SharpRhino RAT (Trojan) – Malware

Overview

SharpRhino is a sophisticated Remote Access Trojan (RAT) that has been increasingly observed in cybercrime operations targeting both individual users and organizations. First emerging in 2023, this malware is notable for its stealthy, multi-functional nature, allowing attackers to establish persistent access to compromised systems while evading traditional security defenses. Leveraging a wide array of malicious capabilities, SharpRhino has quickly become a favorite tool among cybercriminals and threat actors for conducting espionage, stealing sensitive data, and executing further malicious activities. Its design allows attackers to gain full control over a victim’s system, enabling actions ranging from file exfiltration to remote surveillance.

One of the key features that make SharpRhino particularly dangerous is its ability to remain undetected for extended periods, often using encryption and obfuscation techniques to conceal its presence from security software. It is highly modular, with the ability to download and execute additional payloads, providing attackers with flexibility and adaptability in their operations. The malware is typically delivered through phishing emails, exploit kits, or malicious attachments, making it an effective and persistent tool for a wide range of cyberattacks. Furthermore, its use of legitimate system processes to execute malicious actions adds an additional layer of complexity to its detection, making it particularly difficult to identify and eradicate from compromised networks.

Targets

Information

How they operate

Initial Access and Execution

Upon successful delivery, SharpRhino uses a variety of techniques to gain initial access to the target machine. The malware is often distributed through malicious email attachments or fake software updates. Once executed, SharpRhino’s payload makes use of common command-line tools such as PowerShell (T1059.001) and Windows Command Shell (T1059.003) to initiate the malware’s execution. SharpRhino may deploy scripts or batch files like WindowsUpdate.bat that, when run, facilitate the RAT’s deeper penetration into the system. The malware leverages these scripting languages to execute its payloads and establish further connections with its Command and Control (C2) server. This often involves making requests to external servers via HTTPS (T1071.001), allowing it to remain encrypted and covert in its communication, reducing the likelihood of detection by traditional network monitoring systems.

Privilege Escalation and Persistence

One of the key features of SharpRhino RAT is its ability to elevate its privileges, enabling it to bypass security controls and gain full administrative access to the infected machine. SharpRhino often uses Access Token Manipulation (T1134) techniques, such as calling on system utilities like 7za.exe to set privileged access rights, including SeRestorePrivilege, SeCreateSymbolicLinkPrivilege, and SeSecurityPrivilege. This privilege escalation allows the RAT to gain deeper control over the system and circumvent security measures, ensuring its survival and continued access.

SharpRhino also takes steps to establish persistence on infected machines by creating autostart entries in system registries (T1547). For instance, it may write entries like \Run\UpdateWindowsKey in the Windows registry, ensuring that the malware is executed every time the system starts. The RAT can also modify system services, like altering the MSDTC (Microsoft Distributed Transaction Coordinator) service to ensure that malicious processes are executed even after a reboot (T1543.003). These persistence mechanisms are essential for maintaining a long-term foothold on the target system.

Evasion and Discovery

SharpRhino employs several tactics to avoid detection by antivirus software, sandbox environments, and security monitoring tools. One notable technique is Virtualization/Sandbox Evasion (T1497), where the malware checks system characteristics to determine whether it is running in a virtualized environment or sandbox, which might be used for analysis. It uses system functions such as GetDiskFreeSpaceExW to identify the underlying hardware and avoid running if it detects sandboxed conditions. SharpRhino may also implement time-based evasion (T1497.003), such as introducing a deliberate delay in execution (e.g., sleeping for 66 seconds), making it more difficult for analysts to spot its activity during dynamic analysis.

Additionally, SharpRhino has the ability to perform network share discovery (T1135), scanning the infected machine’s network environment for other devices or shares that it can exploit. This lateral movement functionality helps expand the reach of the malware within a network, increasing its potential for compromise and data exfiltration.

