFD356C06A9B9DC6"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "39238E2D12C218C0751AC949F5F086D3E3F6A8DF72680BD61D7D17324BFDDA6C",
        "sha1": "32446DBCE30CE08F0AF4A89C5848F4C4185C1ABC"
      },
      {
        "file_name": "xdc6h.exe",
        "sha256": "381C2276013C27DA29F950FBB4C731C4D67BA51F3545C3F0F79DB99E2765AE48",
        "sha1": "16B437426FF24D5F595FC31D3850D2C77E572F1D"
      },
      {
        "file_name": "SupremoHelper",
        "sha256": "8FEADCAA5D785B2CF6E6D0A5492084C115D61ED51ECBEA163C9D3F4C9D1BFADE",
        "sha1": "FF5CBEC1C9CE8F844F19BBDE780A35CD31655A6D"
      },
      {
        "file_name": "SupremoHelper.exe",
        "sha256": "008E862924422FD03971865523A6E690E2F1541C35C741A2D22CE57F00BC9304",
        "sha1": "CAE72609AEC5D5141B02C5B06ED29540C00AFA17"
      }
    ]
  }
}