1. Home
  2. Software
  3. Shark

Shark

Shark is a backdoor malware written in C# and .NET that is an updated version of Milan; it has been used by HEXANE since at least July 2021.[1][2]

ID: S1019
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 10 June 2022
Last Modified: 11 April 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

Shark can upload files to its C2.[1][2]
Enterprise T1036 .005 伪装: Match Legitimate Name or Location

Shark binaries have been named audioddg.pdb and Winlangdb.pdb in order to appear legitimate.[1]
Enterprise T1568 .002 动态解析: Domain Generation Algorithms

Shark can send DNS C2 communications using a unique domain generation algorithm.[1][2]
Enterprise T1140 反混淆/解码文件或信息

Shark can extract and decrypt downloaded .zip files.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Shark has the ability to use CMD to execute commands.[1][2]
Enterprise T1008 回退信道

Shark can update its configuration to use a different C2 server.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

Shark has the ability to use HTTP in C2 communications.[1][2]
.004 应用层协议: DNS

Shark can use DNS in C2 communications.[1][2]
Enterprise T1074 数据分段

Shark has stored information in folders named U1 and U2 prior to exfiltration.[1]
Enterprise T1012 查询注册表

Shark can query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid to retrieve the machine GUID.[2]
Enterprise T1027 .013 混淆文件或信息: Encrypted/Encoded File

Shark can use encrypted and encoded files for C2 configuration.[1][2]
Enterprise T1070 .004 移除指标: File Deletion

Shark can delete files downloaded to the compromised host.[1]
Enterprise T1082 系统信息发现

Shark can collect the GUID of a targeted machine.[1][2]
Enterprise T1497 .001 虚拟化/沙盒规避: System Checks

Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.[1]
Enterprise T1105 输入工具传输

Shark can download additional files from its C2 via HTTP or DNS.[1][2]
Enterprise T1041 通过C2信道渗出

Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.[1]
Enterprise T1029 预定传输

Shark can pause C2 communications for a specified time.[1]

Groups That Use This Software

ID Name References
G1001 HEXANE

[3][2]

References

  1. ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.
  2. Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.
  1. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.