RMM
GoToAssist
GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2024-08-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
Windows
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
gotoassist.exe
g2a*.exe
GoTo Assist Opener.exe
g2mcomm.exe
g2mupdate.com
goto opener.exe
g2ax_comm_customer.exe
Code signing
- signer name
- GoTo Technologies USA, LLC
- certificate thumbprint
- 33023C0243016946C78CCB9B15AC6C203882E5D9
- src file sha256
- a15638d6c615001cc15d1a4d382593dc3ddd62d4ae98691ae43e5845f468c380
- src file path
- downloaded_files/gotoassist/a15638d6c615001cc15d1a4d382593dc3ddd62d4ae98691ae43e5845f468c380
- src file company
- GoTo, Inc.
- signer name
- GoTo Technologies USA, LLC
- certificate thumbprint
- 8D3FA6EEEBFC68A0FA76CDC4C6AD5982FE07DE91
- src file sha256
- df63edd5e58d2f1dbefc24dc863eeb3e7b4d8f6002dc9b5cf69a847e831d3cd2
- src file path
- downloaded_files/gotoassist/df63edd5e58d2f1dbefc24dc863eeb3e7b4d8f6002dc9b5cf69a847e831d3cd2
- src file company
- GoTo
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- goto.com
- *.getgo.com
- *.fastsupport.com
- *.gotoassist.com
- helpme.net
- *.gotoassist.me
- *.gotoassist.at
- *.desktopstreaming.com
- *.cdn.getgo.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/gotoassist_network_sigma.yml
- Description
- Detects potential network activity of GoToAssist RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/gotoassist_processes_sigma.yml
- Description
- Detects potential processes activity of GoToAssist RMM tool