---
title: "SharpRhino: An old, new threat"
description: SharpRhino is delivered as legitimate software and grants remote access to the victim's machine. Read our full analysis to see how attackers use it to propagate other malware.
canonical_url: https://www.acronis.com/en/tru/posts/sharprhino-an-old-new-threat/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

09 January 2025

# SharpRhino: An old, new threat

SharpRhino is delivered as legitimate software and grants remote access to the victim's machine. Read our full analysis to see how attackers use it to propagate other malware.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

Other languages available:[Deutsch](https://www.acronis.com/de/tru/posts/sharprhino-an-old-new-threat/)  
[Español](https://www.acronis.com/es/tru/posts/sharprhino-an-old-new-threat/)  
[Français](https://www.acronis.com/fr/tru/posts/sharprhino-an-old-new-threat/)  
[Italiano](https://www.acronis.com/it/tru/posts/sharprhino-an-old-new-threat/)  
[日本語](https://www.acronis.com/ja/tru/posts/sharprhino-an-old-new-threat/)  
[Português](https://www.acronis.com/pt/tru/posts/sharprhino-an-old-new-threat/)

## Summary

*   SharpRhino is based on open-source project ThunderShell

*   Delivered to victims as an NSIS installer that drops PowerShell scripts

*   Powershell scripts contain encoded .NET assemblies

*   NET payload is used to communicate with the C2 server

*   Can remotely execute commands

*   Network traffic is encrypted with RC4 and encoded in Base64 format

## Introduction

[Hunters International](https://www.acronis.com/en-eu/cyber-protection-center/posts/hunters-international-new-ransomware-based-on-hive-source-code/), a well-known threat group known for their ransomware-as-a-service operations, has started using new RAT malware. The first incident featuring this software was spotted at the start of August 2024 and was named SharpRhino due to its C# language. The trojan is delivered to victims as legitimate software and grants remote access to the victim's machine. Using this software, attackers can execute different commands and propagate other malware.

## Technical details

### Overview

The analyzed sample is delivered to victims as an installer that was built with the Nullsoft Scriptable Install System. This file has ‘Angryip.org’ in the description and a valid digital certificate, but the company name is fake and does not exist.

![Image 1: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/6ebeebec8dc94a9939c46d88f46111f6.png)

This installer contains an additional installer, password-protected archive and additional files that will be used during malware execution.

![Image 2: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/4b5ffe10cbd9a5b550ab01a74ef16f60.png)

### Installation

When executed, the sample drops all embedded files to the ‘C:\ProgramData\Microsoft\WindowsUpdate24’ folder and executes an ‘ipscan-3.9.1-setup.exe’ file, which is an installer of legitimate software: Angry IP Scanner.

![Image 3: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/08f92cf5acf2adc4ad1a381d4bde10a5.png)

While the user is distracted by this installer, the malware extracts files from the password-protected archive UpdateFull.zip. Then, to unpack the archive, it uses an embedded 7za.exe program. In the command line we can see the password for the archive:

_C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe x C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24_

The contents of the archive are as follows:

![Image 4: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/c59d1f1a6eb3a738165c54d1bb4515b6.png)

The sample creates a new folder — ‘C:\ProgramData\Microsoft\LogUpdateWindows’ — after extraction, and copies files extracted from the archive to the new folder. Using two different installation folders can help attackers to gain persistence and stay on the system in case one of the folders is removed, as files in those folders are similar in the execution process. Next, it adds a new registry key to the ‘HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run’ path that points to the ‘Microsoft.AnyKey.lnk’ file. This file is a shortcut and contains the next target:

_C:\ProgramData\Microsoft\LogUpdateWindows\Microsoft.AnyKey.exe abnormal c:\programdata\%username%0 cmd /c C:\ProgramData\Microsoft\LogUpdateWindows\LogUpdate.bat_

The executable, ‘Microsoft.AnyKey.exe’, which also was dropped from the archive, is a legitimate program that is a part of Node.js tools for Visual Studio and is named ‘Microsoft.NodejsTools.PressAnyKey.exe’.

