Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. Remsec

Remsec

Remsec is a modular backdoor that has been used byStrider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua.[1]

ID: S0125
ⓘ
Associated Software: Backdoor.Remsec, ProjectSauron
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.5
Created: 31 May 2017
Last Modified: 06 June 2025

Associated Software Descriptions

NameDescription
ProjectSauron

ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125.[2]

Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1087.001Account Discovery:Local Account

Remsec can obtain a list of users.[3]

EnterpriseT1071.001Application Layer Protocol:Web Protocols

Remsec is capable of using HTTP and HTTPS for C2.[4][5][3]

.003Application Layer Protocol:Mail Protocols

Remsec is capable of using SMTP for C2.[4][5][3][6]

.004Application Layer Protocol:DNS

Remsec is capable of using DNS for C2.[4][5][3]

EnterpriseT1059.011Command and Scripting Interpreter:Lua

Remsec can use modules written in Lua for execution.[7]

EnterpriseT1025Data from Removable Media

Remsec has a package that collects documents from any inserted USB sticks.[3]

EnterpriseT1652Device Driver Discovery

Remsec has a plugin to detect active drivers of some security products.[3]

EnterpriseT1048.003Exfiltration Over Alternative Protocol:Exfiltration Over Unencrypted Non-C2 Protocol

Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.[5]

EnterpriseT1052.001Exfiltration Over Physical Medium:Exfiltration over USB

Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.[5]

EnterpriseT1068Exploitation for Privilege Escalation

Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.[3]

EnterpriseT1083File and Directory Discovery

Remsec is capable of listing contents of folders on the victim.Remsec also searches for custom network encryption software on victims.[4][5][3]

EnterpriseT1562.004Impair Defenses:Disable or Modify System Firewall

Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.[3]

EnterpriseT1070.004Indicator Removal:File Deletion

Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.[4][5][3]

EnterpriseT1105Ingress Tool Transfer

Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.[4][3]

EnterpriseT1056.001Input Capture:Keylogging

Remsec contains a keylogger component.[4][3]

EnterpriseT1036.005Masquerading:Match Legitimate Resource Name or Location

TheRemsec loader implements itself with the name Security Support Provider, a legitimate Windows function. VariousRemsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare.Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.[8][5]

EnterpriseT1556.002Modify Authentication Process:Password Filter DLL

Remsec harvests plain-text credentials as a password filter registered on domain controllers.[5]

EnterpriseT1046Network Service Discovery

Remsec has a plugin that can perform ARP scanning as well as port scanning.[3]

EnterpriseT1095Non-Application Layer Protocol

Remsec is capable of using ICMP, TCP, and UDP for C2.[4][5]

EnterpriseT1027.013Obfuscated Files or Information:Encrypted/Encoded File

Some data inRemsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.[4][3]

EnterpriseT1003.002OS Credential Dumping:Security Account Manager

Remsec can dump the SAM database.[3]

EnterpriseT1057Process Discovery

Remsec can obtain a process list from the victim.[3]

EnterpriseT1055.001Process Injection:Dynamic-link Library Injection

Remsec can perform DLL injection.[3]

EnterpriseT1018Remote System Discovery

Remsec can ping or traceroute a remote host.[3]

EnterpriseT1053.005Scheduled Task/Job:Scheduled Task

Remsec schedules the execution one of its modules by creating a new scheduler task.[3]

EnterpriseT1518.001Software Discovery:Security Software Discovery

Remsec has a plugin detect security products via active drivers.[3]

EnterpriseT1082System Information Discovery

Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.[3]

EnterpriseT1016System Network Configuration Discovery

Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.[3]

EnterpriseT1049System Network Connections Discovery

Remsec can obtain a list of active connections and open ports.[3]

EnterpriseT1033System Owner/User Discovery

Remsec can obtain information about the current user.[3]

Groups That Use This Software

IDNameReferences
G0041Strider

[1][2]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp