S0445 ShimRatReporter

toolEnterprise

platformsWindows

also known asShimRatReporter

ShimRatReporter is a tool used by suspected Chinese adversary Mofang to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as ShimRat) as well as set up faux infrastructure which mimics the adversary's targets. ShimRatReporter has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.

techniques used (16)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1020Automated Exfiltration
T1027Obfuscated Files or Information
T1036.005Match Legitimate Resource Name or Location
T1041Exfiltration Over C2 Channel
T1049System Network Connections Discovery
T1057Process Discovery
T1069Permission Groups Discovery
T1071.001Web Protocols
T1082System Information Discovery
T1087Account Discovery
T1105Ingress Tool Transfer
T1106Native API
T1119Automated Collection
T1518Software Discovery
T1560Archive Collected Data

used by groups (1)

Threat groups associated with this.

G0103Mofang

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan