1. Home
  2. Software
  3. RemoteUtilities

RemoteUtilities

RemoteUtilities is a legitimate remote administration tool that has been used by MuddyWater since at least 2021 for execution on target machines.[1]

ID: S0592
ⓘ
Type: TOOL
ⓘ
Platforms: Windows
Version: 1.0
Created: 18 March 2021
Last Modified: 25 April 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1083 File and Directory Discovery

RemoteUtilities can enumerate files and directories on a target machine.[1]
Enterprise T1105 Ingress Tool Transfer

RemoteUtilities can upload and download files to and from a target machine.[1]
Enterprise T1113 Screen Capture

RemoteUtilities can take screenshots on a compromised host.[1]
Enterprise T1218 .007 Signed Binary Proxy Execution: Msiexec

RemoteUtilities can use Msiexec to install a service.[1]

Groups That Use This Software

ID Name References
G0069 MuddyWater

[1]

References

  1. Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.