.. /Remote Utilities
Star

Author: Remote Utilities
Website: https://www.remoteutilities.com

Remote Utilities is a tool that offers remote access to devices. This can be direct connections or access via the internet.

Artifacts

Windows

Privileges: User
Path(s):

%PROGRAMFILES(X86)%\Remote Utilities - Host\
%PROGRAMFILES(X86)%\Remote Utilities - Server\
%PROGRAMFILES(X86)%\Remote Utilities - Viewer\

Domains

id.remoteutilities.com
server.remoteutilities.com
*.remoteutilities.com

Ports

TCP 443 Inbound (Host) public server, in case port 5655 is blocked
TCP 443 Outbound (Viewer) public server, in case port 5655 is blocked
TCP 5650 Inbound (Host/Agent) direct connection, default port can be changed
TCP 5650 Outbound (Viewer) direct connection, default port can be changed
TCP 5655 Inbound (Host) public server
TCP 5655 Outbound (Viewer) public server
TCP 5670 Inbound (RU Server PC)
TCP 5670 Outbound (Admin console PC)

Remediation

Blocking id.remoteutilities.com blocks the connection to the internet relay server.

Resources

https://ics-cert.kaspersky.com/media/TV_RMS_PHISHING_EN.pdf