Remexi

ATP Sandbox Adv. Heuristics

Description

Remexi is a Windows based trojan written in the C programming language, documented in campaigns attributed to Iranian state sponsored actors.

Stats

First seen: March 2022
Last seen: October 2026

MITRE ATT&CK techniques

16 techniques across 7 tactics.

TA0002 Execution

T1047Windows Management Instrumentation
T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.005Visual Basic

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder
- T1547.004Winlogon Helper DLL

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1010Application Window Discovery
T1083File and Directory Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture
T1115Clipboard Data
T1560Archive Collected Data

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G0087APT39

Alert name variants

Alert Name	Engine
Win32.Backdoor.Remexi	ATP Sandbox Adv. Heuristics
Win32.Infostealer.Remexi	ATP Sandbox Adv. Heuristics
Win32.Trojan.Remexi	ATP Sandbox Adv. Heuristics

Related families

Metamorfo QakBot DarkGate Empire Machete

References