Conrad Sallian's community posts


C2 Defender Alerts

Hello everyone,

Yes, it is our server at 172.241.164.247. RU uses end-to-end encryption, and the servers simply relay the encrypted traffic. They cannot inspect forwarded packets and do not store any data.

The reason for this alert is banal and very typical for the modern “security industry”. Apparently, someone was “hacked” using social engineering methods, which in this case simply means they voluntarily installed RU, gave their access credentials to a fraudster/attacker, and the attacker connected to their computer using RU. The victim then complained to their ISP, the ISP submitted an “abuse report” to the hosting provider Leaseweb, and that was enough for the IP address to be labeled as a “botnet server”, despite the fact that it is used by hundreds of thousands of perfectly legitimate connections.

I don't know if it's possible to guarantee the ip-addresses are actually official RU servers. I

It is possible. Just ask here and we will answer. However, we will not disclose our entire infrastructure because we do not want it to be DDoSed or otherwise targeted. That is quite understandable.

Do not hesitate to ask if you have any questions.

Beta testing: Remote Utilities for macOS/Linux

Hello everyone,

We've updated the macOS and Linux versions to beta 24. A final release will follow soon once we implement the file manager (File Transfer mode), which is our current top priority.

rpm packages will not install

Hello,

We've updated the following packages:

Viewer (deb)
Viewer (rpm)
Host (deb)
Host (rpm)

Feel free to download the updated files on this page:
https://www.remoteutilities.com/download/linux.php.

rpm packages will not install

Hello Emiliano,

Yes, we are currently looking into this issue. Sorry for the inconvenience.

Beta testing: Remote Utilities for macOS/Linux

Hi M P,

Since Bazzite uses an immutable (rpm-ostree) system, installing the Host via RPM can cause version conflicts.

Please try installing the Host from the binary archive instead:

1. Download the archive:
https://www.remoteutilities.com/download/host1.0.23.b23.tar.xz

2. Extract it and run the installer as root:


tar -xf host1.0.23.b23.tar.xz
cd host1.0.23.b23
sudo ./host -install
Let us know if you run into any issues.

ERROR 1722 WHEN INSTALLING HOST

Hello John,

Thank you for your message.

No, you don't have to install Viewer. The exe file is a wrapper over the msi, so this error indicates that there's an issue with installing an msi package on this computer.

Please, refer to this MS knowledge base article, it may help to resolve it:
https://support.microsoft.com/en-us/topic/fix-problems-that-block-programs-from-being-installed-or-removed-cca7d1b6-65a9-3d98-426b-e9f927e1eb4d

Beta testing: Remote Utilities for macOS/Linux

Hi Jim,

Thank you for the feedback. Unfortunately it's a current limitation of the beta version.

Beta testing: Remote Utilities for macOS/Linux

Dear users and beta testers,

We have released the first beta version of Remote Utilities Host for macOS. Feel free to download and test it — we appreciate your feedback.

P.S. The version number is beta 23 so that it matches the rest of the macOS and Linux modules.

[Resolved] Defender for Endpoint Alert?

Hello,

You can simply add the folder from which you run the Agent (after downloading it) to your antivirus exceptions.

If you're using the Host (the persistent module), make sure to whitelist the following folder:
C:\Program Files (x86)\Remote Utilities - Host\

[Resolved] Defender for Endpoint Alert?

Hello,

Remote Utilities Host runs as a Windows SYSTEM service. When the Host needs to “enter” a different Windows session, Windows uses the standard token duplication mechanism to create a session-appropriate process under the SYSTEM account.

This isn’t privilege escalation — the Host already runs with SYSTEM privileges as a service. Microsoft Defender sometimes flags this pattern generically because it can also appear in malware, but in this context it is part of normal, documented Windows functionality for remote-access and RMM tools.

Hope that helps.