RAT

Adobe Connect

Adobe Connect is Adobe's virtual meeting, webinar, and training platform. Its desktop application supports Windows and macOS and can be used for screen sharing and remote collaboration. The application communicates with Adobe Connect service domains over HTTPS and WebRTC.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RAT
Research authors: Andrew Weir
Created: 2024-08-02
Last modified: 2026-09-01
Privileges: User
Free / availability: No
Verification required: Adobe's current 64-bit Windows MSI was downloaded from the official Adobe Connect downloads page and inspected statically. The MSI and its embedded ConnectAppSetup.exe both have valid signatures from Adobe Inc. The Anti-Cloud Corporation certificate previously listed here came from a WireSock Secure Connect sample unrelated to Adobe Connect and was removed.
Supported platforms: WindowsmacOS

Capabilities

Virtual meetings and webinarsScreen sharingRemote collaborationFile and content sharingSession recording

Executables & installation paths

Filename: ConnectAppSetup.exe
OriginalFileName: ConnectAppSetup.exe
Description: Connect App Setup
Product: Adobe Connect

Installation paths

ConnectAppSetup*.exe

ConnectShellSetup*.exe

Connect.exe

ConnectDetector.exe

Code signing

signer name: Adobe Inc.
certificate thumbprint: B3E56EED6B5D6A685141BA37C60B2A616A79A77F
issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
valid from: 2025-10-06T00:00:00Z
valid to: 2027-10-05T23:59:59Z
src file sha256: 42a4974d93ae8593e0d5b59b8555aaa1e3dff60f48a41ff4d4dee20a6d211c29
src file path: ConnectAppSetup.exe
src file company: Adobe Inc.

search names

ConnectAppSetup.exe

Connect.exe

ConnectDetector.exe

company names

Adobe Inc.

signer names

Adobe Inc.

File hashes

authenticode

file name
ConnectAppSetup.exe
sha256
ecae61572669a1571a82c3d150654704da3a2be4fac3c4432771547ccbe008dc
sha1
Not recorded

FORENSIC EVIDENCE

Network artifacts

Description

Adobe Connect service domains.

Domains

*.adobeconnect.com

Ports

443
3478

FORENSIC EVIDENCE

Other artifacts

Type: ObservedInstallerSHA256
Value: 70e9cebbf2294d7805f6cda3ad8274aa20164005c8162b748fba6d1265c98c82

Type: ObservedSetupSHA256
Value: 42a4974d93ae8593e0d5b59b8555aaa1e3dff60f48a41ff4d4dee20a6d211c29

Detections

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/adobe_connect_network_sigma.yml
Description: Detects potential network activity of Adobe Connect RMM tool

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/adobe_connect_processes_sigma.yml
Description: Detects potential processes activity of Adobe Connect RMM tool

References

Acknowledgements

Person: Andrew Weir
Handle: @mrajweir