RDCMan
Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only.
Tool overview
- Category
- RAT
- Research authors
- Daniel Koifman (KoifSec)
- Created
- 2025-11-12
- Last modified
- 2025-11-12
- Privileges
- User
- Free / availability
- Yes
- Verification required
- Yes
- Supported platforms
Windows
Capabilities
Known vulnerabilities
- CVE-2020-0765
Executables & installation paths
Installation paths
Code signing
- signer name
- Microsoft Corporation
- issuer
- CN=Microsoft Code Signing PCA 2011
- certificate thumbprint
- 3F56A45111684D454E231CFDC4DA5C8D370F9816
- tbs sha256
- 21DC4A8B9890842E51963CE36D3A614C716D2D794AFCF606F73CE12B525F9E6B
- tbs sha1
- 1D04935E420A06C650CB71FB762C0F0E8F90D17C
- valid from
- 2025-06-19T18:21:37+00:00
- valid to
- 2026-06-17T18:21:37+00:00
- src file path
- downloaded_files/rdcman/e6067c98e8ffc586d689d1ddb5376f26e1657c15ddafe4eff7b4d231de15770a
- src file company
- Microsoft
- signer name
- Microsoft Corporation
- issuer
- CN=Microsoft Code Signing PCA
- certificate thumbprint
- 67B1757863E3EFF760EA9EBB02849AF07D3A8080
- tbs sha256
- B4D5162BFE8B7E38196E3C394D21AC408EA0E31A050560AF2909B066526B7207
- tbs sha1
- 85959A020005CF379188739F02E24D0B6031DBC4
- valid from
- 2014-04-22T17:39:00+00:00
- valid to
- 2015-07-22T17:39:00+00:00
- signer name
- Microsoft Corporation
- certificate thumbprint
- F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79
- src file sha256
- 966952d678a8eb7254cf7c024ece8bc47e05a89c760f994db92f5a4309688b25
- src file path
- downloaded_files/rdcman/966952d678a8eb7254cf7c024ece8bc47e05a89c760f994db92f5a4309688b25
- src file company
- Microsoft
search names
company names
signer names
File hashes
- authenticode
- file name
- RDCMan-x86.exe
- sha256
- 5BC272A208BF66991CD5970D394F1E54525EE641B3FD9371ADA17026E75378A5
- sha1
- 9B0422A36C73BF7FE2564420DD90D545231DAEE3
- file name
- RDCMan-x86.exe
- sha256
- D3E586562037D1639E0A70D6C5AB31F40408B805C8C969857E8BDEC53410C342
- sha1
- DD13B79EDC779927A728799DC74FD5B06BD0CE43
- file name
- RDCMan-x86.exe
- sha256
- 5841E09FB6E2B8EEB453D177A5E56053CA252714A2BCB484A4481A36BC33F47A
- sha1
- 9FD7AA70A0AD609907EFA546E3AD7CF7A418BE51
- file name
- RDCMan.exe
- sha256
- 1618E995C25C9E881FD50D349BA3D2749BC4E4A133975431D71B6A6EB4FDCFF4
- sha1
- 4C90CB51AE90E54A34446A1581288A05FF45EDEC
- file name
- RDCMan-x86.exe
- sha256
- D1C67E6934E650D574AD56DB18D1CB09618D9F09C9E4313CA7C9650C1C6AB83D
- sha1
- 5CA8A51931D39B29E4CC161526E1681DED42C114
- file name
- RDCMan-x86.exe
- sha256
- 3CF37A92143E9EAE3223CB9622F951A854D3C46F2D5F024C06DC916953889691
- sha1
- 2E53240995E4A45BCC5A809BD87DD94FE6DAB463
- file name
- RDCMan-x86.exe
- sha256
- 9BA6CF75FC5295BE0E5F92A1A44D6CA6FB9572C5CFE0BE2CD0E2E8AA6C34E432
- sha1
- EA0A90B7EA86FB3B7F9961B0FB83DFE2E3437932
- file name
- RDCMan-x86.exe
- sha256
- 06E4CB94B7745B10BB2BE17653B13F54CD0F1C3559025208457571EFEC214016
- sha1
- C071EE8ED4EEBC8C4A84D39C14CB12770234E9F1
- file name
- RDCMan-x86.exe
- sha256
- 74B4F499BF43EFDA77D854D4A36C190DF762DA9D6192BBE8316CD93023FD47CC
- sha1
- 5FE86B3293596EC73840D72EABA258FD0900C9E1
- file name
- RDCMan-x86.dll
- sha256
- CEAB7C913A68FE70EFE4644B86DA6FCE81D2B9AC2CD597AF5C2A16E181C85F26
- sha1
- C9AC5C1348942C9D68774733469DD84AF625B71B
- file name
- v8yka5.exe
- sha256
- ED38AF28E6937AF2BE25FA0BB36FA5FCB227160A813534AEC2ABA00A044864C0
- sha1
- F1517300A63B03EA966D76356FCE9601ED792781
- file name
- RDCMan.exe
- sha256
- B0988D2187A02C1E27BA8E2D184A153BA61769B7926D979635A84FD0196CC366
- sha1
- F1735B0D0FA6CC585C0FA7693511211223511499
- file name
- RDCMan-x86.exe
- sha256
- 7D490021979B3D345C12BC63297D0CC0777FDFBB9B1B6EEC0EA37A344F8762C8
- sha1
- B3BDCD54D11D6350964537AC409AEBAD16251991
- file name
- nmk092kb9.exe
- sha256
- C4671732EF6F299C723490AA305BF4439226C79A9107530674AAAA204C436016
- sha1
- EE8650A59EC911CBAA03C20D5FC9B799D8090309
- file name
- RDCMan-x86.exe
- sha256
- F865B64E287A090C8C90CC38B447C8169F5FA33F7D0FB713167FEC837E476732
- sha1
- 08A683875545D77768DC26B2C8D0DB67A2CDDC1E
- file name
- RDCMan-x86.exe
- sha256
- C757873F983503D5FE0DC47DDAAA177DFDD63B40EC255FCC94DF53992F0E5192
- sha1
- 16BAFB5E70A6267129C7EC5E1A5AC792DFAFC58E
- file name
- RDCMan-x86.exe
- sha256
- 301D12BA963F4BB7EFC0C5183F8F405DA29E5BB10D8C6806FFD772E0AB60C54D
- sha1
- 5A75F5E03F19676DC8BACB8C527EBF2B80E9ACE1
- page
- file name
- RDCMan-x86.exe
- sha256
- 4C7DF8D957FE411B1C7CFF76E942B5FD599BDDF8615F0CBC6DFC0A1B1FE6F46F
- sha1
- DD0B27369D0E1716E4C958B625F334A82352BF4A
- file name
- RDCMan-x86.exe
- sha256
- FC99BFF6CF077C5A1D5CA87A0FFDCCF39E21E14D775FAADAA1B90DD01463BB7C
- sha1
- 20A8A0C93661FFE8FCE83968E17C68890CCA4637
- file name
- RDCMan-x86.exe
- sha256
- 56E852B40B0652CC3180DFC9AEEEFBE309A35B283B6DD29B8578B5E86D782063
- sha1
- 2406CA75D570279F64D088912232A6F9BBD6A353
- file name
- RDCMan-x86.exe
- sha256
- 63DB9F738188336426FA928386B5B5B9EA721833BB1EEE2471C48BF5731A25C7
- sha1
- FCE68D8735341AF594242E42566AE2450AC42A1B
- file name
- RDCMan-x86.exe
- sha256
- 5C02F32FF21647F9CF6E70DC25CACC6AE2599B56A62E7E78CDDD8C599A5B5C88
- sha1
- D602CBDDD19BF061D967E54356427E58E729A635
- file name
- RDCMan-x86.exe
- sha256
- C77F9266F297C5590F2F41F6659D4A65E1976D10D3DE16EECCC9AF338EEFC875
- sha1
- 8907AF5497348368F091D9BB3A8CFF42B0242CBD
- file name
- RDCMan-x86.exe
- sha256
- 0AC5F63C1F78EDCAF629D949CAFFA2E15715FD4EE381758284DD4BDC3B4F5532
- sha1
- 417E0C15A9BF212627B1EE09D110F056813A931A
- file name
- RDCMan-x86.exe
- sha256
- 5289255473627ACEFB589EB9DB5C22C4B3329997B502E2F6BC30AFBE6FA07AC4
- sha1
- DA44E04CD6DEA5670984184C70A1D42594AFE6BE
- file name
- RDCMan-x86.dll
- sha256
- 1BACD80487828AC1F9E8A15E38951C66C90CC0E9AA6A9529A91CE53796E69C4B
- sha1
- 4E99889F7C52328C383743EDF3F7D0D6AA999B1E
- file name
- v8yka5.exe
- sha256
- F1AD9038A11E8FCAA328F6FB9E444386081005B5C7A5E7C4CF94C89EF97E7768
- sha1
- 385A49F68B86AF4490521873728B5283B67EB6FA
- file name
- RDCMan-x86.exe
- sha256
- 05ED894B82B84256900F02BD440A283A845BF3BD984AB99F67EA385AEB898D40
- sha1
- 1A8F55ECE08544DE8D4FF97A0F82AF41A10073B6
- file name
- RDCMan-x86.exe
- sha256
- 0C6535084571ED5AB1775F49D8CBB85C3F864D9444DD8A3B6B88D7B5F79358CD
- sha1
- 11FFBF5C42DD29F658773A9A7FF0A84F3ADBE2C2
- file name
- RDCMan-x86.exe
- sha256
- BD09703AD68D3A3FD2F9D779838600662515C50E535F68B23600DE67574CACBD
- sha1
- D7911C5D4506211CED7D494DA6B159E38ECDB025
- file name
- RDCMan-x86.exe
- sha256
- E85E05372FF2A191D1353E5D2A83BFB82C7EC17540142725C99AFB0886F7DE2A
- sha1
- F92CB8B3EDE30EDC70F497CDCFFAC789BB6E096A
Detections
- KQL
- https://github.com/Koifman/Deathcon25/blob/main/rmm_rodeo/rdcman/kql.kql
- Description
- KQL query for detecting RDCMan activity in Microsoft Sentinel