MITRE ATT&CKsoftware (malware)
S0444 ShimRat
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2020-05-12
Description
ShimRat has been used by the suspected China-based adversary Mofang in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development. The name "ShimRat" comes from the malware's extensive use of Windows Application Shimming to maintain persistence.
Related
Uses · MITRE ATT&CK (21)
- T1027.015 Compression sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.002 External Proxy sub-technique
- T1574 Hijack Execution Flow technique
- T1059.003 Windows Command Shell sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1027.002 Software Packing sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1546.011 Application Shimming sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1008 Fallback Channels technique
- T1029 Scheduled Transfer technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
- T1112 Modify Registry technique
Referenced by MITRE ATT&CK · uses (1)
- G0103 Mofang group
References
- https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf FOX-IT May 2016 Mofang