Remexi usesBITSAdmin to communicate with the C2 server over HTTP.^[1]

Remexi has a command to capture active windows on the machine and retrieve window titles.^[1]

Remexi encrypts and adds all gathered browser data into files for upload to C2.^[1]

Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.^[1]

Remexi achieves persistence using Userinit by adding the Registry keyHKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit.^[1]

Remexi collects text from the clipboard.^[1]

Remexi silently executes received commands with cmd.exe.^[1]

Remexi uses AutoIt and VBS scripts throughout its execution process.^[1]

Remexi decrypts the configuration data using XOR with 25-character keys.^[1]

Remexi performs exfiltration overBITSAdmin, which is also used for the C2 channel.^[1]

Remexi searches for files on the system.^[1]

Remexi gathers and exfiltrates keystrokes from the machine.^[1]

Remexi obfuscates its configuration data with XOR.^[1]

Remexi utilizes scheduled tasks as a persistence mechanism.^[1]

Remexi takes screenshots of windows of interest.^[1]

Remexi executes received commands with wmic.exe (for WMI commands).^[1]

^[2][1][3]