Procedure examples

ShimRat has the capability to upload collected files to a C2.

ShimRat has used a secondary C2 location if the first was unavailable.

ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.

ShimRat can sleep when instructed to do so by the C2.

ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.

ShimRat can be issued a command shell function from the C2.

ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.

ShimRat communicated over HTTP and HTTPS with C2 servers.

ShimRat can list directories.

ShimRat can use pre-configured HTTP proxies.

ShimRat can download additional files.

ShimRat has used Windows API functions to install the service and shim.

ShimRat has registered two registry keys for shim databases.

ShimRat can enumerate connected drives for infected host machines.

ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.

ShimRat has installed a Windows service to maintain persistence on victim machines.

ShimRat has installed shim databases in the AppPatch folder.

ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.

ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.

ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.