Exfiltration and Command and Control

SharpRhino’s primary goal is often data exfiltration, which it achieves through encrypted communication with its C2 server. By using Application Layer Protocols like HTTPS (T1071.001), SharpRhino ensures that its data transmission is encrypted, making it difficult to intercept and analyze. The malware communicates with C2 servers hosted on legitimate platforms such as Cloudflare Workers, using encrypted channels (T1573) to transmit sensitive information back to the attacker. This stealthy data exfiltration method helps maintain the malware’s covert presence within the network.

Once SharpRhino has established a foothold, it also provides the attackers with full control of the infected system. The malware can be used to execute arbitrary commands, download additional payloads, or even deploy ransomware or other malicious tools. The flexibility of SharpRhino makes it a powerful tool for attackers, enabling them to not only steal data but also disrupt system functionality or spread to other systems in the network.

Conclusion

SharpRhino RAT represents a serious and adaptable threat to organizations and individuals alike. Its ability to gain initial access, escalate privileges, maintain persistence, evade detection, and exfiltrate data makes it a dangerous tool in the hands of cybercriminals. By leveraging a combination of obfuscation techniques, encrypted communications, and lateral movement capabilities, SharpRhino operates stealthily and efficiently, ensuring its survival in highly-secured environments. As attackers continue to evolve their tactics, it is crucial for organizations to implement robust security measures, such as network monitoring, endpoint detection, and effective privilege management, to defend against threats like SharpRhino RAT.

MITRE Tactics and Techniques

Initial Access (T1071 – Application Layer Protocol)

SharpRhino RAT typically gains initial access through phishing emails, malicious attachments, or compromised software. It uses web protocols (e.g., HTTPS) to communicate with a command-and-control (C2) server, which could be hosted on legitimate services like Cloudflare Workers.

Execution (T1059 – Command and Scripting Interpreter)

SharpRhino RAT often uses command-line interpreters such as PowerShell (T1059.001) and Windows Command Shell (T1059.003) to execute malicious scripts or batch files, such as WindowsUpdate.bat. These scripts are used to execute the RAT payload, giving attackers full control over the infected machine.

Persistence (T1547 – Boot or Logon Autostart Execution)

The RAT establishes persistence on infected systems by creating registry entries under Run Keys or modifying system services (e.g., T1543.003). For example, the SharpRhino RAT may write entries like \Run\UpdateWindowsKey to ensure that it is launched at system startup.

Privilege Escalation (T1134 – Access Token Manipulation)

SharpRhino RAT leverages privilege escalation techniques such as manipulating access tokens. The malware may attempt to acquire higher privileges, enabling it to bypass security controls and gain full system access. Tools like 7za.exe are used to set privileges like SeRestorePrivilege, SeCreateSymbolicLinkPrivilege, and SeSecurityPrivilege.

Defense Evasion (T1497 – Virtualization/Sandbox Evasion)

To avoid detection, SharpRhino employs tactics to evade sandboxing and analysis tools. This includes system checks such as calling GetDiskFreeSpaceExW (T1497.001) and introducing time-based evasion where the RAT sleeps for a period, making it less likely to be detected during dynamic analysis (T1497.003).

Discovery (T1135 – Network Share Discovery)

SharpRhino RAT may attempt to discover network shares or other connected systems by calling network share enumeration functions, such as NetShareEnum (T1135), to facilitate lateral movement or exfiltrate data across the network.

Exfiltration (T1573 – Encrypted Channel)

SharpRhino is capable of exfiltrating data via encrypted channels (T1573). It communicates over HTTPS, ensuring that the data transmission is encrypted and difficult to intercept or analyze. This enables the attacker to stealthily steal sensitive data from the compromised system.

Impact (T1543 – Create or Modify System Process)

SharpRhino may modify system processes by creating or altering services (T1543.003). For example, it can manipulate the MSDTC (Microsoft Distributed Transaction Coordinator) service, setting it to delayed start, thus ensuring that malicious processes are executed even after the system reboots.

Reference: 

• SharpRhino – New Hunters International RAT Identified by Quorum Cyber