Threat Intelligence Directory

Malware family identifying win.shrinklocker. Origin and technical characteristics tracked via Malpedia.

According to STRIKE, ShortLeash is a custom backdoor used to create an ORB network. It generates unique, self-signed TLS certificates with spoofed metadata for each node. Analysis of these certificates revealed over 1000 active nodes globally and victimology supports attribution to China-Nexus APTs.

SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.

Malware family identifying win.shimrat. Origin and technical characteristics tracked via Malpedia.

Shifu was originally discovered by Trusteer security researchers (Ilya Kolmanovich, Denis Laskov) in the middle of 2015. It is a banking trojan mostly focusing on Japanese banks and has rich features for remote data extraction and control.

According to IBM X-Force, this is a modular backdoor that was used for targeting the defense sector of Ukraine. It uses the Dropbox API for C2 and data exfiltration.

PCRIsk states that ShellLocker is a ransomware-type virus developed using .NET framework. It was first discovered by Jakub Kroustek and is virtually identical to another ransomware virus called Exotic. Following infiltration, this virus encrypts stored data (video, audio, etc.) and renames encrypted files using the "[random_characters].L0cked" pattern (e.g., "sample.jpg" might be renamed to "gd&=AA0fgoi.L0cked"). Following successful encryption, ShellLocker opens a pop-up window containing ransom-demand message.

Malware family identifying win.shellclient. Origin and technical characteristics tracked via Malpedia.

According to Zscaler, SHEETCREEP is a lightweight backdoor written in C# that uses Google Sheets for C2 communication.

Kaspersky Labs observed Andariel to drop this ransomware in one case within a series of attacks carried out against targets in South Korea in April 2021.

Malware family identifying win.sharp_rhino. Origin and technical characteristics tracked via Malpedia.

SharPyShell is a tiny and obfuscated ASP.NET webshell that executes commands received by an encrypted channel compiling them in memory at runtime. SharPyShell supports only C# web applications that runs on .NET Framework >= 2.0 VB is not supported atm.

According to its Github repository, SharpWMI is a C# implementation of various WMI functionality.

Malware family identifying win.sharpstats. Origin and technical characteristics tracked via Malpedia.

The SharpStage backdoor is a .NET malware with backdoor capabilities. Its name is a derivative of the main activity class called “Stage_One”. SharpStage can take screenshots, run arbitrary commands and downloads additional payloads. It exfiltrates data from the infected machine to a dropbox account by implementing a dropbox client in its code. SharpStage was seen used by the Molerats group in targeted attacks in the middle east.

This tool is made to simplify penetration testing of networks and to create a Swiss-army knife that is made for running on Windows which is often a requirement during insider threat simulation engagements.

Malware family identifying win.sharpknot. Origin and technical characteristics tracked via Malpedia.

According to its Github repository, SharpHound is a C# Data Collector for BloodHound.

.NET reimplementation of Cobalt Strike beacon/stager

Malware family identifying win.shark. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shareip. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shapeshift. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shakti. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shady_hammock. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shadow_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shadowpad. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shadowhammer. Origin and technical characteristics tracked via Malpedia.

Ransomware

A malicious IIS module that allows up/download of files, remote command execution, and using the compromised server as a hop into the network behind.

ServHelper is written in Delphi and according to ProofPoint best classified as a backdoor. ProofPoint noticed two distinct variant - "tunnel" and "downloader" (citation): "The 'tunnel' variant has more features and focuses on setting up reverse SSH tunnels to allow the threat actor to access the infected host via Remote Desktop Protocol (RDP). Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to 'hijack' legitimate user accounts or their web browser profiles and use them as they see fit. The 'downloader' variant is stripped of the tunneling and hijacking functionality and is used as a basic downloader."

Malware family identifying win.serpico. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.serpent. Origin and technical characteristics tracked via Malpedia.

This malware is protected using VMProtect and related to the loading of KEYPLUG.

Malware family identifying win.sepulcher. Origin and technical characteristics tracked via Malpedia.

Ransomware.

Malware family identifying win.sendsafe. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.selfmake. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, Sekhmet is ransomware. This malicious program operates by encrypting data and demanding ransom payments for decryption. During the encryption process, all affected files are appended with an extension, consisting of random characters (e.g. ".HrUSsw", ".WNgh", ".NdWfEr", etc.).

Malware family identifying win.seinup. Origin and technical characteristics tracked via Malpedia.

simple tool to facilitate download and persistence of a next-stage tool; collects system information and metadata probably in an attempt to tell sandbox-environments apart from real targets on the server-side; uses domains of search engines like Google to check for Internet connectivity; XOR-based string obfuscation with a 16-byte key