RAT
WinSCP
WinSCP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RAT
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2024-08-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
C:\Users\IEUser\Downloads\WinSCP-5.21.6-Portable\*
*\WinSCP*Portable\*
*\WinSCP.exe
*\WinSCP\*
Code signing
- signer name
- Martin Prikryl
- certificate thumbprint
- FB845245CFBB0EE97E76C775348CAA31D74BEC4C
- tbs sha256
- 74EEE4DFE920C6143FD736784DCFB3940980CC4146631D445F9BB116497B16E6
- tbs sha1
- Not recorded
- signer name
- Martin Prikryl
- certificate thumbprint
- N/A
- tbs sha256
- Not recorded
- tbs sha1
- D2F63F6BE83E61B9E64E25752802F7F06F8B5BE5
- signer name
- Martin Prikryl
- certificate thumbprint
- 0DEE8F52D6B8D8C4B2C9573F4299FD97D707BAB7
- tbs sha256
- C90767BFCA208A4FC3C990310D616C50B6E79AE77085E46A53EFA484A4E142F6
- tbs sha1
- Not recorded
- signer name
- RARE IDEAS, LLC
- certificate thumbprint
- 436F0AAD2181EDA5B606CA9BDD8D7B259833306A
- tbs sha256
- 791D415EAA0D30EEC874E1CC045F5076A41C741F792D6B9789F7E28DFB9127BD
- tbs sha1
- Not recorded
search names
39a4d16980a27a88493f519aa458e837856ac60a7037afe10985f8947991ef72-dropped.bin
company names
signer names
Martin Prikryl
RARE IDEAS, LLC
File hashes
- authenticode
- file name
- 39a4d16980a27a88493f519aa458e837856ac60a7037afe10985f8947991ef72-dropped.bin
- sha256
- 39A4D16980A27A88493F519AA458E837856AC60A7037AFE10985F8947991EF72
- sha1
- 6AA74A53453EBA483CF564C22129763D9D96FB07
- page
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/winscp_processes_sigma.yml
- Description
- Detects potential processes activity of WinSCP RMM tool