FOX-IT May 2016 Mofang

ShimRat has the capability to upload collected files to a C2.

ShimRat has used a secondary C2 location if the first was unavailable.

ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.

ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.

ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.

ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.

Mofang has encrypted payloads before they are downloaded to victims.

Mofang has compressed the ShimRat executable within malicious email attachments.

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.

ShimRat can sleep when instructed to do so by the C2.

ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.

ShimRatReporter spoofed itself as AlphaZawgyl_font.exe, a specialized Unicode font.

ShimRatReporter sent generated reports to the C2 via HTTP POST requests.

ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.

ShimRatReporter listed all running processes on the machine.

ShimRat can be issued a command shell function from the C2.

ShimRatReporter gathered the local privileges for the infected host.

ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.

ShimRat communicated over HTTP and HTTPS with C2 servers.

ShimRatReporter communicated over HTTP with preconfigured C2 servers.

ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.

ShimRat can list directories.

ShimRatReporter listed all non-privileged and privileged accounts available on the machine.

ShimRat can use pre-configured HTTP proxies.

ShimRat can download additional files.

ShimRatReporter had the ability to download additional payloads.

ShimRatReporter used several Windows API functions to gather information from the infected system.

ShimRat has used Windows API functions to install the service and shim.

ShimRat has registered two registry keys for shim databases.

ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.

ShimRat can enumerate connected drives for infected host machines.

ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.

Mofang's malicious spearphishing attachments required a user to open the file after receiving.

ShimRatReporter gathered a list of installed software on the infected host.

ShimRat has installed a Windows service to maintain persistence on victim machines.

ShimRat has installed shim databases in the AppPatch folder.

ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.

ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.

ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.

Mofang delivered spearphishing emails with malicious links included.

ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.