{
  "Name": "Zabbix Agent",
  "Category": "RMM",
  "Description": "Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.zabbix.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "zabbix_agent*.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "user_managed",
          "zabbix.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/zabbix_agent_network_sigma.yml",
      "Description": "Detects potential network activity of Zabbix Agent RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/zabbix_agent_processes_sigma.yml",
      "Description": "Detects potential processes activity of Zabbix Agent RMM tool"
    }
  ],
  "References": [
    "https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "aga.controls.dll",
      "librehardwaremonitorlib.dll",
      "openhardwaremonitorlib.dll",
      "oxyplot.dll",
      "oxyplot.windowsforms.dll",
      "smartctl.exe",
      "zabbix_agent2.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Zabbix SIA"
    ],
    "certificates": [
      {
        "signer_name": "Zabbix SIA",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "6EA7E157D0630DEDEFA9A840B0BC5C48FA0A5E29AAF10F877AF01D348F5C695E",
        "tbs_sha1": ""
      },
      {
        "signer_name": "Zabbix SIA",
        "certificate_thumbprint": "1E158B87803F8F9B4189C62B762EA6E60340D65C",
        "certificate_der_base64": "MIIGXzCCBEegAwIBAgIQAcU4KuX9OB0balShHH6TTjANBgkqhkiG9w0BAQsFADB4MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmluZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI1MDUxMjAxMDgwMFoXDTI3MDUxMjAxMDgwMFowRjELMAkGA1UEBhMCTFYxDTALBgNVBAcMBFJpZ2ExEzARBgNVBAoMClphYmJpeCBTSUExEzARBgNVBAMMClphYmJpeCBTSUEwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCtxxh2tAq+eu50XNYe+wNn2obCnR8pl9ueoEZDP5NPH71Ngda9JFiAPYQ69U3C+CysQjBDcValrJDmURw6au9ogIeHE1o07C4HDXq1TRbuwbvSH6CsXknXWz3Ms8ekALn8tIqiwEN0dTTB6vNAz9Y+WwvUXVKoTk3tJu8+JMsF26f7jB/rcXvG4009qBQp3ENqTxfthK6jc9m0CuqNVkgDo+Iimhg5DD6Yv4gkK7U012SZFvBKtxI8MhyazyVUtcPWkPmvzT+X32UzRyb1r0OlXuC1p4qFzkj2VgSKi8t8pv8vfNgrzFzBnUmu3MpZBjWMRFZ/2X6Ifp3uo3CcCvOVKUe4eJ4AGk6u3qGQ3u0X7rcIOA30gJ4sFfVLJO4e6iVe9nKLAj0PidDcxmy8Fa50Fed4xTNZWmFEmapd/3hZM5jrZQLOHjhXiA9YXbluk0O4CQrCpSk1W7E6zHEP29J5axZNt1OqUptmyh4VW7jQ21e+aXf4/Ci5j10fQv0oUccCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEEbjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJDQS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkwAQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDovL2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYtUjEuY3JsMB0GA1UdDgQWBBRfikuMMYml4VjTlfeLTthXHTn3mjAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBAHqFTiEaNFAg/5JHY5bTWu1uSV+EW0h4jCYIqhDWLHPe5FNp4ovZhcdiKZ8AIAbaOWwoZUaasTaSdJwXwwL5ShRSFq8HJEgCGGCPcz3mn7gzZ4FssOh1wz/AtApANM2mYWvAcRo9T6k3OkmCQSbZQwSKrj1xRI/7aeqDMCWAbtClFPKtPOBm6VmWULhnrOSplbQDK2hr1MSyZKn29WcuRfR+e3XYl11EQY8xdblun7s+T7WFODwym0rbjXc6Omsx8nqgZrUtRN3HPWOBNmgENRstyHfLyNKlgP4Dpd4fmvaCb5Fu9pX2lyOEBe81X0quYNWzs4aCEDATOf/T6FuR5oYuLx/mhFWWbLfSFWsNP8EdTK/H9GrldAD7QFbl34rWbu4SoZU14UqwD7zcWHmurwx1kDuOuPrGUk8XcpTuOF59OE2Do7wZ3rwzrztTCFTv2T197ONOD3qNJuAxzml72BPHY968Mv8hhzSid3D/UrKYFmIWdgHxwIqWXOvmUHlPxChjr3qLlOx82vdsbLQz7PCnaPCA7c4AD6yd3PIemxdExl0kN50N5LPL3RpmNVZT5quXE5EVODL9EnvUcdXMA0fOLYxtwy4fwKssMZK4OuCqlM+qvlHUh+d4RbOxzsrLBiMqgORszJUzgyPvLBJjkCXVhv0WwEisdERX5f3Ccl5r",
        "src_file_sha256": "0b2070c42e42bfad0fb239a25696e4a734de487dd293135121fa3651cb9e826b",
        "src_file_path": "downloaded_files/zabbix_agent/0b2070c42e42bfad0fb239a25696e4a734de487dd293135121fa3651cb9e826b",
