MITRE ATT&CKsoftware (tool)
S0445 ShimRatReporter
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2020-05-12
Description
ShimRatReporter is a tool used by suspected Chinese adversary Mofang to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as ShimRat) as well as set up faux infrastructure which mimics the adversary's targets. ShimRatReporter has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.
Related
Uses · MITRE ATT&CK (16)
- T1071.001 Web Protocols sub-technique
- T1560 Archive Collected Data technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1518 Software Discovery technique
- T1016 System Network Configuration Discovery technique
- T1020 Automated Exfiltration technique
- T1027 Obfuscated Files or Information technique
- T1041 Exfiltration Over C2 Channel technique
- T1049 System Network Connections Discovery technique
- T1057 Process Discovery technique
- T1069 Permission Groups Discovery technique
- T1082 System Information Discovery technique
- T1087 Account Discovery technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
- T1119 Automated Collection technique
Referenced by MITRE ATT&CK · uses (1)
- G0103 Mofang group
References
- https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf FOX-IT May 2016 Mofang