ShellReset Remote Access Trojan
ShellReset is a newly observed .NET remote access trojan believed to be based on the older Quasar malware.
Summary
ShellReset is a newly observed .NET remote access trojan believed to be based on the older Quasar malware.
Affected platforms
The following platforms are known to be affected:
Threat details
Delivery of ShellReset is via macro-laden Microsoft Word files, themselves distributed as attachments in spam campaigns targeting a number of London-based events. These document macros contain embedded C# code, which is compiled by the macro into the primary ShellReset binary before being executed. The macros will also set several working directories for ShellReset to operate in.
Once installed, ShellReset will collect system information to send to a command and control (C2) server, before awaiting further instructions. Commands are sent from the C2 server as GET requests, with ShellReset able to execute commands and payloads, take screenshots, and upload files to the C2 server.
Remediation steps
| Type | Step |
|---|---|
|
To prevent and detect a trojan infection, NHS Digital advises that:
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages. |
Indicators of compromise
Last edited: 29 June 2021 12:01 pm