### Execution

The ‘LogUpdate.bat’ and ‘WindowsUpdate.bat’ files have the same functionality, but they load different files.

![Image 5: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/f9fe7002d32e48acea953f950472c74b.png)

‘Wiaphoh7um.t’ and ‘kautix2aeX.t’ files both contain obfuscated data. The raw data and the key are different for those files, but the result data will be the same. After the decoding process, the sample defines this data as .NET assembly and calls one method with some parameters.

![Image 6: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/a859199aae89cc2b3e31aa4213a2ee33.png)

After dumping all data from the script, we can observe the next variables:

$var1, $var2, $var3 variables determine referenced assemblies and when concatenated form the next string:

_System.Drawing.dllSystem.Web.Extensions.dllSystem.Windows.Forms.dll_

$var4 is different for each file and contains a C2 server address. Below is a table representing arguments that are used in .NET assembly call for each file:

![Image 7: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/a1b3f898ccd81f705dc2cebd8c046c65.png)

‘$fjwZrHB1k2RF’ represents .NET Assembly that is loaded to the memory. After dumping data, we can observe C# code. The PowerShell script calls a function from the ‘Bzxmlpi’ namespace and ‘OyrWkb’ class. At the start of this class, we can observe some additional imports load and unreadable variable names.

![Image 8: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/0c1cc43a0a98c2792a85ac2f9f2ee859.png)

In fact, this file is a modified version of the open-source project ‘[ThunderShell](https://github.com/Mr-Un1k0d3r/ThunderShell/blob/master/data/payloads/stager.cs)’. Several changes were made to the source project:

*   Removed keylogger, screenshot and .NET Assembly loading functions, as well as the server’s commands that represented those functions.

*   All classes, functions and variables’ names were renamed.

*   Added default values that will be used if the payload is executed without arguments.

![Image 9: Comparison between SharpRhino code and ThunderShell code](https://staticfiles.acronis.com/images/content/66e5f82384953ced9541b98b24d4eba1.png)

Comparison between SharpRhino code and ThunderShell code

This function first generates a 16-byte random string. When initializing the Random class, the sample uses the current date, time and process ID as a seed. Next, it gets some environment variables, such as COMPUTERNAME, USERDOMAIN and USERNAME. All those data will be formatted:

![Image 10: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/c200e95c1a6423db0a05ed3d5060614f.png)

As a result, the next string is generated:

![Image 11: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/cab82ae79e427649e0fc51ad9958dfcb.png)

Next, the sample passes this string to a function that will send it to the server. Here, it encrypts data using an RC4 cipher with a key that was passed as the second argument.

![Image 12: RC4 encryption routine](https://staticfiles.acronis.com/images/content/c6966492dbc8dcefc89e34c19a1cc373.png)

RC4 encryption routine

After the encryption process, it adds some data to the request and also encodes the encrypted string in Base64 format. All this data is then sent to the server.

![Image 13: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/727003ea4050ce706aa702fa5c3da66a.png)

At this first connection, the response from the server is ignored. When the sample enters a loop, it connects to the server again, but both arguments are ‘null’. Next, the response is saved and compared with saved values. If the ‘delay’ command is received, the sample takes an additional argument and changes the value that will be passed to the sleep function. If the ‘exit’ command was obtained, it would break the loop and terminate execution. If it obtained any data other than ‘delay’ or ‘exit’, it will create a new thread with a function, which will take the obtained data as an argument. All those actions will be repeated with a 95-second delay between each loop iteration.

![Image 14: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/18388c3c078daeaa9cde6cafbe85c3a1.png)

The response that comes from the server is passed to the deserialization function in ‘zWxFlnVASjHYb’ class, which grabs and stores the next data: ‘UUID’, ‘ID’ and ‘Data’.

