SharpRhinoMalware
Last reported 18 months ago, by Group-IB1 report
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1020Automated Exfiltration
“Automated Exfiltration (T1020)”
- T1021.002SMB/Windows Admin Shares
“Remote Services: SMB/Windows Admin Shares (T1021.002)”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1027.008Stripped Payloads
“Obfuscated Files or Information: Stripped Payloads (T1027.008)”
- T1057Process Discovery
“Process Discovery (T1057)”
What the reports say
1 report, newest first · the exact sentence from each-
The beginning of the end: the story of Hunters International“On 7 August, 2024, Hunters International’s administrator shared a few articles from the media on the SharpRhino Remote Access Trojan (RAT) malware which was used by criminals collaborating with Hunters International.”
Indicators in its reports
named in the reports above- 45.8.228[.]240in 1 report
- huntersinternational[.]suin 1 report
- 45.135.233[.]154in 1 report
- lynxblog[.]netin 1 report
- incblog[.]suin 1 report
- huntersinternational[.]bondin 1 report
- huntersinternational[.]ltdin 1 report
- huntersinternational[.]topin 1 report
- huntersinternational[.]vipin 1 report
- 193.106.175[.]48in 1 report
- huntersinternational[.]orgin 1 report
- 185.185.68[.]40in 1 report
- 109.172.85[.]126in 1 report
- 185.185.69[.]129in 1 report
- 185.12.127[.]116in 1 report
- 158.160.141[.]169in 1 report
- 192.185.35[.]253in 1 report
- 185.244.181[.]173in 1 report
- huntersinternational[.]netin 1 report
- 31.44.5[.]116in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.