RMM

ControlR

ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RMM
Research authors: Swachchhanda Shrawan Poudel
Created: 2026-08-17
Last modified: 2026-08-18
Privileges: SYSTEM/root
Free / availability: Yes
Verification required: Code-signed by Bitbound
Supported platforms: LinuxWindowsmacOS

Capabilities

Remote desktop managementRemote desktop viewFile transferCommand executionActivity monitoring

Executables & installation paths

Filename: ControlR.Agent.Installer.exe
OriginalFileName: ControlR.Agent.Installer.dll
Description: ControlR.Agent.Installer
Product: ControlR.Agent.Installer

Filename: ControlR.Agent.exe
OriginalFileName: ControlR.Agent.dll
Description: ControlR.Agent
Product: ControlR.Agent

Filename: ControlR.DesktopClient.exe
OriginalFileName: ControlR.DesktopClient.dll
Description: ControlR.DesktopClient
Product: ControlR.DesktopClient

Installation paths

C:\Program Files\ControlR\*\ControlR.Agent.exe

C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.exe

C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.dll

C:\ProgramData\ControlR\

/usr/local/bin/ControlR/*

/Library/Application Support/ControlR/*

/Applications/ControlR.app

/Applications/ControlR.*.app

FORENSIC EVIDENCE

Disk artifacts

File: *\ControlR.Agent.Installer.exe
Description: ControlR agent installer dropped and executed by threat actors.
OS: Windows

File: C:\Program Files\ControlR\*\ControlR.Agent.exe
Description: ControlR agent binary installed on Windows.
OS: Windows

File: C:\ProgramData\ControlR\*\appsettings.json
Description: ControlR agent configuration file on Windows.
OS: Windows

File: C:\ProgramData\ControlR\*\Logs\ControlR.Agent\LogFile*.log
Description: ControlR agent log files on Windows.
OS: Windows

File: C:\ProgramData\ControlR\*\Logs\ControlR.DesktopClient\LogFile*.log
Description: ControlR desktop client log files on Windows.
OS: Windows

File: /usr/local/bin/ControlR/*/ControlR.Agent
Description: ControlR agent binary installed on Linux.
OS: Linux

File: /etc/controlr/*/appsettings.json
Description: ControlR agent configuration file on Linux (root).
OS: Linux

File: /etc/systemd/system/controlr.agent*.service
Description: ControlR agent systemd service unit file on Linux.
OS: Linux

File: /var/log/controlr/*/ControlR.Agent/LogFile*.log
Description: ControlR agent log files on Linux (root).
OS: Linux

File: ~/.controlr/*/logs/ControlR.Agent/LogFile*.log
Description: ControlR agent log files on Linux (user context).
OS: Linux

File: /Library/Application Support/ControlR/*/ControlR.Agent
Description: ControlR agent binary installed on macOS.
OS: MacOS

File: /Applications/ControlR.app
Description: Default ControlR desktop client app bundle on macOS.
OS: MacOS

File: /Applications/ControlR.*.app
Description: Instance-specific ControlR desktop client app bundle on macOS.
OS: MacOS

File: /Library/LaunchDaemons/app.controlr.agent*.plist
Description: ControlR agent launchd plist files on macOS.
OS: MacOS

File: /Library/LaunchAgents/app.controlr.desktop*.plist
Description: ControlR desktop client launchd plist files on macOS.
OS: MacOS

File: /var/log/controlr/*/ControlR.Agent/LogFile*.log
Description: ControlR agent log files on macOS (root).
OS: MacOS

File: ~/.controlr/*/logs/ControlR.Agent/LogFile*.log
Description: ControlR agent log files on macOS (user context).
OS: MacOS

FORENSIC EVIDENCE

Registry artifacts

Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ControlR
Description: Default ControlR uninstall registry key on Windows.

Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ControlR (*)
Description: Instance-specific ControlR uninstall registry key on Windows.

FORENSIC EVIDENCE

Network artifacts

Description

ControlR agent installer is downloaded from the official demo tenant domain.

Domains

demo.controlr.app

Ports

References

Acknowledgements

Person: Swachchhanda Shrawan Poudel
Handle: @_swachchhanda_