Threat Intelligence Directory

Malware family tracked by Malpedia. ID: win.sinowal

Malware family tracked by Malpedia. ID: win.simplefilemover

Malware family tracked by Malpedia. ID: win.simda

Malware family tracked by Malpedia. ID: win.siluhdur

Malware family tracked by Malpedia. ID: win.silon

Malware family tracked by Malpedia. ID: win.silent_sweeper

According to Mandiant, SILENTUPLOADER is an uploader written in MSIL that is dropped by DOSTEALER and is designed to work specifically in tandem with it. It checks for files in a specified folder every 30 seconds and uploads them to a remote server.

Malware family tracked by Malpedia. ID: win.silentgh0st

Malware family tracked by Malpedia. ID: win.sihost

Malware family tracked by Malpedia. ID: win.sigloader

Malware family tracked by Malpedia. ID: win.siggen6

Malware family tracked by Malpedia. ID: win.siesta_graph

Malware family tracked by Malpedia. ID: win.sierras

Ransomware used by threat actor group DEV-0530, attributed by MSTIC to North Korean origin.

Ransomware used by threat actor group DEV-0530, attributed by MSTIC to North Korean origin.

Malware family tracked by Malpedia. ID: elf.sidewalk

Malware family tracked by Malpedia. ID: win.sidetwist

Malware family tracked by Malpedia. ID: win.shylock

Malware family tracked by Malpedia. ID: win.shurl0ckr

Malware family tracked by Malpedia. ID: win.shurk

Malware family tracked by Malpedia. ID: win.shrinklocker

According to STRIKE, ShortLeash is a custom backdoor used to create an ORB network. It generates unique, self-signed TLS certificates with spoofed metadata for each node. Analysis of these certificates revealed over 1000 active nodes globally and victimology supports attribution to China-Nexus APTs.

SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.

Malware family tracked by Malpedia. ID: win.shimrat

Shifu was originally discovered by Trusteer security researchers (Ilya Kolmanovich, Denis Laskov) in the middle of 2015. It is a banking trojan mostly focusing on Japanese banks and has rich features for remote data extraction and control.

According to IBM X-Force, this is a modular backdoor that was used for targeting the defense sector of Ukraine. It uses the Dropbox API for C2 and data exfiltration.

PCRIsk states that ShellLocker is a ransomware-type virus developed using .NET framework. It was first discovered by Jakub Kroustek and is virtually identical to another ransomware virus called Exotic. Following infiltration, this virus encrypts stored data (video, audio, etc.) and renames encrypted files using the "[random_characters].L0cked" pattern (e.g., "sample.jpg" might be renamed to "gd&=AA0fgoi.L0cked"). Following successful encryption, ShellLocker opens a pop-up window containing ransom-demand message.

Malware family tracked by Malpedia. ID: win.shellclient

According to Zscaler, SHEETCREEP is a lightweight backdoor written in C# that uses Google Sheets for C2 communication.

Kaspersky Labs observed Andariel to drop this ransomware in one case within a series of attacks carried out against targets in South Korea in April 2021.

Malware family tracked by Malpedia. ID: win.sharp_rhino

SharPyShell is a tiny and obfuscated ASP.NET webshell that executes commands received by an encrypted channel compiling them in memory at runtime. SharPyShell supports only C# web applications that runs on .NET Framework >= 2.0 VB is not supported atm.

According to its Github repository, SharpWMI is a C# implementation of various WMI functionality.

Malware family tracked by Malpedia. ID: win.sharpstats

The SharpStage backdoor is a .NET malware with backdoor capabilities. Its name is a derivative of the main activity class called “Stage_One”. SharpStage can take screenshots, run arbitrary commands and downloads additional payloads. It exfiltrates data from the infected machine to a dropbox account by implementing a dropbox client in its code. SharpStage was seen used by the Molerats group in targeted attacks in the middle east.

This tool is made to simplify penetration testing of networks and to create a Swiss-army knife that is made for running on Windows which is often a requirement during insider threat simulation engagements.

Malware family tracked by Malpedia. ID: win.sharpknot

According to its Github repository, SharpHound is a C# Data Collector for BloodHound.

.NET reimplementation of Cobalt Strike beacon/stager

Malware family tracked by Malpedia. ID: win.shareip