RMM

Atera

Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RMM
Research authors: Not recorded
Created: 2024-08-03
Last modified: 2026-06-16
Privileges: SYSTEM
Free / availability: 30 day trial
Verification required: None
Supported platforms: LinuxWindowsmacOS

Capabilities

Integrated remote access with Splashtop and AnyDeskRemote monitoring and managementPatch managementNetwork discoveryBackup and disaster recoveryHelpdesk and ticketingReporting and analyticsBilling and invoicingCustomer portalMobile app

Known vulnerabilities

CVE-2023-26078
CVE-2023-26077

Executables & installation paths

Filename: AteraAgent.exe
OriginalFileName: AteraAgent.exe
Description: AteraAgent

Installation paths

*\AgentPackageNetworkDiscovery.exe

*\AgentPackageTaskScheduler.exe

*\ATERA Networks\AteraAgent\*

*\AteraAgent.exe

atera_agent.exe

ateraagent.exe

C:\Program Files\ATERA Networks\AteraAgent\*

C:\Program Files\Atera Networks

C:\Program Files (x86)\Atera Networks

syncrosetup.exe

Code signing

signer name: Atera Networks Ltd
certificate thumbprint: E2D5CC46541C8FC8E9E619175516C5616B84D8D8
tbs sha256: C81C87870D6F0DD87F6E02E5D6EE09886DE73BECB81B06A3C92626E24F174A3D
tbs sha1: Not recorded

signer name: Atera Networks Ltd
certificate thumbprint: 7908DDC749BBCA22273E8CB58101BAC915E9B8D9
tbs sha256: 97D2940D1BA0DBAF84280371A267A1BC689DEC0E224010EC7963D9DE45A5BCD1
tbs sha1: Not recorded

signer name: .NET
issuer: CN=Microsoft Code Signing PCA 2011
certificate thumbprint: 860AB2B78578D8EF61F692CF81AE4B1198CCBC94
tbs sha256: 7F0D0E92811AC3A99C25B3DDA0BDDEFA767475CF8FD22D3496CBF79F92B11878
tbs sha1: 3D04A28E763E746DBBE3D2F8485AA3A6D114E1F4
valid from: 2025-09-18T17:58:59+00:00
valid to: 2026-07-06T17:58:59+00:00

search names

agentpackagenetworkdiscovery.exe

agentpackagetaskscheduler.exe

atera_agent.exe

ateraagent.exe

syncrosetup.exe

company names

signer names

.NET

Atera Networks Ltd

FORENSIC EVIDENCE

Disk artifacts

File: C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRunCommandInteractive\log.txt
Description: N/A
OS: Windows

File: C:\Program Files\ATERA Networks\AteraAgent\Packages\*
Description: N/A
OS: Windows

File: C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
Description: Atera service binary
OS: Windows

File: C:\Program Files\Atera Networks\AlphaAgent.exe
Description: Atera service binary
OS: Windows

File: C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
Description: N/A
OS: Windows

File: C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
Description: N/A
OS: Windows

File: C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
Description: N/A
OS: Windows

File: C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageFileExplorer\AgentPackageFileExplorer.exe
Description: N/A
OS: Windows

File: C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRunCommandInteractive\AgentPackageRunCommandInteractive.exe
Description: N/A
OS: Windows

FORENSIC EVIDENCE

Event log artifacts

EventID: 7045
ProviderName: Service Control Manager
LogFile: System.evtx
ServiceName: AteraAgent
ImagePath: "C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\AteraAgent.exe"
Description: Service installation event as result of AteraAgent installation.

EventID: 7045
ProviderName: Service Control Manager
LogFile: System.evtx
ServiceName: WinRing0_1_2_0
ImagePath: "C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageMonitoring\\OpenHardwareMonitorLib.sys"
Description: Service installation event as result of Atera pakcage manager installation.

EventID: 11707
ProviderName: MsiInstaller
LogFile: Application.evtx
Data: Product: AteraAgent -- Installation completed successfully.
Description: Service installation event as result of AteraAgent installation.

