Skip to content

ShimRat

Software · ATTACK:enterprise:S0444

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0444",
  "title": "ShimRat",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0444",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--5763217a-05b6-4edd-9bca-057e47b5e403",
  "external_id": "S0444",
  "domain": "enterprise",
  "created": "2020-05-12T21:28:20.934Z",
  "modified": "2025-04-25T14:43:24.555Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "FOX-IT May 2016 Mofang",
      "url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0177d430-a0b9-4f2f-8c66-8dfa4391611a

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d1314fe-7fd6-4816-abb8-4b9872478807

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4439e86a-de1d-4ea6-a856-858b799bcdc5

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58238854-4649-4cea-a43d-aae442dc60a6

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6435caf7-2493-4cfb-9ddc-2f672c220251

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--684b6701-559f-4ba9-a2b0-f79ed5683eb1

FOX-IT May 2016 Mofang

ATTACK:enterprise:G0103 → uses → ATTACK:enterprise:S0444

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f82d8a7-d168-4e19-97d2-3950f0c649ce

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7060e30c-cbb6-4b79-ad52-5e1619e030f0

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7288054b-0679-497a-b4c5-090801b06941

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80a14bfe-6bf6-4f87-8ae1-5085505656f2

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84d3fa4b-a4c6-404c-a363-0d9a96381952

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--980a5f66-14d7-42c6-82f7-ef96cbab77bb

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1546.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ec20e7b-8996-4f16-b830-1f8a0e99b778

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2118212-1594-4fb1-8076-5a8649756c9c

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac88262c-e14d-4f52-a5df-bbddc6d5c1bc

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b057569e-0e0b-4e8e-9955-016a556b8248

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdd7c955-c41a-4b68-9eb6-1ecd66869457

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--caa8b50b-67ab-4de4-b61a-ab89ea8a2e9b

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2ef2109-c65f-452b-bb5b-dd06d1b16602

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6d72bc4-c8d7-48b3-96c3-84a9810333d2

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec095867-cb54-4fcf-b2c7-00e805bf7500

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f81b567d-9fd3-44f4-bd6b-9ba6f386609e

FOX-IT May 2016 Mofang

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.