Procedure examples

Remsec can dump the SAM database.

Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.

Remsec can ping or traceroute a remote host.

Remsec has a package that collects documents from any inserted USB sticks.

Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.

Remsec can obtain information about the current user.

The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.

Remsec has a plugin that can perform ARP scanning as well as port scanning.

Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.

Remsec can obtain a list of active connections and open ports.

Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.

Remsec schedules the execution one of its modules by creating a new scheduler task.

Remsec can perform DLL injection.

Remsec contains a keylogger component.

Remsec can obtain a process list from the victim.

Remsec can use modules written in Lua for execution.

Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.

Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.

Remsec is capable of using HTTP and HTTPS for C2.

Remsec is capable of using SMTP for C2.

Remsec is capable of using DNS for C2.

Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.

Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.

Remsec can obtain a list of users.

Remsec is capable of using ICMP, TCP, and UDP for C2.

Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.

Remsec has a plugin detect security products via active drivers.

Remsec harvests plain-text credentials as a password filter registered on domain controllers.

Remsec has a plugin to detect active drivers of some security products.

Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.