{
  "Name": "WinSCP",
  "Category": "RAT",
  "Description": "WinSCP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://winscp.net/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Users\\IEUser\\Downloads\\WinSCP-5.21.6-Portable\\*",
      "*\\WinSCP*Portable\\*",
      "*\\WinSCP.exe",
      "*\\WinSCP\\*"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": []
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/winscp_processes_sigma.yml",
      "Description": "Detects potential processes activity of WinSCP RMM tool"
    }
  ],
  "References": [],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "39a4d16980a27a88493f519aa458e837856ac60a7037afe10985f8947991ef72-dropped.bin"
    ],
    "company_names": [],
    "signer_names": [
      "Martin Prikryl",
      "RARE IDEAS, LLC"
    ],
    "certificates": [
      {
        "signer_name": "Martin Prikryl",
        "certificate_thumbprint": "FB845245CFBB0EE97E76C775348CAA31D74BEC4C",
        "tbs_sha256": "74EEE4DFE920C6143FD736784DCFB3940980CC4146631D445F9BB116497B16E6",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFeTCCBGGgAwIBAgIQAjJGbclbQOydIdkymr/NXTANBgkqhkiG9w0BAQsFADBsMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBFViBDb2RlIFNpZ25pbmcgQ0EgKFNIQTIpMB4XDTIwMDIxMDAwMDAwMFoXDTIzMDIxNzEyMDAwMFowgZcxEzARBgsrBgEEAYI3PAIBAxMCQ1oxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMREwDwYDVQQFEwg4NzMzMTUxOTELMAkGA1UEBhMCQ1oxDzANBgNVBAcTBlByYWd1ZTEXMBUGA1UEChMOTWFydGluIFByaWtyeWwxFzAVBgNVBAMTDk1hcnRpbiBQcmlrcnlsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArjgofJe/Yqm1CDbY+bsHzq51KVtLZiHMP4vf6u9wNfdsZ93Zr4Z7BS85U/cac0ab7v+zfQSb9SApv8K9heu/s02D/5u1St2NFrW9uztFfZeE9L5Vy7IHhqFAdk1ZDTgM5zkuu1DsK/g81vjYHFulKdCM/4DVO8dXNQiQfU1o1mMMTIh+ygudKvZtRwQdpJUTkKu26Y4HSDYwGTtB/BwzTX1T3TCCCOmGSXaqBNrXgQgfgjAs9Zfa5GCoaQOUo8SlH8emNiVuHzJ4yDixNeiTOLQvJNfLGHAPZShXnrf2BSbYrpBxKCDmucuhMQfgI3VUboR1ohPzZUQ6eRYSLltk7wIDAQABo4IB6TCCAeUwHwYDVR0jBBgwFoAUj+h+8G0yagAFI8dwl2o6kP9r6tQwHQYDVR0OBBYEFB6VJN3DGK95aOAEc/7thaBFoj6lMCYGA1UdEQQfMB2gGwYIKwYBBQUHCAOgDzANDAtDWi04NzMzMTUxOTAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwewYDVR0fBHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0VWQ29kZVNpZ25pbmdTSEEyLWcxLmNybDA3oDWgM4YxaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0VWQ29kZVNpZ25pbmdTSEEyLWcxLmNybDBLBgNVHSAERDBCMDcGCWCGSAGG/WwDAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAcGBWeBDAEDMH4GCCsGAQUFBwEBBHIwcDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEgGCCsGAQUFBzAChjxodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRFVkNvZGVTaWduaW5nQ0EtU0hBMi5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAQEAkACN0vCCRLPCJfpMyMIXIIYysXez4+ODX4xvUQfWZIrCqzvs+d15rK+KrD2YYyQUdf+isBkVGX0jtTT3jP6KQXRZFPo+esnHKv2NPGh3feDRP7w8iSc//PHMD9uuUuGndvIlYaRgqVNlZ4Ne11PKXL8szR1b/6MbkpdK1cbx/zTnG5UY4/oeAIz1CBUqFh6OIVLPO3KrJO5afSjnP0KH5Vq4ha9JzwIWMKgJY22CI8OFgRLMpajNbriLdoXCLWkiM4tvoM/jzrqIOSATO6+cXRF1x0abIGl3mVCL1XfIqdYmrtuHx1m5FOG7uhBdE1sWer7yEGdvHzDGZOCZFPW7Uw=="
