Procedure examples

RCSession can collect data from a compromised host.

RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.

RCSession can compress and obfuscate its strings to evade detection on a compromised host.

RCSession can gather system owner information, including user and administrator privileges.

RCSession has used a file named English.rtf to appear benign on victim hosts.

RCSession can launch itself from a hollowed svchost.exe process.

RCSession has the ability to capture keystrokes on a compromised host.

RCSession can identify processes based on PID.

RCSession can use `cmd.exe` for execution on compromised hosts.

RCSession can remove files from a targeted system.

RCSession can use HTTP in C2 communications.

RCSession can gather system information from a compromised host.

RCSession has the ability to use TCP and UDP in C2 communications.

RCSession has the ability to drop additional files to an infected machine.

RCSession can use WinSock API for communication including WSASend and WSARecv.

RCSession can write its configuration file to the Registry.

RCSession can capture screenshots from a compromised host.

RCSession has the ability to execute inside the msiexec.exe process.

RCSession has the ability to modify a Registry Run key to establish persistence.

RCSession can bypass UAC to escalate privileges.

RCSession can use an encrypted beacon to check in with C2.

RCSession can be installed via DLL side-loading.