LOLRMMTHE REMOTE ACCESS CATALOG
GitHub
Catalog / Tactical RMM
RMM

Tactical RMM

Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category
RMM
Research authors
Not recorded
Created
2024-08-02
Last modified
2026-06-16
Privileges
Not recorded
Free / availability
Not recorded
Verification required
Not recorded
Supported platforms
Not recorded

Executables & installation paths

Filename
Not recorded
OriginalFileName
Not recorded
Description
Not recorded

Installation paths

tacticalrmm.exe

Code signing

signer name
Christopher West
certificate thumbprint
F73B1F0CA2D3B9FCC00D4CD9B379C9FF9DB518A2
tbs sha256
EA02531BA6EEAE043DFCDBEAC2A5C520567FC566AB5C2D75AA0DEAD4E2F6414D
tbs sha1
Not recorded
signer name
Christopher West
certificate thumbprint
N/A
tbs sha256
Not recorded
tbs sha1
A306499CEC6AF8C46C2F959731D0D41C6090D06C

search names

2025-12-14_3570cdbcb1a442eb605fb2b5f3d7aef7_cobalt-strike_coinminer_dosia_frostygoop_glassworm_luca-stealer_poet-rat_quasar-rat_sliver_snatch
7v04zvtl.exe
ft38y1rpx.exe
is-mp1io.tmp
l0ahm9y.exe
m7i0z.exe
nhvs68.exe
tacticalagent-v2.9.1-windows-amd64.exe
tacticalrmm.exe
vz4exk32z.exe

