Procedure examples

Shark can upload files to its C2.

Shark can update its configuration to use a different C2 server.

Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Shark can use encrypted and encoded files for C2 configuration.

Shark can pause C2 communications for a specified time.

Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.

Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.

Shark has the ability to use `CMD` to execute commands.

Shark can delete files downloaded to the compromised host.

Shark has the ability to use HTTP in C2 communications.

Shark can use DNS in C2 communications.

Shark has stored information in folders named `U1` and `U2` prior to exfiltration.

Shark can collect the GUID of a targeted machine.

Shark can download additional files from its C2 via HTTP or DNS.

Shark can extract and decrypt downloaded .zip files.

Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.

Shark can send DNS C2 communications using a unique domain generation algorithm.