Sharik Back For More After Php.Net Compromise

This report analyzes the 'Sharik' Trojan — a backdoor that injects into legitimate processes, creates persistent autorun mechanisms (including explorer.exe hooks), and communicates with command-and-control servers over HTTP (commonly on non-standard port 35618). The author enumerates many drop URLs and phone-home IPs/URLs as IOCs, highlights overlap with other malware families (Nymaim, Fareit), and recommends monitoring or closing port 35618 and investigating traffic matching the listed indicators.