EventID: 4697
ProviderName: Microsoft-Security-Auditing
LogFile: Security.evtx
CommandLine: C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageFileExplorer\\AgentPackageFileExplorer.exe XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX agent-api.atera.com/Production 443 [BASE64BLOB]
Description: Service installation event as result of AteraAgent installation.

FORENSIC EVIDENCE

Registry artifacts

Path: HKLM\SOFTWARE\ATERA Networks\AlphaAgent
Description: Not recorded

Path: HKLM\SYSTEM\CurrentControlSet\Services\AteraAgent
Description: Not recorded

Path: KLM\SOFTWARE\WOW6432Node\Splashtop Inc.
Description: Not recorded

Path: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Splashtop Software Updater
Description: Not recorded

Path: HKLM\SYSTEM\ControlSet\Services\EventLog\Application\AlphaAgent
Description: Not recorded

Path: HKLM\SYSTEM\ControlSet\Services\EventLog\Application\AteraAgent
Description: Not recorded

Path: HKLM\SOFTWARE\Microsoft\Tracing\AteraAgent_RASAPI32
Description: Not recorded

Path: HKLM\SOFTWARE\Microsoft\Tracing\AteraAgent_RASMANCS
Description: Not recorded

Path: HKLM\SOFTWARE\ATERA Networks\*
Description: Not recorded

FORENSIC EVIDENCE

Network artifacts

Description

N/A

Domains

pubsub.atera.com

Ports

Not recorded

Description

N/A

Domains

agentreporting.atera.com

Ports

Not recorded

Description

N/A

Domains

getalphacontrol.com

Ports

Not recorded

Description

N/A

Domains

app.atera.com

Ports

Not recorded

Description

N/A

Domains

agenthb.atera.com

Ports

Not recorded

Description

N/A

Domains

packagesstore.blob.core.windows.net

Ports

Not recorded

Description

N/A

Domains

agent-api.atera.com

Ports

Not recorded

Description

N/A

Domains

agentreportingstore.blob.core.windows.net

Ports

Not recorded

Description

N/A

Domains

atera-agent-heartbeat.servicebus.windows.net

Ports

Not recorded

Description

N/A

Domains

ps.atera.com

Ports

Not recorded

Description

Atera-specific PubNub tenant subdomain (CNAME api-tls11.pubnubapi.com) used by the AteraAgent for real-time tenant messaging. Distinct from the generic pubsub.pubnub.com / ps.pndsn.com PubNub multi-tenant infrastructure (shared by thousands of unrelated apps), this `atera.`-prefixed subdomain is reliable Atera-attribution signal.

Domains

atera.pubnubapi.com

Ports

Not recorded

Description

N/A

Domains

appcdn.atera.com

Ports

Not recorded

Detections

Sigma: https://github.com/The-DFIR-Report/Sigma-Rules/blob/d67407d357ad32b247e2a303abc5a38bb30fd576/rules/windows/process_creation/proc_creation_win_ateraagent_malicious_installations.yml
Name: AteraAgent malicious installations
Description: Detects AteraAgent installations with suspicious command line arguments.

Sigma: https://github.com/SigmaHQ/sigma/blob/782f0f524e6f797ea114fe0d87b22cb4abaa6b7c/rules/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml
Name: Atera Agent Installation
Description: Detects Atera Agent installation.

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/atera_registry_sigma.yml
Description: Detects potential registry activity of Atera RMM tool

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/atera_network_sigma.yml
Description: Detects potential network activity of Atera RMM tool

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/atera_files_sigma.yml
Description: Detects potential files activity of Atera RMM tool

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/atera_processes_sigma.yml
Description: Detects potential processes activity of Atera RMM tool

References

Acknowledgements

Person: Théo Letailleur
Handle: in/theosyn

Person: Nasreddine Bencherchali
Handle: @nas_bench

Person: Kostas
Handle: @kostastsale