Hunters International has introduced a new C# malware named SharpRhino, serving as an initial infection vector and persistent Remote Access Trojan (RAT).
SharpRhino is disseminated via a typosquatting domain that mimics Angry IP Scanner. It employs unprecedented techniques to escalate privileges, facilitate lateral movement within networks, and eventually deploy ransomware. This underscores the group’s evolving strategies and the increasing sophistication of Ransomware-as-a-Service (RaaS) operations.
Emerging in October 2023, Hunters International swiftly became a leading ransomware actor, ranking in the top ten. Their operations are closely associated with the now-defunct Hive group, as evidenced by similar code structures. They utilize a sophisticated Rust-based encryptor to lock victim files with the .locked extension after initial data exfiltration.
Hunters International’s advanced technical prowess and business model have fueled their widespread attack campaign, targeting organizations across various sectors without discrimination. The malware sample, a 32-bit self-extracting executable camouflaged as a legitimate network tool, leverages a valid code certificate for obfuscation.
The malware’s hashes are as follows:
- 4bba5b7d3713e8b9d73ff1955211e971
- 9473104a1aefb0daabe41a92d75705be7e2daf3
- 09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264
These are signed by J-Golden Strive. SharpRhino, masquerading as the AngryIP installer, is an NSIS-packed executable containing an additional binary and a password-protected 7z archive.
Analysts executed the malware to bypass the archive password, capturing command-line arguments and discovering the password, enabling them to extract the archive’s contents for further analysis.
The NSIS installer alters the Run\UpdateWindowsKey registry to maintain persistence by launching Microsoft.AnyKey.exe, a LOLBIN from Microsoft Visual Studio 2019 Node JS tools deployed by the attacker. This LOLBIN runs LogUpdate.bat, a batch file that invokes an obfuscated PowerShell script. The installer creates two directories, WindowsUpdater24 and LogUpdateWindows, housing files for command-and-control (C2) communication.
Quorum Cyber’s analysis of the .t file identified it as a PowerShell script using fileless malware techniques. It decodes embedded C# source code, compiles it in memory, and executes it. Initial findings suggest the malware communicates with a Cloudflare Serverless Architecture endpoint, presumably the attacker’s C2 infrastructure.
To verify this, the .t file was modified to extract the embedded C# source code and convert it into a file for detailed analysis. The investigation revealed a highly obfuscated C# payload using encryption to mask communication data.
By directing network traffic to a controlled environment and deobfuscating critical code segments, investigators deciphered SharpRhino’s main functions, including encrypted C2 communication, PowerShell command execution, and a basic delay mechanism. Successful emulation of C2 commands, including executing ‘calc.exe’, confirmed complete control over the infected system, illustrating the malware’s potential for significant damage.
SharpRhino RAT utilizes the following Indicators of Compromise (IOCs) for detection: LogUpdate.bat, Wiaphoh7um.t, ipscan-3.9.1-setup.exe, kautix2aeX.t, and WindowsUpdate.bat, each associated with specific SHA-256 hashes.
The RAT also communicates with C2 servers located at:
- cdn-server-1.xiren77418.workers.dev
- cdn-server-2.wesoc40288.workers.dev
- Angryipo.org
- Angryipsca.com
