LOLRMMTHE REMOTE ACCESS CATALOG
GitHub
Catalog / MSP360
RMM

MSP360

MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category
RMM
Research authors
Not recorded
Created
2024-08-02
Last modified
2026-06-15
Privileges
Not recorded
Free / availability
Not recorded
Verification required
Not recorded
Supported platforms
Not recorded

Executables & installation paths

Filename
Not recorded
OriginalFileName
Not recorded
Description
Not recorded

Installation paths

Online Backup.exe
CBBackupPlan.exe
Cloud.Backup.Scheduler.exe
Cloud.Backup.RM.Service.exe
cbb.exe
CloudRaService.exe
CloudRaSd.exe
CloudRaCmd.exe
CloudRaUtilities.exe
Remote Desktop.exe
Connect.exe
RMM.Agent.exe

Code signing

signer name
MSPBytes Corp
certificate thumbprint
C8B331F3152A9D709D0A313D7326154F6787935D
tbs sha256
AD670F8BD4D505626D4FB0A50380869B4F18F08825BBE4E417618F4E51D977E3
tbs sha1
Not recorded
signer name
MSPBytes, Corp.
certificate thumbprint
N/A
tbs sha256
Not recorded
tbs sha1
Not recorded
tbs sha384
8A459D01A551D1AFE00C32819DC5E788F67A4E8C5B937D490C53D75A0944E9B3F17599FF5E285F728AEA5191DE96BC16
signer name
MSPBytes\
issuer
CN=Sectigo Public Code Signing CA R36
certificate thumbprint
EF6439FC45C8031E514DD7D445D1B8BABF474E9B
tbs sha256
0B0B70BB42674314EFDE0A25E8DD4401C71F243078B51B1E286C663EB33C4E00
tbs sha1
5CA8DD6F7C06E9EE0BAA9FD811D0F175FA7C280E
valid from
2021-12-03T00:00:00+00:00
valid to
2024-12-02T23:59:59+00:00

search names

.bc.t_55370z
.bc.t_7sapsr
.bc.t_nptrc3
.bc.t_qzi9au
.bc.t_skipgm
.bc.t_su36ea
cbbackupplan.exe
cbbackupplan.resources.dll
cl2z504wh.exe
cloud.backup.scheduler.exe
cloudracmd.dll
cloudracmd.exe
cloudrasd.dll
cloudrasd.exe
cloudraservice.exe
rmm.agent.exe

