RAT
PuTTY Tray
PuTTY Tray is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RAT
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2024-08-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
C:\*\puttytray.exe
*\puttytray.exe
Code signing
- signer name
- Christopher West
- issuer
- CN=StartCom Class 2 Primary Intermediate Object CA
- certificate thumbprint
- 83191137CDEEF81C30E354873FECF014729C2FDF
- tbs sha256
- BF98620649A90682F39538F9A9DB76B90CD49FFD11AE96385A9D7113E1F70099
- tbs sha1
- A306499CEC6AF8C46C2F959731D0D41C6090D06C
- valid from
- 2014-02-25T22:22:24+00:00
- valid to
- 2016-02-26T05:05:17+00:00
search names
putty
putty.exe
puttytray.exe
company names
signer names
Christopher West
File hashes
- authenticode
- file name
- PuTTY
- sha256
- 264444C790AF00AA0830BE764FE3EC4613B0F16D9AEEA9C480C27D418679650A
- sha1
- 1CF0A22F3C317E7D53ABC5003ECC7136768F4F1F
- file name
- putty.exe
- sha256
- A342E96AA7631BCC98AF33E781C239B486E5417C7CB665A79F66841B41C50360
- sha1
- D9494272E8A7EE2A491D3C57E059A7A7F6EE7017
- page
- file name
- PuTTY
- sha256
- 75CA90063D40A7B88F9092A7DF12017592266CF4BC9F2FBEA0E96E8333AD7A53
- sha1
- 3444BD923A9B08273DBE3F302B2A569A210E44DA
- file name
- putty.exe
- sha256
- 69C73E6DD1F2460762962DCE98774CED99AFF86E1FC715103114A004816FF4A1
- sha1
- 5249C8F956D087A90A5BDA1E3149F4E90BCA59C1
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/putty_tray_processes_sigma.yml
- Description
- Detects potential processes activity of PuTTY Tray RMM tool