RMM
Vicarius vRx
Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder.
Tool overview
- Category
- RMM
- Research authors
- Liran Ravich, Cribl
- Created
- 2026-10-01
- Last modified
- 2026-10-05
- Privileges
- Not recorded
- Free / availability
- No
- Verification required
- Not recorded
- Supported platforms
Linux
Windows
macOS
Capabilities
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
C:\Program Files\Vicarius\Topia\*
/usr/share/vicarius/*
topiad.exe
/Library/PrivilegedHelperTools/topiad
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files\Vicarius\Topia\Trace\TopiaTrace.log
- Description
- vRx agent log file
- OS
- Windows
- File
- C:\Program Files\Vicarius\Topia\Topia.config
- Description
- vRx agent configuration file
- OS
- Windows
- File
- C:\Program Files\Vicarius\topiaInstaller.log
- Description
- vRx installation log file
- OS
- Windows
- File
- /var/log/TopiaTrace.log
- Description
- vRx agent log file
- OS
- Linux
- File
- /usr/share/vicarius/topiad.config
- Description
- vRx agent configuration file
- OS
- Linux
- File
- /Library/Logs/TopiaTrace.log
- Description
- vRx agent log file
- OS
- macOS
- File
- /Library/Application Support/Vicarius/TopiaTrace.log
- Description
- vRx agent log file for version 5.1.19 and above
- OS
- macOS
- File
- /Library/Preferences/Topia/io.vicarius.topia.config
- Description
- vRx agent configuration file
- OS
- macOS
- File
- C:\Program Files\Vicarius\Topia\topiad.exe
- Description
- Unified v5 agent executable
- OS
- Windows
- File
- /Library/PrivilegedHelperTools/topiad
- Description
- macOS agent executable
- OS
- macOS
- File
- /Library/LaunchDaemons/io.vicarius.Topia.plist
- Description
- macOS agent launch daemon configuration
- OS
- macOS
- File
- /var/log/topiaInstaller.log
- Description
- vRx installation log file
- OS
- Linux
- File
- /Library/Application Support/Vicarius/topiaInstaller.log
- Description
- vRx installation log file
- OS
- macOS
FORENSIC EVIDENCE
Network artifacts
- Description
- Vendor-hosted tenant dashboards, agent communication, installation packages and patch distribution
- Domains
- *.vicarius.cloud
- vicarius-installer.s3.amazonaws.com
- vicarius-patches.s3.amazonaws.com
- vicarius-release.s3.amazonaws.com
- vicarius-release.s3.us-east-1.amazonaws.com
- vicarius-static-organizationinstallations.vicarius-cdn.com
- vicarius-eu-central-1-installer.s3.amazonaws.com
- vicarius-eu-central-1-installer.s3.eu-central-1.amazonaws.com
- vicarius-eu-central-1-patches.s3.amazonaws.com
- vicarius-eu-central-1-patches.s3.eu-central-1.amazonaws.com
- vicarius-eu-central-1-release.s3.amazonaws.com
- vicarius-eu-central-1-release.s3.eu-central-1.amazonaws.com
- vicarius-ap-southeast-3-installer.s3.amazonaws.com
- vicarius-ap-southeast-3-installer.s3.ap-southeast-3.amazonaws.com
- vicarius-ap-southeast-3-patches.s3.amazonaws.com
- vicarius-ap-southeast-3-patches.s3.ap-southeast-3.amazonaws.com
- vicarius-ap-southeast-3-release.s3.amazonaws.com
- vicarius-ap-southeast-3-release.s3.ap-southeast-3.amazonaws.com
- Ports
- 443
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/vicarius_vrx_network_sigma.yml
- Description
- Detects potential network activity of Vicarius vRx RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/vicarius_vrx_files_sigma.yml
- Description
- Detects potential files activity of Vicarius vRx RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/vicarius_vrx_processes_sigma.yml
- Description
- Detects potential processes activity of Vicarius vRx RMM tool
References
- https://customer-portal.vicarius.io/vrx-logs-and-files
- https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en
- https://www.huntress.com/blog/two-inc-ransom-notes
- https://www.vicarius.io/features/scripting
- https://customer-portal.vicarius.io/vrx-my-scripts
- https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent
- https://customer-portal.vicarius.io/macos-useful-commands
Acknowledgements
- Person
- Liran Ravich, Cribl
- Handle
- Not recorded