RMM
Gorelo RMM
Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration.
Tool overview
- Category
- RMM
- Research authors
- Jean-Marc ALBERT
- Created
- 2025-11-13
- Last modified
- 2025-11-13
- Privileges
- User
- Free / availability
- No
- Verification required
- No
- Supported platforms
Windows
macOS
Capabilities
Executables & installation paths
- Filename
- Gorelo.Rmm.Setup.exe
- OriginalFileName
- Gorelo.Rmm.Setup.exe
- Description
- Gorelo RMM
- Product
- Gorelo RMM
Installation paths
C:\Program Files\Gorelo\*
Code signing
- signer name
- GORELO TECH, INC.
- certificate thumbprint
- A607C45B264B698F88B0CFBB40553D223E8B7032
- src file sha256
- caa0721604c85d2779f2d5dfebd2a1f3203d11585231288f254d84d9544c7ce0
- src file path
- downloaded_files/gorelo_rmm/caa0721604c85d2779f2d5dfebd2a1f3203d11585231288f254d84d9544c7ce0
- src file company
- Gorelo.Rmm.Setup
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.AppManagement.zip
- Description
- Gorelo Agent Plugin - App Management
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.DeviceChat.zip
- Description
- Gorelo Agent Plugin - Device Chat
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.IpAddressDetector.zip
- Description
- Gorelo Agent Plugin - IpAddress Detector
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.ScreenCapture.zip
- Description
- Gorelo Agent Plugin - Screen Capture
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.ScriptRunner.zip
- Description
- Gorelo Agent Plugin - Script Runner
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.ServerMonitor.zip
- Description
- Gorelo Agent Plugin - Server Monitor
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.ShellCommand.zip
- Description
- Gorelo Agent Plugin - Shell Command
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.SystemProfiler.zip
- Description
- Gorelo Agent Plugin - System Profiler
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.SystemSecurityManagement.zip
- Description
- Gorelo Agent Plugin - System Security Management
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.WindowsChecker.zip
- Description
- Gorelo Agent Plugin - Windows Checker
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Plugins\Downloads\Gorelo.RemoteManagement.WindowsPatchManagement.zip
- Description
- Gorelo Agent Plugin - Windows Patch Management
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\RMMAgent\Gorelo.RemoteManagement.Agent\Gorelo.RemoteManagement.Agent.exe
- Description
- Gorelo RMM Agent executable
- OS
- Windows
- File
- C:\Program Files\Gorelo\Agent\Shell\Gorelo.RemoteManagement.Shell\Gorelo.RemoteManagement.Shell.exe
- Description
- Gorelo RMM Shell executable
- OS
- Windows
- File
- C:\Program Files\Gorelo\Installer\Downloads\Gorelo.RemoteManagement.Agent.zip
- Description
- Installer Download - Agent package
- OS
- Windows
- File
- C:\Program Files\Gorelo\Installer\Downloads\Gorelo.RemoteManagement.Shell.zip
- Description
- Installer Download - Shell package
- OS
- Windows
- File
- C:\Program Files\Gorelo\Installer\Downloads\Gorelo.Rmm.Installer.Handler.zip
- Description
- Installer Download - Handler package
- OS
- Windows
- File
- C:\Program Files\Gorelo\Installer\Downloads\Gorelo.Rmm.Installer.zip
- Description
- Installer Download - Installer package
- OS
- Windows
- File
- C:\Program Files\Gorelo\Installer\Gorelo.Rmm.Installer.Handler\Gorelo.Rmm.Installer.Handler.exe
- Description
- RMM Installer Handler executable
- OS
- Windows
- File
- C:\Program Files\Gorelo\Installer\Gorelo.Rmm.Installer\Gorelo.Rmm.Installer.exe
- Description
- RMM Installer executable
- OS
- Windows
- File
- C:\Program Files\Gorelo\LogFiles\Agent\diagnostics-*.txt
- Description
- Diagnostics logs for the Agent component
- OS
- Windows
- File
- C:\Program Files\Gorelo\LogFiles\Installer\diagnostics-*.txt
- Description
- Diagnostics logs for the Installer component
- OS
- Windows
- File
- C:\Program Files\Gorelo\LogFiles\InstallerHandler\diagnostics-*.txt
- Description
- Diagnostics logs for the InstallerHandler component
- OS
- Windows
- File
- C:\Program Files\Gorelo\LogFiles\Shell\diagnostics-*.txt
- Description
- Diagnostics logs for the Shell component
- OS
- Windows
FORENSIC EVIDENCE
InstallationPaths artifacts
C:\Program Files\Gorelo\Agent\*
FORENSIC EVIDENCE
Network artifacts
- Description
- Called during access to remote control WebGUI access
- Domains
- app.gorelo.io
- Ports
- 443
- Description
- Called during setup
- Domains
- gorelo-rmm.azurewebsites.net
- Ports
- 443
- Description
- Called during setup
- Domains
- gw.usw.gorelo.tech
- Ports
- 443
- Description
- Called during setup
- Domains
- lr.rmm.pod1.usw.gorelo.tech
- Ports
- 443
- Description
- Called during setup
- Domains
- public.rmm.pod1.usw.gorelo.tech
- Ports
- 443
- Description
- Called during setup
- Domains
- r1.rmm.uw.gorelo.tech
- Ports
- 443
- Description
- Called during setup
- Domains
- sr.rmm.pod1.usw.gorelo.tech
- Ports
- 443
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/gorelo_rmm_network_sigma.yml
- Description
- Detects potential network activity of Gorelo RMM RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/gorelo_rmm_files_sigma.yml
- Description
- Detects potential files activity of Gorelo RMM RMM tool
References
Acknowledgements
- Person
- Squiblydoo
- Handle
- https://github.com/Squiblydoo
- Person
- Jean-Marc ALBERT
- Handle
- in/jeanmarcalbert