company names

signer names

MSPBytes Corp
MSPBytes, Corp.
MSPBytes\

File hashes

authenticode
  • file name
    CBBackupPlan.exe
    sha256
    94EFB12346EA005189DEDAC715F48E6C01A8EF188DEBABDD40DED8D8D93499A5
    sha1
    9B84F2157CA5524BBD94B99A6EE8C7C5CB96F6D4
  • file name
    CBBackupPlan.resources.dll
    sha256
    5220B03478F01E2D46CC171C72D1812810D9791CF64E7A6E1BCB721461E61941
    sha1
    649D49957AA3DBD93E96C80F71A73ABE0F163DF1
  • file name
    .BC.T_QzI9aU
    sha256
    3BD5B8415473613C5BC0BD92B918E267382DFD6E81ECC1152B03F53B9CF3CBD2
    sha1
    8553FBD6659596BDC6F77345C9361E4869FCF8F9
  • file name
    CloudRaSd.dll
    sha256
    FA06E558BFDB082426C340B7181C99D8D65EDB00B1CC72C28F3BF46768EDAAE3
    sha1
    62DB5563077353B7404762D70F9CCA2786DBC6FA
  • file name
    CBBackupPlan.resources.dll
    sha256
    6952FD200F1C42FB8BC3002C94675AA33F634080F4549E7DBBC8EB009FF16010
    sha1
    DF208C3A7DDA7D209CEC63856534C15C2773E2CB
  • file name
    CloudRaSd.dll
    sha256
    56086224AF7D86133FDEBB6B88DCEB546F8F41A82115CE37FEA470BCD5ADA409
    sha1
    896B129F7F12159C36DD94DCC763E566F862DF55
  • file name
    CBBackupPlan.resources.dll
    sha256
    C65DF16791A6984342D45C47C7311FA3271304FFF2ED3B44A991A10D47FDBF45
    sha1
    12686213450D197E72290C0B0A8DEB6D062855C8
  • file name
    .BC.T_nPtRC3
    sha256
    7E309A943829B6E6F9DB6E4510C11FAE7C62736CFAE6F02900314F8160F33725
    sha1
    4F0AAD853B519021531E56578C7F818B532AF2C9
  • file name
    CBBackupPlan.resources.dll
    sha256
    622BCB6916117DDC0DA68BD0616890B6E59CB6F1D309F0918CE0210D543ACA4F
    sha1
    EF0544F2AF9992504B590A1888C4B72E09199358
  • file name
    CBBackupPlan.exe
    sha256
    5C6171030FF1517E7CD263A79ED0E0B076A21C846547ED2B71DBCC21C30E495A
    sha1
    0DB58AE74DAB3C861115CB982E36684C2D6AE247
  • file name
    CloudRaCmd.exe
    sha256
    DAE2D1F1673943DDB0BF3FE1E05B016342455627388C1DDE5B03070A5E0C1E89
    sha1
    01E3E8CDCB81E91B4A8560BB05126CD40EDF1DE8
  • file name
    .BC.T_sU36EA
    sha256
    460E3C1FE1E1B9F3949CCDFE0D907D915577D99E87B184368929E5DC6B3EB3AA
    sha1
    014229FFFDF466656841BB38AB697B67C498522D
  • file name
    CBBackupPlan.resources.dll
    sha256
    16CB61CE36EBC7F75FFB7056EA9E8366C2264D235DDBB0AAE62D7CA59C49BD91
    sha1
    9FDD10703CF4E13F57D56E964D5149FCF4139E09
  • file name
    CloudRaSd.dll
    sha256
    FE2473D98A2814DC5A77E5D6D386E2B8DEAC41DFB7A790D9E92A95047640BCD5
    sha1
    E0C5BEDFFF3E4167894049820254C8DEE68FADD3
  • file name
    .BC.T_7SApSr
    sha256
    4236C711775F449975817DDF115559FEA758333EA54644CCFAE6EBF8A6125FD5
    sha1
    ACE2F3CA839B67AD43039FB29F39014C94A1049A
  • file name
    .BC.T_skIpGM
    sha256
    35E57F622E3F4D12F040424CAEF8FDB1102DE49B34E3679E26BC48B1C56F9489
    sha1
    BF46EF161CC43331BA7345999069A39B61A5C67B
  • file name
    CloudRaCmd.dll
    sha256
    095AC7D8ABF395E9E5CD2C640992F992E132CDCFF573846C2292F599CD62674C
    sha1
    C1B8557C9C4A7891F8E831F5BA5A6582AADB5A40
  • file name
    CBBackupPlan.resources.dll
    sha256
    E39A267346816BAC631EAEBB87F2912CA890481024B98FF07E71E42301224D28
    sha1
    71B9D469EC920E43D154937781F70DE00CFA3BB9
  • file name
    CloudRaCmd.dll
    sha256
    222E3C9B7E43776E25243FD6D974936A8750B9E2F1305FF6E5229395049FC5E1
    sha1
    F442A8E06A75B50377916587634A4A601D992E74
  • file name
    cl2z504wh.exe
    sha256
