Search/Remsec
● Malware

Remsec

Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
31 relationships
T1053.005: Scheduled Task
source
T1033: System Owner/User Discovery
source
T1056.001: Keylogging
source
T1027.013: Encrypted/Encoded File
source
T1003.002: Security Account Manager
source
T1071.004: DNS
source
T1025: Data from Removable Media
source
T1036.005: Match Legitimate Resource Name or Location
source
T1652: Device Driver Discovery
source
T1087.001: Local Account
source
T1686.003: Windows Host Firewall
source
T1082: System Information Discovery
source
T1556.002: Password Filter DLL
source
T1071.003: Mail Protocols
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
T1049: System Network Connections Discovery
source
T1057: Process Discovery
source
T1052.001: Exfiltration over USB
source
T1059.011: Lua
source
T1068: Exploitation for Privilege Escalation
source
T1095: Non-Application Layer Protocol
source
T1518.001: Security Software Discovery
source
T1070.004: File Deletion
source
T1071.001: Web Protocols
source
T1018: Remote System Discovery
source
T1046: Network Service Discovery
source
T1105: Ingress Tool Transfer
source
T1055.001: Dynamic-link Library Injection
source
T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol
source