RMM
Miradore
Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access.
Tool overview
- Category
- RMM
- Research authors
- Michael Haag
- Created
- 2026-01-15
- Last modified
- 2026-01-15
- Privileges
- SYSTEM
- Free / availability
- Free tier available
- Verification required
- Code-signed by Sectigo
- Supported platforms
Android
Linux
Windows
iOS
macOS
Capabilities
Executables & installation paths
- Filename
- StatementView.msi
- OriginalFileName
- Not recorded
- Description
- Miradore installer MSI (observed renamed in phishing campaigns - verified via VirusTotal)
Installation paths
C:\Program Files\Miradore\OnlineClient\bin\*
*\Miradore\*
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files\Miradore\OnlineClient\bin\*
- Description
- Miradore client installation directory (verified via VirusTotal sandbox analysis)
- OS
- Windows
- File
- C:\Program Files\Miradore\OnlineClient\bin\7z.dll
- Description
- Miradore compression library (verified via VirusTotal sandbox analysis)
- OS
- Windows
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- Description
- Service installation event for Miradore Online Client
- OS
- Windows
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- gateway.miradore.com
- *.miradore.com
- miradore.com
- gerwconline.blob.core.windows.net
- Ports
- 443
References
Acknowledgements
- Person
- Squiblydoo
- Handle
- @Squiblydoo