        "src_file_company": "Zabbix SIA"
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "OxyPlot.WindowsForms.dll",
        "sha256": "AAC544630C825D295BFCED85667E967E823AA12544EB52522579B5A38DF342C0",
        "sha1": "89CB4FCA740429F4534E2FCB8E169647F9651167"
      },
      {
        "file_name": "OxyPlot.dll",
        "sha256": "6E08EE9F84C21270E37481982FED30520B09CEEAA7D55642ADCCE6766041178E",
        "sha1": "CE298F7684BA74A39C60DFDAC73E933356574DCF"
      },
      {
        "file_name": "LibreHardwareMonitorLib.dll",
        "sha256": "22414271105D103A14DD8AE009BEC293C5BFC575AA23174BDB5690DA08749748",
        "sha1": "0CC5A2BA08CD98DE9CCD23CFD2BB2F83851B31BF"
      },
      {
        "file_name": "OpenHardwareMonitorLib.dll",
        "sha256": "1053E55C0BCC4002F23B383AAB0A038110764104DE4B350CB91FDF88C785E237",
        "sha1": "2622288E737F1486465576E14405FB3333F7D583"
      },
      {
        "file_name": "Aga.Controls.dll",
        "sha256": "01662C51780F895E60CF6B984A3D5BF4BD60A03D7173EE96E486F5296C309248",
        "sha1": "611FFAA90BF81C22A3355D10F70E4C39D75AF7FC"
      },
      {
        "file_name": "smartctl.exe",
        "sha256": "01E17D55620DB645C69573A14E3B5C7E266620B718713C62FEBDC25927D08DD3",
        "sha1": "8541EB7070834867FEC7D08CC32A8E787D220341"
      },
      {
        "file_name": "OpenHardwareMonitorLib.dll",
        "sha256": "3572E4912214422865DA0FF2E120353A52668B7FC88103F574771FBECE2E20FA",
        "sha1": "7377A591EA9B5769E4C08FB52E8DCEBD6FD17667"
      },
      {
        "file_name": "zabbix_agent2.exe",
        "sha256": "25961B16B3486DB34EAB7168EC716C13FD212D6328F038A33F739622370D9E32",
        "sha1": "CD6ABD39A67C99A783BD53979E904AA089E2D0B7"
      }
    ],
    "page": [
      {
        "file_name": "OxyPlot.WindowsForms.dll",
        "sha256": "791C1FD12C47053AF8AE411FAA657E3E0CC2A1B224E8327E030549B95BADA291",
        "sha1": "83BEC1543EC304B9B252822503731A07CC9CA4B1"
      },
      {
        "file_name": "OxyPlot.dll",
        "sha256": "92DCDB288EA627FFE5C68BE5A9F06C87D9003DE3D01391F0FF08C887117F0FDF",
        "sha1": "BD33E6D8EE244397FECCFDCD3E227598BD674E66"
      },
      {
        "file_name": "LibreHardwareMonitorLib.dll",
        "sha256": "B8A575D65CE153E072F2162FF8CC522AF4018DE8BDAC133B56A7B823B48A5CC9",
        "sha1": "93AC73405441317D2ED2667BA83654692AC662B9"
      },
      {
        "file_name": "OpenHardwareMonitorLib.dll",
        "sha256": "BD2512F293B861F85B67EDF56AD39C47C5488983973DEA239DF2AFBBA0E1955A",
        "sha1": "C8A01D4466AAC998103ABA19A3EE8CE3D630F805"
      },
      {
        "file_name": "Aga.Controls.dll",
        "sha256": "BCCD11AEA8A80D912F8C400208E9451DEB2F881EBB581DF05ED79867865BD55C",
        "sha1": "7B3684B99259A5864D12D21EAE35444B9FF7AFD4"
      },
      {
        "file_name": "smartctl.exe",
        "sha256": "8FF105352772CD03FB1EAC780206097E045A2123D50BE2A92AACFCC081521085",
        "sha1": "EE9F07413020B5C0E8EDB73F1F5799520E10608C"
      },
      {
        "file_name": "OpenHardwareMonitorLib.dll",
        "sha256": "FB8C1A22E5E6FA0ADFEF0C55A576E439DE27AF5E7A1F4EFC75004F42B60E49D0",
        "sha1": "5B2B840A237C7EDC46255D94701F7D20750A6378"
      },
      {
        "file_name": "zabbix_agent2.exe",
        "sha256": "787F1315191CEC6E15A3697CA06295C7BCD7D9B05014F295DA9BE93F94098B54",
        "sha1": "1B78645786C5AB77AF255A2CE87A110BE7139DC5"
      }
    ]
  }
}