    D733380B2CFF37AC11EBABCEF0162E02339AF286E1B0EF0481AF0303B1C27402
    sha1
    15775DFDE129D651A327BDB34F05DFCD042FA72C
  • file name
    CBBackupPlan.resources.dll
    sha256
    9DE6390D29F7B546459963D993B4AFBB6C674A0C460E103C4CA7F0BDBFB7BB00
    sha1
    414B95A271A7AED3566962D6CF22EE8DEFF479FE
  • file name
    CloudRaCmd.dll
    sha256
    3138AE4DC10942811FD087ED489BB1D1BF4C81BAB479A441395437CAB2095126
    sha1
    90E15115CC40E72F793191F0AA6C8D8A84B87FB2
  • file name
    CBBackupPlan.resources.dll
    sha256
    0F27D3957DEC144B82869352FDAC24B343B31952A72DBFD207AA5C4A8E4D7AFE
    sha1
    A5525560E45566385970B4C16E29CE7C3E1E5A7B
  • file name
    CBBackupPlan.resources.dll
    sha256
    1A088744BEC59FC6ADE358CA2F8A892F1D050723738AA01AF7736DF1A3C4B497
    sha1
    F99EFE83A3683910FAA88242ECB8186CEAC9C0B3
  • file name
    CBBackupPlan.resources.dll
    sha256
    8F04BE5F40BA03BCA2351DAAE1BE9D202885D0EC472249D50961C4B88CAC1502
    sha1
    E98C75CFADA1B7A383A35191BF86DDC0BDD4B826
  • file name
    CloudRaCmd.dll
    sha256
    BC0E5ACD988E5E8DA81F057C539816D5F843EE5A890B5A8EE008A90675D2F885
    sha1
    466549433B5A6834542C4BBDF622E6A99E415364
  • file name
    .BC.T_55370Z
    sha256
    F894094639DC0F886458653322476C2DE6A7C6FBA19CE18BD3F9C04F8EF0E1A1
    sha1
    8D75D6AA451AEBCB6DFC712D06FE98684CF5FC3E
  • file name
    CloudRaSd.dll
    sha256
    3CC3A663282367653EB897D1F8DEBDC523AA12C15D737D94B750D71AD511D52E
    sha1
    B21F45A511C492472BE727488330A01D945E8249
  • file name
    CBBackupPlan.resources.dll
    sha256
    F7158F7EFE789FB7BF51A69073014CD6142888115AAC0E4837EEB65DA694F9CD
    sha1
    5C53D536E40CFEF057E6C5BBEA3661AAB8D53B12
page
  • file name
    CBBackupPlan.resources.dll
    sha256
    43123C2AD78B4CEE1CB47E48998BE97E5814947B0F60038127D2C2C50F404D75
    sha1
    67C5F7B0D52FACA19AB91917C5B881187BEDA7B3
  • file name
    .BC.T_QzI9aU
    sha256
    F4C47D8498BE0F84ACDFD3221424C84DA44D810F88B03AB8863594526A25E9DF
    sha1
    0F364E7E39B06F98B15F04B9972A0323AD4E78FC
  • file name
    CloudRaSd.dll
    sha256
    5A03D1E37513981173BEA9109BF0B0F02B3A0148DFCF56DED6E36534FB0A14A0
    sha1
    D5B96614599DCE0E5B70D64E7E153D0DC8561525
  • file name
    CBBackupPlan.resources.dll
    sha256
    F24F4E359AE981A6BC3B187EDAA5BE6771C132A67AEC20D50BA5F392723468F5
    sha1
    FB00DC665701B53752C4D65732CC0093A6F3C225
  • file name
    CloudRaSd.dll
    sha256
    BC74EAC79CF492E2DC73FABBD8D90CB6DE6FEF91E9FFBDC71F91C47A7CDDD203
    sha1
    0C2E9355C460FF781A80BC044887C3E87760719E
  • file name
    CBBackupPlan.resources.dll
    sha256
    E811527C98F8F724EE96902BF39666D364A4560FB19FB13709FD702A52487D00
    sha1
    7FF87663317B65680E649C27D365A0AD9828B453
  • file name
    .BC.T_nPtRC3
    sha256
    C3B93BB1E501880CBC678F1CE7D587A37015DFD1BBE97D52739352D890029941
    sha1
    7D915AE56C9866F9988193CA98120C51A4E3D7A7
  • file name
    CBBackupPlan.resources.dll
    sha256
    67F64B6949D9CF6CA307EE3425FA38529E315A405DBF1FD77351BF7915B4D622
    sha1
    5C19C93D81182971077C7269FEC1941A1028911F
  • file name
    CloudRaCmd.exe
    sha256
    9C50BF139A8C5D443A90CE8536E404B4D2A5B09EF8C1A25B7ED3070E7635AB86
    sha1
    4AB6C0847E4FBEF632A3433E08029FA9A7055E63
  • file name
    .BC.T_sU36EA
    sha256
    E838F732DBC9BCBB4450946A44ADDA0FB9D7DC61450659BA244525D8F0EAA5DF
    sha1
    0572DC7072387B42F2228C8F5C53CF9F5C3B5699
  • file name