company names

signer names

Christopher West

File hashes

authenticode
  • file name
    tacticalrmm.exe
    sha256
    2850E1F08F4BCDBA6B4FDDB0F85D04EFA28BE2A311DF6C9ADA375A9AA68D8AA3
    sha1
    115DAA83F7B4DF3CF3BF4F46EE5DA761CB69363A
  • file name
    ft38y1rpx.exe
    sha256
    3CC4C9D00DF29DC51A64A41DEB93CB4B010669D0571040700DFB4D15D3768A90
    sha1
    EFB8FFC4CB40D47A668CA38DA98CECE3AA3B8902
  • file name
    vz4exk32z.exe
    sha256
    1615799D0036FA60E74689E45F45EA9DC9047065BD37339BEE9CB37D92E48F22
    sha1
    16780328DEC2D7A10B9168A11F073169667125BE
  • file name
    tacticalrmm.exe
    sha256
    252F57B824BC488FE635391E0E6F554077F530952992618D11DD8D15E2D7AEC4
    sha1
    7DD42D637F3BAF82CF8CA9551CDA2E62D57EB1A1
  • file name
    2025-12-14_3570cdbcb1a442eb605fb2b5f3d7aef7_cobalt-strike_coinminer_dosia_frostygoop_glassworm_luca-stealer_poet-rat_quasar-rat_sliver_snatch
    sha256
    02BF4D99FE81A2C92A28EFF02A8EEEE93B79C2B019185326917E77A07B5D1640
    sha1
    0D476F7C7F536242B3003EECAE64E1A223CB56E1
  • file name
    tacticalrmm.exe
    sha256
    3026E8C0E61B78884F5AA1777527B233F3CF4BE14AF6E257BAB50ADB0B4EADAE
    sha1
    E6A620B83B6C860AECAE59412DF26ECB0331D39F
  • file name
    tacticalrmm.exe
    sha256
    F2835C54CB6E24A0598D74D5A13C110DB84F05D1BE6863280C1BB09E74F207E2
    sha1
    AC61A1CC25EB933635599AFB6D0B80D9B0C50E7C
  • file name
    tacticalrmm.exe
    sha256
    7ED4D76A0A62329691D4FCBA076F63F09CD60CEF156484328E5AE83956E8F32C
    sha1
    54179578313D5C13935AF83314F752EEC5385DD7
  • file name
    tacticalrmm.exe
    sha256
    E142022630AB18A1EB2007027FCF4320FBE3E537FA1784E079DF5E0454C95FFA
    sha1
    7F7D7AB9DB11F142D9CA5B8200784B01416AFC9E
  • file name
    7v04zvtl.exe
    sha256
    9D2FA4720EAA8FC77FD769475D9692628CE231D09B68D3F262A71B6A9918B7A3
    sha1
    46AC3162F3F78C00B895FF590381B7B13F180B98
  • file name
    nhvs68.exe
    sha256
    EB9F6F96ECE167D782885D01620D5ADCEAE51D69D73BAAC922F0C9F4BB64F8AB
    sha1
    128666F81B3F8554D58DF76AB84B619A42799FC7
  • file name
    tacticalrmm.exe
    sha256
    11CC8798C52FA3C656A1A584DDE09144E690F62620D3B54295D469952C63D4B4
    sha1
    C67383FBEC97D9CD08D8F04629DC767D9A435E3D
  • file name
    tacticalrmm.exe
    sha256
    3970FF0BD8B081A6D880D23DE6C2932874B41D6E91F0C77D7A39B5A9E54DB785
    sha1
    BD871C91B00BF1101B727C1A0E69EA4CF568A3F1
  • file name
    l0ahm9y.exe
    sha256
    AEDFE445946EC94FD2C7CEFD6C4A4C33771134A2AE487FCC4BDB27781328C4BA
    sha1
    D1C60D1C1C738C3EB45DC3D74155A6E7BB060A22
  • file name
    tacticalagent-v2.9.1-windows-amd64.exe
    sha256
    268CAC5F97338DC5541EB517AE75CFBAB0E5E9E52AD66817129EAFD55DA1BE05
    sha1
    9BC42B4C6B68724825EB5F0067FD59191853EF9D
  • file name
    tacticalrmm.exe
    sha256
    500C2081B4F2E76DDFB9D30F2794D29FF0BE627F8D81D4A32076B427550E92E1
    sha1
    B47446613A26F6B5550DD0D8776B94070F82F4BC
  • file name
    tacticalrmm.exe
    sha256
    DDD7083C8595F7A3CB7516DA58320F09121C7DBD3628930FAACF82CA55CC315B
    sha1
    90AEE3D7A12A420915B13874CA8952FFB33AA067
  • file name
    is-MP1IO.tmp
    sha256
    8CD03F59DB7C549DFEFD239DDB7B6EB4BFD8AB518FBFBE9518C6F004E3BE4C25
    sha1
    793EAC66DDB705E4DB63BB3116EDF02B0F28918B
  • file name
    m7i0z.exe
    sha256
    FD5E369822E6CF4BC12A342F9A8109CEDEB86781DA411D4C3E64B934BC398058
    sha1
    96D8C6A59C6B7DA0C3107D988DD94278C95E1EAA
page
  • file name
    ft38y1rpx.exe
    sha256
    5D36E860BC011D2A937A2C04D33C41AC22DE22DEC3B10FD229E54F8AB7FF9FC9
    sha1
    6E489AEB60857D065FD25AFE949B163EE441CE31
  • file name
    vz4exk32z.exe
    sha256
    2C04EF69FB5DFAA678575E4241DB560735A9AD0CDB0B1BA52CC80595279F4EDD
    sha1
    355CB1AEDF005F6335EEACA302CE00F268F05D90
  • file name
    2025-12-14_3570cdbcb1a442eb605fb2b5f3d7aef7_cobalt-strike_coinminer_dosia_frostygoop_glassworm_luca-stealer_poet-rat_quasar-rat_sliver_snatch
    sha256
    38169383E87CA8B9C0442F6B8AD64BF76C61D41D7C11512640700F29426DCAFF
    sha1
    9582072F90C99E0337027C542B18E30E63AFE0F2
  • file name
    tacticalrmm.exe
    sha256
    D45072B2EAD3E6F841A59086A0F3FCF63CA4C0667A6C20F16ABEEF26773309C0
    sha1
    2A2E6E7259A52DAB61D7E077AFD09FB859FFF627
  • file name
    tacticalrmm.exe
    sha256
    BF9797B468D297FA41DE2E6879B0C0450203F99055AA45DF28FC11787852142A
    sha1
    342D95593FA22B134557C777DB81BB51C47AF6E0
  • file name
    tacticalrmm.exe
    sha256
    4C3AD685700D6703369133F0DD0A13DCCBC1FF8368929ABDE9646DCB673DEB5B
    sha1
    7B108289E162A6BE86F0E2F81C97357D3D11AC69
  • file name
    7v04zvtl.exe
    sha256
    ACAF8E991A83A50D0B091F2E1C9DECED141C20080CEF8D9F54C0340BCE7F68CC
    sha1
    745DB9C6B127428E1FBA63547851A4F696A24A91
  • file name
    nhvs68.exe
    sha256
    5F3BA1EE7CB45424DCB04DC4D9C99C399A684AAEB8A227308E8DF60CB5A957B1
    sha1
    04D53C28F7385E3F46DC02060AF9C8A792CBCDCE
  • file name
    tacticalrmm.exe
    sha256
    94A64F4250C4A199083FCAF98F1B077543DA8964EBCBDE7A4F2223052D68238C
    sha1
    03458F61391A87208AF29AE560349B91CEEF6F69
  • file name
    tacticalrmm.exe
    sha256
    90022B3F951ECF60130AD47D278150A62F4DAFD84139C3EAD97D0DFFFA08CDFE
    sha1
    9698BB51C7DC33D8C53F9ECDFD94CBEC588E089A
  • file name
    l0ahm9y.exe
    sha256
    BFF28767946B8ED7C3C1217548F742967637052F6CC5DF7B75BA2922B5ED4A1F
    sha1
    53C592BFBBDF90EF286512BEDD084CB3A4CBD996
  • file name
    tacticalagent-v2.9.1-windows-amd64.exe
    sha256
    C7E2AEC782798DB83645BFFE14820ED47B035182681B224D262CE11FD1A6D703
    sha1
    435D9C4486FAEAB61FC0C1681C47347D74ABEA04
  • file name
    tacticalrmm.exe
    sha256
    A628305383B398F760933ABB5AC219F21782AB3E3E677A74444A8E203FB1E0F2
    sha1
    76F628C73887BA1B00245C6CD374B5B747157A2E
  • file name
    is-MP1IO.tmp
    sha256
    88E768CB07E4E56900325D6A3DC4966CA43B47E0D5F35AEBA6756218459F4EBC
    sha1
    E180813967854F98734AE14FA2164A2D59FA6C8F

FORENSIC EVIDENCE

Network artifacts

Description
Known remote domains
Domains
  • login.tailscale.com
  • docs.tacticalrmm.com
Ports
Not recorded

Detections

Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/tactical_rmm_network_sigma.yml
Description
Detects potential network activity of Tactical RMM RMM tool
Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/tactical_rmm_processes_sigma.yml
Description
Detects potential processes activity of Tactical RMM RMM tool

References