Network Admins: SharpRhino Ransomware Disguised as Angry IP Scanner

Hunters International, a rapidly expanding Ransomware-as-a-Service group, emerged in October 2023 and has quickly become a major threat actor, executing 134 attacks through July 2024. 

Strongly suspected to be a successor to the defunct Hive ransomware group due to code similarities, Hunters International leverages a RaaS model to proliferate attacks, contributing significantly to its rapid ascent in the threat landscape. 

The financially motivated ransomware group Hunters International uses a two-pronged attack strategy, starting with data exfiltration and then encrypting files with a sophisticated Rust-based encryptor. 

It aligns with evolving ransomware trends, emphasizing data theft for extortion. The group exhibits a non-discriminatory targeting approach, excluding only CIS nations, suggesting potential Russian affiliations. 

An initial malware sample, named “ipscan-3.9.1-setup.exe,” is a 32-bit Portable Executable file disguised as a Nullsoft installer containing a self-extracting archive. 

The sample leverages a valid code certificate from J-Golden Strive Trading Co., Ltd., issued by GlobalSign, to impersonate the legitimate network administration tool AngryIP, which exploits the open-source nature of AngryIP to bypass security controls and establish a foothold in the target system. 

SharpRhino RAT spreads by masquerading as the AngryIP installer, which contains a password-protected archive and another executable (ipsscan-3.9.1-setup.exe). 

Detonation analysis revealed the archive password and that the NSIS installer establishes persistence by adding a registry key pointing to a malicious Microsoft.AnyKey.exe (dropped by the installer). 

This LOLBIN then executes a LogUpdate.bat script, which in turn uses obfuscated PowerShell to launch an additional hidden file most likely responsible for malicious activity. 

Analysis of the .t file reveals a sophisticated fileless malware infection.

The attacker leveraged PowerShell to obfuscate and execute malicious C# code directly in memory, which employs secure strings for further obfuscation and dynamically constructs a web address pointing to a Cloudflare Serverless Architecture endpoint, strongly indicating a Command-and-Control (C2) infrastructure. 

The extracted C# source code from the modified .t file is heavily obfuscated, hindering analysis. Loading the code into an IDE improved readability and identified objects referenced by the .t file. 

According to Quorum Cyber, to understand malware behavior, the .t file was redirected to a controlled server, revealing an HTTP POST request containing base64-encoded, likely encrypted data. 

The next analytical step is to decrypt the data after identifying a suspected encryption routine within the C# code that uses XOR operations on byte objects. 

SharpRhino is C# malware that uses encryption to obfuscate communication with a C2 server. By bypassing this encryption and analyzing network traffic, researchers determined that the malware registers with the C2 using device and user information, receives commands, and executes PowerShell commands on the infected system. 

The malware’s functionality includes delaying command execution and terminating its operation based on specific commands. A proof-of-concept C2 server was built to demonstrate full control over the malware, including the ability to spawn processes like the calculator application. 

Also Read:

• Chameleon Malware Disguised as CRM App to Attack IT Employees
• North Korean Hackers Exploit VPN Update Flaw to Breach Networks