| File name: | ATTACK SHARK G3 Software.exe |
| Full analysis: | https://app.any.run/tasks/f429a11b-b29a-40c9-894c-a81281be30b2 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | November 09, 2025, 16:58:14 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections |
| MD5: | 9BEF8FFC94477449EE8A97D93712251D |
| SHA1: | 269E320BF57F0334ADEA8EB7B79AA4915A2DB5C5 |
| SHA256: | F52B4314BFC10D8D0E40BF5C95E6170C0B436009F1C57E7FB02DD3A13F5F32AF |
| SSDEEP: | 98304:t+QqZ8fjOOiZb5fV9m9Vg+p/NCbOng4Nc0kaqsqZiG9s+b1zyv4xLi4Ft3znhw+/:Vi+m7r/n5JOWz/vH |
MALICIOUS
DRAYN mutex has been found
- ATTACK SHARK G3 Software.tmp (PID: 7268)
SUSPICIOUS
Executable content was dropped or overwritten
- ATTACK SHARK G3 Software.exe (PID: 7232)
- ATTACK SHARK G3 Software.tmp (PID: 7268)
Reads the Windows owner or organization settings
- ATTACK SHARK G3 Software.tmp (PID: 7268)
INFO
Create files in a temporary directory
- ATTACK SHARK G3 Software.exe (PID: 7232)
- ATTACK SHARK G3 Software.tmp (PID: 7268)
Checks supported languages
- ATTACK SHARK G3 Software.tmp (PID: 7268)
- ATTACK SHARK G3 Software.exe (PID: 7232)
Reads the computer name
- ATTACK SHARK G3 Software.tmp (PID: 7268)
Detects InnoSetup installer (YARA)
- ATTACK SHARK G3 Software.exe (PID: 7232)
- ATTACK SHARK G3 Software.tmp (PID: 7268)
Compiled with Borland Delphi (YARA)
- ATTACK SHARK G3 Software.exe (PID: 7232)
- ATTACK SHARK G3 Software.tmp (PID: 7268)
Creates files in the program directory
- ATTACK SHARK G3 Software.tmp (PID: 7268)
The sample compiled with russian language support
- ATTACK SHARK G3 Software.tmp (PID: 7268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:06:03 08:09:11+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741376 |
| InitializedDataSize: | 489984 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Guangzhou Junxingcheng Electronic Technology Co. |
| FileDescription: | Attack Shark Software Setup |
| FileVersion: | |
| LegalCopyright: | |
| OriginalFileName: | |
| ProductName: | Attack Shark Software |
| ProductVersion: | 1.0 |
Total processes
150
Monitored processes
4
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5268 | "C:\Users\admin\AppData\Local\Temp\ATTACK SHARK G3 Software.exe" | C:\Users\admin\AppData\Local\Temp\ATTACK SHARK G3 Software.exe | — | explorer.exe | |||||||||||
User: admin Company: Guangzhou Junxingcheng Electronic Technology Co. Integrity Level: MEDIUM Description: Attack Shark Software Setup Exit code: 3221226540 Version: Modules
| |||||||||||||||
| 7232 | "C:\Users\admin\AppData\Local\Temp\ATTACK SHARK G3 Software.exe" | C:\Users\admin\AppData\Local\Temp\ATTACK SHARK G3 Software.exe | explorer.exe | ||||||||||||
User: admin Company: Guangzhou Junxingcheng Electronic Technology Co. Integrity Level: HIGH Description: Attack Shark Software Setup Exit code: 5 Version: Modules
| |||||||||||||||
| 7268 | "C:\Users\admin\AppData\Local\Temp\is-9G5BU.tmp\ATTACK SHARK G3 Software.tmp" /SL5="$D02BC,6173185,1232384,C:\Users\admin\AppData\Local\Temp\ATTACK SHARK G3 Software.exe" | C:\Users\admin\AppData\Local\Temp\is-9G5BU.tmp\ATTACK SHARK G3 Software.tmp | ATTACK SHARK G3 Software.exe | ||||||||||||
User: admin Company: Guangzhou Junxingcheng Electronic Technology Co. Integrity Level: HIGH Description: Setup/Uninstall Exit code: 5 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 8028 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
534
Read events
531
Write events
3
Delete events
0
Modification events
| (PID) Process: | (7268) ATTACK SHARK G3 Software.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 641C0000EEA21A0D9A51DC01 | |||
| (PID) Process: | (7268) ATTACK SHARK G3 Software.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 6D64255144174320B8567543930B9E02AD8A29557CFA35634515ED3CE2BACFAE | |||
| (PID) Process: | (7268) ATTACK SHARK G3 Software.tmp | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
Executable files
7
Suspicious files
2
Text files
501
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\res\DpiColorDialog.xml | xml | |
MD5:E2B1F0812EF4C9AE6E15204D8E520D62 | SHA256:0E3CE75AE22D92A05E076CA269C7240AD9240B31C165ADD1C4C50AF19CA2A060 | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\is-0LDQ4.tmp | executable | |
MD5:D0D9246473016EC7C72FC3FB01CBE3B7 | SHA256:43DE0375479C9A7CDCD4E04ABFD0589004927CAF95E0265C5B159872BA42C801 | |||
| 7232 | ATTACK SHARK G3 Software.exe | C:\Users\admin\AppData\Local\Temp\is-9G5BU.tmp\ATTACK SHARK G3 Software.tmp | executable | |
MD5:D0D9246473016EC7C72FC3FB01CBE3B7 | SHA256:43DE0375479C9A7CDCD4E04ABFD0589004927CAF95E0265C5B159872BA42C801 | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\is-QUBU1.tmp | executable | |
MD5:86A1311D51C00B278CB7F27796EA442E | SHA256:E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\res\about.xml | xml | |
MD5:875BA5F0BD197DED7735D0D1B59CAB18 | SHA256:B262BF791B7603F352A4F53C2FF106C86EC891948D71F41573DEE36226D9EE6A | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Users\admin\AppData\Local\Temp\is-UNEG0.tmp\_isetup\_setup64.tmp | executable | |
MD5:E4211D6D009757C078A9FAC7FF4F03D4 | SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95 | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\res\is-QQSS4.tmp | xml | |
MD5:3A6EF931D1B92B4932555A4A85DFC210 | SHA256:233EE3C4F2ADFB1041C7F2954057F61911C32728A694061BEB1AA5CA4711F5B0 | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\res\is-KM88D.tmp | xml | |
MD5:875BA5F0BD197DED7735D0D1B59CAB18 | SHA256:B262BF791B7603F352A4F53C2FF106C86EC891948D71F41573DEE36226D9EE6A | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\unins000.exe | executable | |
MD5:D0D9246473016EC7C72FC3FB01CBE3B7 | SHA256:43DE0375479C9A7CDCD4E04ABFD0589004927CAF95E0265C5B159872BA42C801 | |||
| 7268 | ATTACK SHARK G3 Software.tmp | C:\Program Files (x86)\Attack Shark Software\res\is-HODK1.tmp | xml | |
MD5:47A8BD1AF9E7B04FAE4166C59B2F1BC7 | SHA256:E67C4BC624736D7A0A26C4DCD69335BA8A3D7677A23AE8086B24786D501F4836 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
14
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4720 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4824 | svchost.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7848 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl | unknown | — | — | whitelisted |
7848 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
7848 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl | unknown | — | — | whitelisted |
7848 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4824 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5596 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7068 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4720 | svchost.exe | 20.190.160.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4720 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4824 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4824 | svchost.exe | 2.16.168.114:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
3440 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |