Malware

Sharpil RAT Malware

Cybersec Sentinel

Apr 24, 2024 • 1 min read

Overview:

Sharpil RAT, initially identified as a Remote Access Trojan (RAT), has been reclassified as a remote-controlled data stealer. It targets a wide range of data, notably from gaming platforms and applications. A new variant, referred to as Sharp Stealer, emerged in 2024, exhibiting similar malicious functionalities and focusing particularly on gamers due to the high value of in-game assets and account information.

Distribution Methods:

Email Phishing: Leveraging emails with malicious attachments or links.
Deceptive Ads: Utilizing ads that automatically download the malware when clicked.
Software Vulnerabilities: Exploiting outdated or unpatched software to execute malicious downloads.

Indicators of Compromise (IoCs):

Sharpil RAT Hashes (sha256):
- 1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef
Related Sharp Stealer (sharp_build.exe) Hashes (sha256):
- 42efd817539480fb44da60d797908869af796df6bfb700980709ccf483e92b96
- b6e763d6b886308df0e0c3e9342dd83dba88d68eb312e0540b24d8dcdcaa1920
- f0bc0f948edb5c15f936234b0453290c135def1fc8dc29e344f4d816ee16110f

Prevention and Mitigation Strategies:

Software Updates: Regularly update all software to close security vulnerabilities.
Antivirus Solutions: Utilize robust antivirus programs with real-time protection.
Cybersecurity Education: Educate users on the risks associated with unknown emails and websites.

Removal Recommendations:

System Scans: Use comprehensive scanning tools like Norton to detect and remove threats.
Manual Removal: Employ tools such as Autoruns for deeper analysis and cleanup of system startup entries.
System Restoration: In severe cases, restoring systems from clean backups may be necessary.

Technical Insights:

Sharpil RAT and Sharp Stealer exploit Telegram bots for command and control, collecting sensitive data from browsers, system information, and gaming platforms. The malware communicates with a bot, receiving commands to exfiltrate specific data, which is then sent back to the attacker through Telegram channels.

Sources:

Sharp-Project: New Stealer Family on the Market (G DATA)

Sharpil RAT malware - possible precursor to Sharp Stealer (Broadcom)

Conclusion:

Both Sharpil RAT and Sharp Stealer represent significant threats in the evolving cyber landscape of 2024, particularly targeting the gaming community due to the lucrative potential of stolen game-related data. Users and organizations should adopt rigorous security measures, including the deployment of advanced threat detection and response solutions, to mitigate these risks.