      },
      {
        "signer_name": "Martin Prikryl",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "",
        "tbs_sha1": "D2F63F6BE83E61B9E64E25752802F7F06F8B5BE5"
      },
      {
        "signer_name": "Martin Prikryl",
        "certificate_thumbprint": "0DEE8F52D6B8D8C4B2C9573F4299FD97D707BAB7",
        "tbs_sha256": "C90767BFCA208A4FC3C990310D616C50B6E79AE77085E46A53EFA484A4E142F6",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIHujCCBaKgAwIBAgIQBCkuRRJQlv5tV6t8ZIqhGDANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIyMTEyNDAwMDAwMFoXDTI2MDIxNzIzNTk1OVowgZcxEzARBgsrBgEEAYI3PAIBAxMCQ1oxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMREwDwYDVQQFEwg4NzMzMTUxOTELMAkGA1UEBhMCQ1oxDzANBgNVBAcTBlByYWd1ZTEXMBUGA1UEChMOTWFydGluIFByaWtyeWwxFzAVBgNVBAMTDk1hcnRpbiBQcmlrcnlsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuIXbaPyJDi84EHP2GMrWcxAq2Zg/s2IzaPxHsdnzxk5vGZ3q3ce6EGf/7h9xUmwO/s9EnS1N1ZMmtFzhuGlDOp3ZPH/WC1jrMMfp2DNnF1S0WrV4q+5QdFJrr8G/y3TzdXWSNgQoLR0DZRaM62m09sutjMmOvNk0EJunyFqglo6LbahDrY0mEwqAqIPDaFO2wuQBThx2IfQ/bSbwH9C3mIJs37KY52RJetGtKOmJGsoPpGFXfYnobZF4eboWfQvJrmVwqpbqswwgyQctLjCrKEV2setVzdtlLw0U3TsPFMWrJ7hgeYSk3bxm9aG8PbDu094enicI0x6h7jzuVN+10aweNg1FBydZivnS8ZQSothtZ9hLnEaWoOAplte+/FPs8qKkbtfrl56VongXOCO8HS5iiLTkQ4/gR5IGkCXba0fVufrIWB/Ex0QUOTaCcDyqufu5RLdNnAGsXsW0a0req72iY/FE1HQwOCXS6ZEdXZjkmjWbuG/LRwelbLq5sYLqUnb2/A37b7B4r8hAq0MdC9KNt7B1gdk1UPIo7l3SBrymEsfHPrTHCVbpChPx6IdGpkV5e7PtdfYJQ2br3TI3chU+iH7Gr9xu1Ax4yoelZjhUxA9FA6O2bYXiLBj1BuEzGeCbuYnk6YjHVPVU7WLpHO6/2BZDYiCIhv9/j0J6cPkCAwEAAaOCAi0wggIpMB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBROB3f3JYIcV2gOaq0AN3CCC/WFuzAmBgNVHREEHzAdoBsGCCsGAQUFBwgDoA8wDQwLQ1otODczMzE1MTkwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMIG1BgNVHR8Ega0wgaowU6BRoE+GTWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFOgUaBPhk1odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCBlAYIKwYBBQUHAQEEgYcwgYQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBcBggrBgEFBQcwAoZQaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAcDtIqZsbEBbnaaNj0e0Hu7Cvk+f9n8W5gXO855wLhMpDpTXVhw1h2gXU3emiA6Jp3Ng5cCTf7SDIt78Eykk+NMOy72o+p2lnkN9Lv9Owrepk6leCYx2dQEFZYGgi3xwOZsoW5dCYY+7/ILwfbDikTclNuG3PoXKjmnNBhwfP8iyiDs6Z80NJnPI+6UXGFekuA1/QERk6IkvwvL10kC26z5n+dIyBKUsRrFzrCyI8CNNljUrlap420fXz+NMPDj3lnC3SnUp1SACl8yUnQnRa6bPf3gYwe1/G9RcIf1ETsmN1lbRhF1nRD+SO+fcrh4CgGJftcxvdusjvDzJWJplDGl0fdsWBy7X+oR+vT5zXx+mW6M1kzcuTPOjkPxTAK5kHGqgCH0j02quq12eoH9qOsdJ89PpDEjHTvr9Wgr+fead3FCLRi564AmCHtrfAgysa0rCnqJsuprQXWxu6Z14oTSMp97EF7iQpE956+XsEjXzVZAi4mwLvcEvBceqXFt2ewdY8Qbfs8DmB/8e70Y+3tD/SpBcrgUmDbfh73RP1Yli08S+4BPZ41eRHCKyXo+pU0DQNzfmgk7aY8UOgS9KxTbdtzb6IjKxVgfjrAiszorb8JfOr9scxoBNQstqfbBSCjz+YyVM11S9ei/JVZnu9d3x+JmHYeRtbyYqOQOFspbA="
      },
      {
        "signer_name": "RARE IDEAS, LLC",
        "certificate_thumbprint": "436F0AAD2181EDA5B606CA9BDD8D7B259833306A",
