Kaspersky ProjectSauron Technical Analysis

Remsec can dump the SAM database.

Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.

Remsec can ping or traceroute a remote host.

Remsec has a package that collects documents from any inserted USB sticks.

Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.

Remsec can obtain information about the current user.

Remsec has a plugin that can perform ARP scanning as well as port scanning.

Remsec can obtain a list of active connections and open ports.

Remsec schedules the execution one of its modules by creating a new scheduler task.

Remsec can perform DLL injection.

Remsec contains a keylogger component.

Remsec can obtain a process list from the victim.

Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.

Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.

Remsec is capable of using HTTP and HTTPS for C2.

Remsec is capable of using SMTP for C2.

Remsec is capable of using DNS for C2.

Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.

Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.

Remsec can obtain a list of users.

Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.

Remsec has a plugin detect security products via active drivers.

Remsec has a plugin to detect active drivers of some security products.

Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.