    CBBackupPlan.resources.dll
    sha256
    1492095EB1D6DE59103D2B25FA4336EDADCECC50D97AAA4B4CA8A845E1794C74
    sha1
    EED7A864B512E53A38994E0999A50231E8B6FCE4
  • file name
    CloudRaSd.dll
    sha256
    6305E7182DFF5E38A816E014B50496B77BC9E3943F6C19522FACD770A07BDD51
    sha1
    3E244DBFAB41D64E4F1A9F6EA5D5454F90D83F95
  • file name
    .BC.T_7SApSr
    sha256
    72DC1D003041090400AD8D77AC3A24604BB70FEC968FBA2C12EED333CDE95F54
    sha1
    9587D7459E112F230A33E18487A0D3AFEC56C178
  • file name
    .BC.T_skIpGM
    sha256
    B3D6ACDDBFA658B11F0ACC15CC7D5025B94BD29CD2D92A85DE72197BFA857370
    sha1
    E3F6B228882C0BB6929E317CDD6B857B7956957E
  • file name
    CloudRaCmd.dll
    sha256
    625B1920032E3361B9DBB5D723EE5A607E7BBD8C54B24069B07408EC1B132FC1
    sha1
    2A0D4B93AB8D79D79E9F2CBED2E4408A6B81B093
  • file name
    CBBackupPlan.resources.dll
    sha256
    77BFC2DA61249B3248528A019D5CB6E9414D6DAA31D8835595E7D8D8D4B5240D
    sha1
    1F4FF763F34D586EC404DC76C34A5E8A3F034FA2
  • file name
    CloudRaCmd.dll
    sha256
    0C0A0997BFF312558FE9B2E0F42CC63BD6398241AAB393AD6D32DDE116AB00DE
    sha1
    10648B2DB9B674907D8893CDA19BE77E441B114F
  • file name
    cl2z504wh.exe
    sha256
    1A6753760C133219BD3001D9AFB8C80C0D665A1F738BC279D504B42C07E5621E
    sha1
    4619457D33A1D741357FF1D69BD177D5F9EC06E3
  • file name
    CBBackupPlan.resources.dll
    sha256
    6103778F0F8B431638DFADF5BA45A0220C6D8C83EEA7E3D516468CFDB86E40C6
    sha1
    1015D99A9E4D01D06BCCD2C8C2A0EA033906C0F7
  • file name
    CloudRaCmd.dll
    sha256
    AB297373C6E055A52986FEDEB15A22D5B9BA390C9B6A4263A77887E107180C01
    sha1
    69DE22B43782594A8A9E499A5CB2DE9B4ACA9C3B
  • file name
    CBBackupPlan.resources.dll
    sha256
    402CFAAC6074422D8A37D77CFCA735963728BE66BE82CC92450183CFC1843D3F
    sha1
    4277B3B5F6AFFEB4791793452C3DEB104489D09B
  • file name
    CBBackupPlan.resources.dll
    sha256
    FEDF8878998DF3676F67E3B04C802924B1E915309B8AEA5F6FCB9A17B45475C6
    sha1
    A4FD7889ED74128D50C7D3DE10236115E5AAA07F
  • file name
    CBBackupPlan.resources.dll
    sha256
    12B07E01BFC04E57B8CEAA1B69CD0BF2F4159F5E037239DA51258DFC952CE01C
    sha1
    A632AAC2EC72E9D477F58A989B33AB92AEAEE261
  • file name
    CloudRaCmd.dll
    sha256
    4A4A21F4A4EC8A2694A8838B6E27A7DE51503FF5E4C1DE65716563FEFCC5A19A
    sha1
    10F7ABA68255886692322A39CF1DC7B27DECA789
  • file name
    .BC.T_55370Z
    sha256
    1B1DBBBF0992F43086157E106B15E85CED84AC5C56C94EB93835106977A645F4
    sha1
    75CBEE455F95A915AC8CE14EF19A67BA0406A44E
  • file name
    CloudRaSd.dll
    sha256
    D63C97AAED18DB59F80CD6561C4AF7CE89DCB852385991C30B452DC071C7C06B
    sha1
    DF5A1BBC16229C81F39FDEFE41FD8268F1E2009F
  • file name
    CBBackupPlan.resources.dll
    sha256
    5030C3B4141F695B4962853AE1821D8AA374DF06BA59E9BFF5826C676C2566FB
    sha1
    DA5EBC3CD0D5ACBA4B6C47C0DEC7A2A783E452BB

FORENSIC EVIDENCE

Network artifacts

Description
Known remote domains
Domains
  • *.cloudberrylab.com
  • *.msp360.com
  • *.mspbackups.com
  • msp360.com
Ports
Not recorded

Detections

Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/msp360_network_sigma.yml
Description
Detects potential network activity of MSP360 RMM tool
Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/msp360_processes_sigma.yml
Description
Detects potential processes activity of MSP360 RMM tool

References