Remexi developers use the C programming language and GCC compiler on Windows in the MinGW environment. The malware utilizes several persistence mechanisms including scheduled tasks, Userinit and Run registry keys in the HKLM hive