Malware

ShimRatReporter

ShimRatReporter is a Windows malware component focused on automated host reconnaissance and reporting to command-and-control infrastructure. It collects system and user-context information without requiring operator tasking, then compiles the results into reports for transmission to the operators. Observed collection includes running process enumeration, installed software discovery, and detailed local network configuration profiling such as proxy settings, domain information, IP addressing, routing data, MAC address, gateway, DNS servers, and DHCP status. It also uses Windows API functions to gather information from the infected system and has been observed identifying connected UDP endpoints through native API calls. Collected reconnaissance data is compressed with an LZ-based method before transmission and sent to command-and-control servers via HTTP POST requests. The malware has also used masquerading, presenting itself as a benign specialized Unicode font component to reduce suspicion. Overall, ShimRatReporter functions as a reconnaissance-oriented implant or reporting module used for post-compromise host profiling and exfiltration of collected system information over its C2 channel.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1106Native APIEvidence1

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence4

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1036MasqueradingEvidence3

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence5

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1057Process DiscoveryEvidence4

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence10

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

T1518Software DiscoveryEvidence3

"Bazar can query the Registry for installed applications"; "BRONZE BUTLER has used tools to enumerate software installed"; "Volt Typhoon has queried the Registry...for information on installed software"; "Windigo has used a script to detect installed software"

Collection

2 techniques

T1119Automated CollectionEvidence1

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.

T1560Archive Collected DataEvidence2

"AppleSeed has compressed collected data before exfiltration."; "APT28 used a publicly available tool to gather and compress multiple documents..."; "Aria-body has used ZIP to compress data..."; "Cadelspy...compress stolen data into a .cab file."; "Daserf hides collected data in password-protected .rar archives."; "FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration."; "Lazarus Group has compressed exfiltrated data with RAR...archive specified directories in .zip format"; "XCSSET will compress entire ~/Desktop folders..."

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

ADVSTORESHELL exfiltrates data over the same channel used for C2.

ACTIVITY FEED

Recent activity

29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

29 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Gathers extensive network and proxy configuration data including IP, routing, MAC, gateway, DNS, and DHCP status.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware component that uses Windows APIs to gather information from infected systems.

mitre attack websiteNews

Oct 21, 2021

Masquerading: Match Legitimate Name or Location, Sub-technique T1036.005 - Enterprise | MITRE ATT&CK®

Malware that spoofs specialized software filenames to appear benign.

mitre attack websiteNews

Oct 21, 2021

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Remote access trojan that gathers extensive network configuration data including proxy, domain, IP, routing, MAC, gateway, DNS, and DHCP status.

+25 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ShimRatReporter