Malware

ShimRat

ShimRat is a Windows remote access malware family associated with stealthy post-compromise operations. It uses application shimming and DLL hijacking techniques to load its core components, including a packed loader that carries a compressed core DLL alongside a legitimate library used for hijack-based execution. The malware has been observed decompressing its core DLL with shellcode after launching under the guise of an impersonated antivirus component, reflecting a strong emphasis on defense evasion and covert execution.

ShimRat establishes persistence through multiple mechanisms, including installation of a Windows service and fallback use of Registry Run autostart entries. It also registers shim database-related Registry entries and uses Windows API functions to install both the service and shim components. For privilege escalation, it has abused DLL hijacking involving a trusted Windows binary to suppress the expected UAC prompt and execute with elevated privileges.

Operationally, ShimRat supports resilient command-and-control by using a secondary C2 location when the primary one is unavailable and can communicate through pre-configured HTTP proxies. On infected hosts it can enumerate connected drives, upload collected files to command infrastructure, and perform a range of file-management actions including creating and modifying directories, moving, copying, renaming, and deleting files. It also includes self-removal capability, allowing operators to uninstall the implant and reduce forensic residue.

The observed tradecraft indicates a backdoor-oriented implant designed for persistent access, covert execution, privilege escalation, and file collection/exfiltration on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence3

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1106Native APIEvidence1

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

3 techniques

T1112Modify RegistryEvidence7

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1543.003Windows ServiceEvidence2

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

T1547.001Registry Run Keys / Startup FolderEvidence6

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

Privilege Escalation

3 techniques

T1543.003Windows ServiceEvidence2

T1547.001Registry Run Keys / Startup FolderEvidence6

T1548.002Bypass User Account ControlEvidence2

The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

"Action RAT's commands, strings, and domains can be Base64 encoded within the payload." / "ADVSTORESHELL... strings... encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed." / "APT29 has used encoded PowerShell commands." / "APT41 used VMProtected binaries..."

T1027.002Software PackingEvidence1

"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."

T1070.004File DeletionEvidence7

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1140Deobfuscate/Decode Files or InformationEvidence3

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

Defense Impairment

1 technique

T1112Modify RegistryEvidence7

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence3

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1135Network Share DiscoveryEvidence1

APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.

Collection

2 techniques

T1005Data from Local SystemEvidence1

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

T1560Archive Collected DataEvidence3

Examples in the content include 'DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules,' 'Molerats decompresses ZIP files once on the victim machine,' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'

Command and Control

4 techniques

T1008Fallback ChannelsEvidence1

APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1090.003Multi-hop ProxyEvidence1

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

ACTIVITY FEED

Recent activity

34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

34 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

Network Share Discovery, Technique T1135 - Enterprise | MITRE ATT&CK®

Remote access trojan that can enumerate connected drives on infected hosts.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Remote access trojan that uploads collected files to command-and-control servers.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Remote access trojan that uses Windows APIs to install a service and shim.

mitre attack websiteNews

Oct 21, 2021

Indicator Removal on Host: File Deletion, Sub-technique T1070.004 - Enterprise | MITRE ATT&CK®

Remote access trojan that can uninstall itself and perform extensive file operations including deletion.

+30 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ShimRat

The observed tradecraft indicates a backdoor-oriented implant designed for persistent access, covert execution, privilege escalation, and file collection/exfiltration on Windows systems.