![Image 15: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/f1cab4b727cab3a8c09b31d4ebfe887b.png)

### C2 server

While the link that was presented in the sample had already gone offline, we can use the server from the source project to see how communication works. First, we need to change the server configuration. It contains a number of fields, including the server IP address, encryption key, GUI settings and HTTP and HTTPS settings. Second, we need to change ‘callback-url’, ‘gui-host’ and ‘encryption-key’ parameters. We will take the encryption key parameters from a SharpRhino sample.

![Image 16: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/852f0dac79c040dcd1bebda68992c127.png)

The server is a Python application and requires a running Redis server. After starting, it outputs some information about the server.

![Image 17: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/53cc38232cb393fc17ac463069dee7be.png)

This includes a Web GUI address. When opened, the user must first be logged in. While it doesn’t matter what username they input, the password must be used from the configuration file. When logged in, the dashboard section is displayed. It contains information about sessions and logs.

![Image 18: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/faf67ddd4ff72ce2992e594ddc70774c.png)

The payload can be built in the Web GUI. The IP address of the server must be provided, as well as the payload type.

![Image 19: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/841dc24b87ceea8c2febe00bce808bd2.png)

After choosing a session, the attacker can interact with it. Entering ‘help’ shows all supported commands that can be used within the session.

![Image 20: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/480612b87739bab808c3ceec2bbe153a.png)

### C2 communications

Those commands have predefined strings that will be appended to data that the attacker enters as arguments. For example, using ‘shell [command]’ will append ‘cmd.exe /c’ to the start of the string that will be sent. Another example is a ‘ps’ command, which will send the PowerShell script to the client:

![Image 21: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/120fcca60813372ee54e4b9342132f85.png)

The command comes to the client encrypted with RC4 and encoded in Base64 format. It contains ID and UUID parameters, where ID is the client ID and UUID is a command ID.

![Image 22: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/b00b475f6b561207e10f5d3fe4bdbc27.png)

All this data is passed to the new thread. The function in this thread uses PowerShell modules to execute given commands.

![Image 23: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/461302089492615515e48a1f4f84b105.png)

Using the pipeline, the sample gets the output of the executed command. This data will then be encrypted and sent back to the server.

![Image 24: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/df0088014406477bd6d414e2869b76b3.png)

## Conclusion

ThunderShell, an old open-source project that was last updated almost four years ago, was used by Hunters International to deliver malware to victims. It arrives as an Angry IP Scanner utility installer, which drops and executes malicious PowerShell scripts. Using PowerShell capabilities, those scripts execute encoded .NET assemblies, so there is no need to bring any additional compiled executable — the malicious code is invoked and executed in the memory.

While the original code was modified, it retained its main functionality: remotely executing commands on targeted systems. This is the danger of such open-source projects. They are typically developed for education or pen-testing purposes but used for real attacks.

## Detected by Acronis

![Image 25: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/00b44fd74cc04d53b8880d2a84811791.png)

![Image 26: SharpRhino: An old, new threat](https://staticfiles.acronis.com/images/content/d70e42baca8abf387f5e32dc0cc369b6.png)

## IoCs

### Files

File name

SHA256

ipscan-3.9.1-setup.exe

09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264

kautix2aeX.t

9a8967e9e5ed4ed99874bfed58dea8fa7d12c53f7521370b8476d8783ebe5021

 LogUpdate.bat 

 d2e7729c64c0dac2309916ce95f6a8253ca7f3c7a2b92b452e7cfb69a601fbf6 

 UpdateFull.7z 

 fe07d238cd17be4b5f8396a27dc395e675732be17aed103033fff56c18009e6d 

 Wiaphoh7um.t 

 3f1443be65525bd71d13341017e469c3e124e6f06b09ae4da67fdeaa6b6c381f 

 WindowsUpdate.bat 

b57ec2ea899a92598e8ea492945f8f834dd9911cff425abf6d48c660e747d722

### Network indicators

 URL 

https://cdn-server-1.xiren77418.workers.dev

https://cdn-server-2.wesoc40288.workers.dev

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)