        "tbs_sha256": "791D415EAA0D30EEC874E1CC045F5076A41C741F792D6B9789F7E28DFB9127BD",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIHQjCCBSqgAwIBAgIMFzUIrHJ2QYffAytYMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS8wLQYDVQQDEyZHbG9iYWxTaWduIEdDQyBSNDUgQ29kZVNpZ25pbmcgQ0EgMjAyMDAeFw0yNTAyMTcxNTE1MzRaFw0yNjAzMjAxNTE1MzRaMIGNMQswCQYDVQQGEwJVUzERMA8GA1UECBMITmV3IFlvcmsxETAPBgNVBAcTCE5ldyBZb3JrMRgwFgYDVQQKEw9SQVJFIElERUFTLCBMTEMxGDAWBgNVBAMTD1JBUkUgSURFQVMsIExMQzEkMCIGCSqGSIb3DQEJARYVY29udGFjdEByYXJlaWRlYXMuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwdJNsgxNiWGR4ycWFG03sWEY6itLoinKU9FkZIm+p4ftk44gmFZP/tVzXBcvnfhqiVodPHD5sgsGsczDBVaUWM7oQdHJUSmd+MDn5xBiX81nN9PMLpn3+nN7cy2C4Oh/qFG8SMO2lA3xKQqewq8L/wZrjp8bNRXirlyBuYoWNzVrTCzPNEROPjAxsBmeSajBpLcvgw72dUdT87z6yXVtxHBfWs3JcR3UqJqd1ojTqbcqYsh3oud9fOYXARNlgCfJY4aMRZUG9sAMwvJjJn6zjvkXmvaD1EVBGvWNaETyBxdDdG6YGu0qMilTzOXnjJNpiVsaT091oo/RSGjQpJHrROlV9I/0R7OxorU/mwHZZL8h6y+pMycBs9/n2kzLv+BPMFQScXt7NA4NQrR44fcEdMzqTxzg43DUSZ6CuXTEYWcjfB1shpMmpt+uvTaDLnvmiNFtN9sxVUilVZY92tUnuTwTLl/gOeLxc9jkt3jppEWA50wJTidREdHhWNuJ4oDm4o/y+MUdH21gH8LMkE26VVtDy3nGEM8QFVNu8lRrixE12aOHbBFexDXu/AX2bI5dma4/WLWdGl3yu5BGAkpOxTShPqaJeIwvb3pjZM08dToCVtpBdAUltuBodih/mxBaSoOT2yegz5ZKwbQZWzoq/b+OC2IXFwYTkGs3m58M/CMCAwEAAaOCAdMwggHPMA4GA1UdDwEB/wQEAwIHgDCBmwYIKwYBBQUHAQEEgY4wgYswSgYIKwYBBQUHMAKGPmh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZ2NjcjQ1Y29kZXNpZ25jYTIwMjAuY3J0MD0GCCsGAQUFBzABhjFodHRwOi8vb2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3I0NWNvZGVzaWduY2EyMDIwMFYGA1UdIARPME0wQQYJKwYBBAGgMgEyMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMAgGBmeBDAEEATAJBgNVHRMEAjAAMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NnY2NyNDVjb2Rlc2lnbmNhMjAyMC5jcmwwIAYDVR0RBBkwF4EVY29udGFjdEByYXJlaWRlYXMuY29tMBMGA1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFNqzjcAkkKNrd9MMoFndIWdkdgt4MB0GA1UdDgQWBBTerYhWpShkjFXZKdIV9A31cublrDANBgkqhkiG9w0BAQsFAAOCAgEABKpHoIZsZ9IrHlLVIHdMg+BmTb24YVApKRbNXp1a+x3lvZ0uBVOrWY7ao97UmQpv1vhS4r6TJ6yhgcDVu/aqvfhk+BZV3soP0lheJPqluhLlpqLYXfYEuGXe3OsKvD7EO3CbZTztAhB9W9YqKlBsTsMEdjaqWPCqKSk81gn6iCyNX+gr9dzzIUno9oAlb5WPUgTdK53O+HcxPbadsQgXMEemVwwNtnsMswPYjqvHENC2yQRmJNUIHt5vjcGn/v+5Y96H/gqVEHs5VNSVNJ1W4s5BImLid9vj2MjTVQWp98um2Uf3chi5BimcCNUnKq/raLqByA71u/yHJY9iVPzefN7PxtzE/mf+ySzBZsif3YcmmBuARXVlmORTCmBoryYxjyEf2qrINvBtS8auT/OL+63wt/NI/T9FhnZBf49u4EVRiUTiltDYO61/dgvSXv5PbIsFHa7Wm3G2HiDjTXnQ5lohO6P59V7WDlJLRj/rrnFnNj/Q5hfCU0SKlZUa3I4Ry19lBItmMSMXvtIOuzrhhr6T5GEFg7TQvPSNLEyfHIqK1rtZPj/PL0o3kBM2pQmynOTi40UpmAzNAR4F8OyhnpHrTzSiopmQg1MbOd/IaX2ZAxiaKAEgWKmcCR4yst5/wWpRfl2ggZCBu3hurHsqIfDeGfbVPA13AXMW3chyIzU="
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "39a4d16980a27a88493f519aa458e837856ac60a7037afe10985f8947991ef72-dropped.bin",
        "sha256": "39A4D16980A27A88493F519AA458E837856AC60A7037AFE10985F8947991EF72",
        "sha1": "6AA74A53453EBA483CF564C22129763D9D96FB07"
      }
    ],
    "page": []
  }
}