RMM
Comodo RMM
Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2025-12-14
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
Windows
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
itsmagent.exe
rviewer.exe
Code signing
- signer name
- Comodo Security Solutions
- certificate thumbprint
- AA6FF933D493EFC39685AC523B7A60748CA98E5C
- tbs sha256
- 45A11A719D1C128EF2666BFE946DB88E2C7ED0AC7B58974D7CAB7EE19D397309
- tbs sha1
- Not recorded
- signer name
- Comodo Security Solutions, Inc.
- certificate thumbprint
- N/A
- tbs sha256
- Not recorded
- tbs sha1
- Not recorded
- tbs sha384
- C9FB3AF5B1058E28F4D4B8C8BF07E975C3C4937B20854E7F2E87AD84B5EEC40304851C772118061825EFC49655B77114
- signer name
- ITarian LLC
- certificate thumbprint
- 83684997F1ACE5AE105E670E8094EDB2AD0879FD
- src file sha256
- 0104e8d061e84b6038d1ae63bd184c30b648dfcf20f1ccef375038cbf415356e
- src file path
- downloaded_files/comodo_rmm/0104e8d061e84b6038d1ae63bd184c30b648dfcf20f1ccef375038cbf415356e
- src file company
- ITarian
search names
itsmagent.exe
company names
signer names
Comodo Security Solutions
Comodo Security Solutions, Inc.
File hashes
- authenticode
- file name
- ITSMAgent.exe
- sha256
- 84BC91D460B280B8A6972B8F777277EDC82395D96E665F32FC2242F752EAC37D
- sha1
- CA2D7EE17FC633F70DB33D24F48DEE3A9C3DA20F
- file name
- ITSMAgent.exe
- sha256
- B75AB2F03350834B9EC34C06CA0A2358CA6B99A708ADEC745680C6E790E82F01
- sha1
- ADA914BBC7166300C4C8942F4339C1E945A946F6
- page
- Not recorded
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- *.itsm-us1.comodo.com
- mdmsupport.comodo.com
- *.mdmsupport.comodo.com
- one.comodo.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/comodo_rmm_network_sigma.yml
- Description
- Detects potential network activity of Comodo RMM RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/comodo_rmm_processes_sigma.yml
- Description
- Detects potential processes activity of Comodo RMM RMM tool