Procedure examples

Remexi has a command to capture active windows on the machine and retrieve window titles.

Remexi obfuscates its configuration data with XOR.

Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.

Remexi executes received commands with wmic.exe (for WMI commands).

Remexi utilizes scheduled tasks as a persistence mechanism.

Remexi gathers and exfiltrates keystrokes from the machine.

Remexi silently executes received commands with cmd.exe.

Remexi uses AutoIt and VBS scripts throughout its execution process.

Remexi uses BITSAdmin to communicate with the C2 server over HTTP.

Remexi searches for files on the system.

Remexi takes screenshots of windows of interest.

Remexi collects text from the clipboard.

Remexi decrypts the configuration data using XOR with 25-character keys.

Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.

Remexi achieves persistence using Userinit by adding the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit.

Remexi encrypts and adds all gathered browser data into files for upload to C2.