RMM
AnyViewer
AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- @kostastsale
- Created
- 2024-08-03
- Last modified
- 2024-08-03
- Privileges
- System
- Free / availability
- up to 10 devices
- Verification required
- None
- Supported platforms
Windows
Capabilities
Executables & installation paths
- Filename
- AnyViewer.exe
- OriginalFileName
- AnyViewer
- Description
- Splash Window
- Filename
- RCClient.exe
- OriginalFileName
- RCClient.exe
- Description
- AnyViewer Core
- Filename
- ScreanCap.exe
- Description
- Screan capture
- Filename
- AVCore.exe
- Filename
- RCService.exe
Installation paths
C:\Program Files (x86)\AnyViewer\*
Code signing
- signer name
- AOMEI International Network Limited
- certificate thumbprint
- E5132FC7E6BD90602C81BBE92FB064B2CBC73853
- src file sha256
- 4ef164fbedfbd439584d7c692f6ebb9bd9d937af436882c762483303531c5f8d
- src file path
- downloaded_files/anyviewer/4ef164fbedfbd439584d7c692f6ebb9bd9d937af436882c762483303531c5f8d
- src file company
- AOMEI International Network Limited
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 4688
- ProviderName
- Microsoft-Security-Auditing
- LogFile
- Security.evtx
- CommandLine
- "C:\\Program Files (x86)\\AnyViewer\\AVCore.exe" -d
- Description
- Taking actions on the remote machine such as opening a command prompt.
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System.evtx
- ServiceName
- RCService
- ImagePath
- C:\\Program Files (x86)\\AnyViewer\\RCService.exe
- Description
- AnyViewer service installation service.
FORENSIC EVIDENCE
Network artifacts
- Description
- N/A
- Domains
- *.anyviewer.com
- Ports
- 443
- Description
- N/A
- Domains
- *.aomeisoftware.com
- Ports
- 443
Detections
- Name
- Arbitrary code execution and remote sessions via Action1 RMM
- Description
- Threat hunting rule for detecting the execution of arbitrary code and remote sessions via Action1 RMM
- author
- @kostastsale
- Link
- https://github.com/tsale/Sigma_rules/blob/main/Threat%20Hunting%20Queries/Anyviewer.yml
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/anyviewer_network_sigma.yml
- Description
- Detects potential network activity of AnyViewer RMM tool
References
Acknowledgements
- Person
- Kostas
- Handle
- @kostastsale