RAT

RDCMan

Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only.

Tool overview

Category
RAT
Research authors
Daniel Koifman (KoifSec)
Created
2025-11-12
Last modified
2025-11-12
Privileges
User
Free / availability
Yes
Verification required
Yes
Supported platforms
Windows

Capabilities

Remote Desktop ManagementMultiple RDP Sessions

Known vulnerabilities

  • CVE-2020-0765

Executables & installation paths

Installation paths

*\RDCMan.exe
*\RDCMan-x86.exe

Code signing

signer name
Microsoft Corporation
issuer
CN=Microsoft Code Signing PCA 2011
certificate thumbprint
3F56A45111684D454E231CFDC4DA5C8D370F9816
tbs sha256
21DC4A8B9890842E51963CE36D3A614C716D2D794AFCF606F73CE12B525F9E6B
tbs sha1
1D04935E420A06C650CB71FB762C0F0E8F90D17C
valid from
2025-06-19T18:21:37+00:00
valid to
2026-06-17T18:21:37+00:00
src file path
downloaded_files/rdcman/e6067c98e8ffc586d689d1ddb5376f26e1657c15ddafe4eff7b4d231de15770a
src file company
Microsoft
signer name
Microsoft Corporation
issuer
CN=Microsoft Code Signing PCA
certificate thumbprint
67B1757863E3EFF760EA9EBB02849AF07D3A8080
tbs sha256
B4D5162BFE8B7E38196E3C394D21AC408EA0E31A050560AF2909B066526B7207
tbs sha1
85959A020005CF379188739F02E24D0B6031DBC4
valid from
2014-04-22T17:39:00+00:00
valid to
2015-07-22T17:39:00+00:00
signer name
Microsoft Corporation
certificate thumbprint
F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79
src file sha256
966952d678a8eb7254cf7c024ece8bc47e05a89c760f994db92f5a4309688b25
src file path
downloaded_files/rdcman/966952d678a8eb7254cf7c024ece8bc47e05a89c760f994db92f5a4309688b25
src file company
Microsoft

search names

nmk092kb9.exe
rdcman-x86.dll
rdcman-x86.exe
rdcman.exe
v8yka5.exe

company names

signer names

Microsoft Corporation

File hashes

authenticode
  • file name
    RDCMan-x86.exe
    sha256
    5BC272A208BF66991CD5970D394F1E54525EE641B3FD9371ADA17026E75378A5
    sha1
    9B0422A36C73BF7FE2564420DD90D545231DAEE3
  • file name
    RDCMan-x86.exe
    sha256
    D3E586562037D1639E0A70D6C5AB31F40408B805C8C969857E8BDEC53410C342
    sha1
    DD13B79EDC779927A728799DC74FD5B06BD0CE43
  • file name
    RDCMan-x86.exe
    sha256
    5841E09FB6E2B8EEB453D177A5E56053CA252714A2BCB484A4481A36BC33F47A
    sha1
    9FD7AA70A0AD609907EFA546E3AD7CF7A418BE51
  • file name
    RDCMan.exe
    sha256
    1618E995C25C9E881FD50D349BA3D2749BC4E4A133975431D71B6A6EB4FDCFF4
    sha1
    4C90CB51AE90E54A34446A1581288A05FF45EDEC
  • file name
    RDCMan-x86.exe
    sha256
    D1C67E6934E650D574AD56DB18D1CB09618D9F09C9E4313CA7C9650C1C6AB83D
    sha1
    5CA8A51931D39B29E4CC161526E1681DED42C114
  • file name
    RDCMan-x86.exe
    sha256
    3CF37A92143E9EAE3223CB9622F951A854D3C46F2D5F024C06DC916953889691
    sha1
    2E53240995E4A45BCC5A809BD87DD94FE6DAB463
  • file name
    RDCMan-x86.exe
    sha256
    9BA6CF75FC5295BE0E5F92A1A44D6CA6FB9572C5CFE0BE2CD0E2E8AA6C34E432
    sha1
    EA0A90B7EA86FB3B7F9961B0FB83DFE2E3437932
  • file name
    RDCMan-x86.exe
    sha256
    06E4CB94B7745B10BB2BE17653B13F54CD0F1C3559025208457571EFEC214016
    sha1
    C071EE8ED4EEBC8C4A84D39C14CB12770234E9F1
  • file name
    RDCMan-x86.exe
    sha256
    74B4F499BF43EFDA77D854D4A36C190DF762DA9D6192BBE8316CD93023FD47CC
    sha1
    5FE86B3293596EC73840D72EABA258FD0900C9E1
  • file name
    RDCMan-x86.dll
    sha256
    CEAB7C913A68FE70EFE4644B86DA6FCE81D2B9AC2CD597AF5C2A16E181C85F26
    sha1
    C9AC5C1348942C9D68774733469DD84AF625B71B
  • file name
    v8yka5.exe
    sha256
    ED38AF28E6937AF2BE25FA0BB36FA5FCB227160A813534AEC2ABA00A044864C0
    sha1
    F1517300A63B03EA966D76356FCE9601ED792781
  • file name
    RDCMan.exe
    sha256
    B0988D2187A02C1E27BA8E2D184A153BA61769B7926D979635A84FD0196CC366
    sha1
    F1735B0D0FA6CC585C0FA7693511211223511499
  • file name
    RDCMan-x86.exe
    sha256
    7D490021979B3D345C12BC63297D0CC0777FDFBB9B1B6EEC0EA37A344F8762C8
    sha1
    B3BDCD54D11D6350964537AC409AEBAD16251991
  • file name
    nmk092kb9.exe
    sha256
    C4671732EF6F299C723490AA305BF4439226C79A9107530674AAAA204C436016
    sha1
    EE8650A59EC911CBAA03C20D5FC9B799D8090309
  • file name
    RDCMan-x86.exe
    sha256
    F865B64E287A090C8C90CC38B447C8169F5FA33F7D0FB713167FEC837E476732
    sha1
    08A683875545D77768DC26B2C8D0DB67A2CDDC1E
  • file name
    RDCMan-x86.exe
    sha256
    C757873F983503D5FE0DC47DDAAA177DFDD63B40EC255FCC94DF53992F0E5192
    sha1
    16BAFB5E70A6267129C7EC5E1A5AC792DFAFC58E
  • file name
    RDCMan-x86.exe
    sha256
    301D12BA963F4BB7EFC0C5183F8F405DA29E5BB10D8C6806FFD772E0AB60C54D
    sha1
    5A75F5E03F19676DC8BACB8C527EBF2B80E9ACE1
page
  • file name
    RDCMan-x86.exe
    sha256
    4C7DF8D957FE411B1C7CFF76E942B5FD599BDDF8615F0CBC6DFC0A1B1FE6F46F
    sha1
    DD0B27369D0E1716E4C958B625F334A82352BF4A
  • file name
    RDCMan-x86.exe
    sha256
    FC99BFF6CF077C5A1D5CA87A0FFDCCF39E21E14D775FAADAA1B90DD01463BB7C
    sha1
    20A8A0C93661FFE8FCE83968E17C68890CCA4637
  • file name
    RDCMan-x86.exe
    sha256
    56E852B40B0652CC3180DFC9AEEEFBE309A35B283B6DD29B8578B5E86D782063
    sha1
    2406CA75D570279F64D088912232A6F9BBD6A353
  • file name
    RDCMan-x86.exe
    sha256
    63DB9F738188336426FA928386B5B5B9EA721833BB1EEE2471C48BF5731A25C7
    sha1
    FCE68D8735341AF594242E42566AE2450AC42A1B
  • file name
    RDCMan-x86.exe
    sha256
    5C02F32FF21647F9CF6E70DC25CACC6AE2599B56A62E7E78CDDD8C599A5B5C88
    sha1
    D602CBDDD19BF061D967E54356427E58E729A635
  • file name
    RDCMan-x86.exe
    sha256
    C77F9266F297C5590F2F41F6659D4A65E1976D10D3DE16EECCC9AF338EEFC875
    sha1
    8907AF5497348368F091D9BB3A8CFF42B0242CBD
  • file name
    RDCMan-x86.exe
    sha256
    0AC5F63C1F78EDCAF629D949CAFFA2E15715FD4EE381758284DD4BDC3B4F5532
    sha1
    417E0C15A9BF212627B1EE09D110F056813A931A
  • file name
    RDCMan-x86.exe
    sha256
    5289255473627ACEFB589EB9DB5C22C4B3329997B502E2F6BC30AFBE6FA07AC4
    sha1
    DA44E04CD6DEA5670984184C70A1D42594AFE6BE
  • file name
    RDCMan-x86.dll
    sha256
    1BACD80487828AC1F9E8A15E38951C66C90CC0E9AA6A9529A91CE53796E69C4B
    sha1
    4E99889F7C52328C383743EDF3F7D0D6AA999B1E
  • file name
    v8yka5.exe
    sha256
    F1AD9038A11E8FCAA328F6FB9E444386081005B5C7A5E7C4CF94C89EF97E7768
    sha1
    385A49F68B86AF4490521873728B5283B67EB6FA
  • file name
    RDCMan-x86.exe
    sha256
    05ED894B82B84256900F02BD440A283A845BF3BD984AB99F67EA385AEB898D40
    sha1
    1A8F55ECE08544DE8D4FF97A0F82AF41A10073B6
  • file name
    RDCMan-x86.exe
    sha256
    0C6535084571ED5AB1775F49D8CBB85C3F864D9444DD8A3B6B88D7B5F79358CD
    sha1
    11FFBF5C42DD29F658773A9A7FF0A84F3ADBE2C2
  • file name
    RDCMan-x86.exe
    sha256
    BD09703AD68D3A3FD2F9D779838600662515C50E535F68B23600DE67574CACBD
    sha1
    D7911C5D4506211CED7D494DA6B159E38ECDB025
  • file name
    RDCMan-x86.exe
    sha256
    E85E05372FF2A191D1353E5D2A83BFB82C7EC17540142725C99AFB0886F7DE2A
    sha1
    F92CB8B3EDE30EDC70F497CDCFFAC789BB6E096A

Detections

KQL
https://github.com/Koifman/Deathcon25/blob/main/rmm_rodeo/rdcman/kql.kql
Description
KQL query for detecting RDCMan activity in Microsoft Sentinel

References