{
  "Name": "Yandex.Disk",
  "Category": "RAT",
  "Description": "Yandex.Disk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://disk.yandex.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Program Files (x86)\\Yandex\\*",
      "*\\Yandex\\*",
      "*\\YandexDisk2.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": []
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/yandex.disk_processes_sigma.yml",
      "Description": "Detects potential processes activity of Yandex.Disk RMM tool"
    }
  ],
  "References": [],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "YANDEX LLC",
        "certificate_thumbprint": "46E2F09D295573BB09DACC6B209B142C244A30D6",
        "certificate_der_base64": "MIIHejCCBWKgAwIBAgIMbxJsnMKH3kWM6JD2MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDEylHbG9iYWxTaWduIEdDQyBSNDUgRVYgQ29kZVNpZ25pbmcgQ0EgMjAyMDAeFw0yNDAzMjAxNDIzMzVaFw0yNjAzMjExNDIzMzVaMIHfMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjEWMBQGA1UEBRMNMTAyNzcwMDIyOTE5MzETMBEGCysGAQQBgjc8AgEDEwJSVTEXMBUGCysGAQQBgjc8AgECEwZNb3Njb3cxCzAJBgNVBAYTAlJVMQ8wDQYDVQQIEwZNb3Njb3cxDzANBgNVBAcTBk1vc2NvdzEfMB0GA1UECRMWTGV2IFRvbHN0b3kgc3RyZWV0LCAxNjETMBEGA1UEChMKWUFOREVYIExMQzETMBEGA1UEAxMKWUFOREVYIExMQzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJBHNIDwuoQRAKsgUHdZAJj95E+tdlQ7Lq7of/skuDP1yn8fETp1arC7JWBK7cweYF2L4oMZDkLaenMe6LSebe4RODrBmJUExwZFCsF2yDbw0EqakrTzeQ3sUjTrBIpcgZiemfFx8kvkHMr7R/XoJx4abhWt5BPa2LidgcskEdmw2KUntRshuIBilg2GR8Oa6s0BZhMxgAE0Ugqw66mWNJWOp+//FwKwoNwtmWceBc7XAkyVK2rCdkaQ9YYJRmw3lGRP7+yLj/cH9I1ALO321j0iYYSoT+4M9ASIzGPZr+EaeE+i07RnUlkiqTntaeQ95Z1lofZ7RDGoIaEfmNU7pB0ecR02NI9UBc31Y6/XEJllauzN8gylSieS0yrS+qa+AsWHrE5wo4umNEHeQYeSpJASIjQwehHXEWbGgoxoCYs6l8HE/F3M2M0vE0Oh1P+UM/jN+ILlrgZN/Fs6w7IntZhBMG9Bz2H9DewILSCz4Naei1HENGK2Fcr+zmoeBxKeOp+NUwgM2dDiuJSQAnLIycwtPXtKUMQDeRiCVHJXupi9junpnVR5GMx3oYrvrZGK7odjUUiuRn8BSON0ixs8pQ94ktyNUFEquL8VATxzUpaai6es+T+DYsJf+BPMLvl1MbspaJ1q57Zyqb3gFW4ON9SaXKZXPCQuWp8uzHTYPkynAgMBAAGjggG2MIIBsjAOBgNVHQ8BAf8EBAMCB4AwgZ8GCCsGAQUFBwEBBIGSMIGPMEwGCCsGAQUFBzAChkBodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2djY3I0NWV2Y29kZXNpZ25jYTIwMjAuY3J0MD8GCCsGAQUFBzABhjNodHRwOi8vb2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3I0NWV2Y29kZXNpZ25jYTIwMjAwVQYDVR0gBE4wTDBBBgkrBgEEAaAyAQIwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQMwCQYDVR0TBAIwADBHBgNVHR8EQDA+MDygOqA4hjZodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMC5jcmwwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAUJZ3Q/FkJhmPF7POxEztXHAOSNhEwHQYDVR0OBBYEFIoN3UJm6MH5Dcw75olDsIF2PuioMA0GCSqGSIb3DQEBCwUAA4ICAQBW4Fq2bcUZm0lsDoFiMyHUNa80jEdmkAzGkEHXnJowhdJwoMgwYxP3c6/cMCMV7tm10gXpeOI6Yf0DIgLz6Xl0qsBIEjK/TxXCQanEvo4qbtZpWbpzfHi+alW3QZv/aKny1sU7MDfedTYWZWd15mvog8uyFx0fvJx3uZOQa/ho/YwgJfNDBkhpqvekTcsu3zakJvstcT4dFFTsvESCWeDFujhLZKi62Ep8g3A06MDBCAePyhhdavDQ/NP0ozZxp/sz23RxsSBHZHRFJgfNOF51m2pN/+q5GeFPXKDCbMZNyec7OrGThkaDyG7ioVdiwSfhpG/QZtZjv3WI86vvBDCvlxwKQ7mXp8HAzn3I/LDhAJcyXTWgtKaKmeOelhWV8Ba2dLJbQ5PYH7fNUNuEjRm9IpXbmH2cK52D6WNKQh14gJfbib9xrbw5c44lZPS33IkIDckfi7mg8299yuSawwhUjk8YBLN1aQfFrfAlm2FoN/XzqDG8rzEcDjt4/D0Rf/1denTDbC/cnkmv8w82RvxhoWJwSGpLbW0HyVaLlXpbBbc25xpFTZzxJ74rctdXHbWD9rOZtkZgfmCyBwquGFG2dKkeg0bBXVFn71pYsSCsJek9pBZ0yReSUnI6Y3IT5l8SkkNeCcl4zHeF8fdbHydTXHqjDiYOvXqZfHz5AVnpjQ==",
        "src_file_sha256": "b4de5a3d4ac1c70fdc0c498e3248389392d80efc4fb3a8fb67435f79da830199",
        "src_file_path": "downloaded_files/yandex.disk/b4de5a3d4ac1c70fdc0c498e3248389392d80efc4fb3a8fb67435f79da830199",
        "src_file_company": "Yandex"
      }
    ]
  }
}