Sencillo RMM remote-access kit: operator panels and delivery stagers

Operator panels and delivery files of 'Sencillo RMM', a self-hosted remote-access kit. Its Go agent checks in with the panel every 15 to 19 seconds and takes commands to run PowerShell, switch off Microsoft Defender through policy settings, bypass User Account Control, persist at logon, inject shellcode and silently install a ScreenConnect remote-support client tied to the operator's own account. A 'VM Guard' switch tells any agent that reports a virtual machine or sandbox to delete itself. The panel needs no login and carries a builder that wraps one PowerShell line, which downloads the agent into the temp folder as MsEdgeUpdate.exe, as an HTA, Office macro, PowerShell or shortcut file. The operator also used a JScript HTA that drops the agent as dllhost.exe, and DLL-sideloading archives dressed as Zoom, Teams, OneDrive and Adobe Creative Cloud installers. A match means a page built from that panel, a page or file carrying one of these stagers, or a scan of the known panel at 193.180.209[.]78 port 7443.