RAT
Devolutions Remote Desktop Manager
Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RAT
- Research authors
- ogmini
- Created
- 2025-06-02
- Last modified
- 2025-06-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
Android
Linux
Windows
iOS
macOS
Known vulnerabilities
Executables & installation paths
- Filename
- RemoteDesktopManager.exe
- OriginalFileName
- RemoteDesktopManager
- Description
- Not recorded
Installation paths
C:\Program Files\Devolutions\Remote Desktop Manager
*\RemoteDesktopManager.exe
Code signing
- signer name
- Devolutions Inc
- certificate thumbprint
- 8DB5A43BB8AFE4D2FFB92DA9007D8997A4CC4E13
- src file sha256
- b4dc03f646a3212aae9769e146b35bad4d0ddea71807afc97a3494215ecb0219
- src file path
- downloaded_files/devolutions_remote_desktop_manager/b4dc03f646a3212aae9769e146b35bad4d0ddea71807afc97a3494215ecb0219
- src file company
- Devolutions inc.
FORENSIC EVIDENCE
Disk artifacts
- File
- %localappdata%\Devolutions\RemoteDesktopManager\Connections.log
- Description
- Log file showing connections, disconnections, actions on saved passwords and attachments, and other changes
- OS
- Windows
- Example
- [5/20/2025 12:48:58 PM] Entry added - '192.168.0.xx' (RDP (Microsoft Remote Desktop))
- [5/20/2025 12:49:02 PM] Connecting - '192.168.0.xx' (RDP (Microsoft Remote Desktop))
- [5/20/2025 12:49:58 PM] Disconnected - '192.168.0.xx' (RDP (Microsoft Remote Desktop))
- [5/22/2025 11:07:39 AM] Password viewed - '192.168.0.xx' (RDP (Microsoft Remote Desktop))
- File
- %localappdata%\Devolutions\RemoteDesktopManager[GUID]\Mru.xml
- Description
- Most recently used Connections
- OS
- Windows
- File
- %localappdata%\Devolutions\RemoteDesktopManager\Connections.db
- Description
- Default connections database. There can be others. Holds information and configuration about the connections
- OS
- Windows
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/devolutions_remote_desktop_manager_files_sigma.yml
- Description
- Detects potential files activity of Devolutions Remote Desktop Manager RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/devolutions_remote_desktop_manager_processes_sigma.yml
- Description
- Detects potential processes activity of Devolutions Remote Desktop Manager RMM tool
References
Acknowledgements
- Person
- ogmini
- Handle
- https://ogmini.github.io/