MITRE ATT&CKsoftware (malware)

S0125 Remsec

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Backdoor.Remsec, ProjectSauron
Version
1.5
Created
2017-05-31

Description

Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua.

Related

Uses · MITRE ATT&CK (30)

  • T1686.003 Windows Host Firewall sub-technique
  • T1059.011 Lua sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1652 Device Driver Discovery technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1052.001 Exfiltration over USB sub-technique
  • T1087.001 Local Account sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1056.001 Keylogging sub-technique
  • T1556.002 Password Filter DLL sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1025 Data from Removable Media technique
  • T1033 System Owner/User Discovery technique
  • T1046 Network Service Discovery technique
  • T1049 System Network Connections Discovery technique
  • T1057 Process Discovery technique
  • T1068 Exploitation for Privilege Escalation technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References