RMM
SpyAnywhere
SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2024-08-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
sysdiag.exe
Code signing
- signer name
- 北京火绒网络科技有限公司
- certificate thumbprint
- 951553728DD3DE4E8F93F5A60FC4C54C12F66835
- src file sha256
- d77eb49917751cfebc42e468bf023e3a2b86b68a73e292ea651d8869aa2650a4
- src file path
- downloaded_files/spyanywhere/d77eb49917751cfebc42e468bf023e3a2b86b68a73e292ea651d8869aa2650a4
- src file company
- Beijing Huorong Network Technology Co., Ltd.
- signer name
- Spytech Software and Design, Inc.
- certificate thumbprint
- 0F999A1FAF749C55BC095242AD221637850EE6AF
- src file sha256
- 8188c9883b46eceed07cc494ac29a02a1506934fcdd3841ea21d7f30fdfbf16b
- src file path
- downloaded_files/spyanywhere/8188c9883b46eceed07cc494ac29a02a1506934fcdd3841ea21d7f30fdfbf16b
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- *.spytech-web.com
- spyanywhere.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/spyanywhere_network_sigma.yml
- Description
- Detects potential network activity of SpyAnywhere RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/spyanywhere_processes_sigma.yml
- Description
- Detects potential processes activity of SpyAnywhere RMM tool