SharpStage

Executive Summary

SharpStage is a .NET‑based Windows RAT featuring fullbackdoor capabilities including remote desktop control, keylogging, file transfer, and command execution. It communicates over HTTPS with custom C2 protocols, persists via registry entries and scheduled tasks, and evades detection through heavy obfuscation. Security teams should monitor for anomalous HTTP/HTTPS traffic, new Startup or Scheduled Task entries, and the creation of unfamiliar persistent processes that employ .NET assemblies.

SharpStage is a Windows‐native executable written in the Microsoft .NET framework that functions as a malicious Remote Access Trojan (RAT). The payload, first reported by Cybereason and BleepingComputer in December 2020 under the moniker "Molerats," leverages the rich libraries of the .NET runtime to conceal its presence and streamline cross‑platform code reuse. Its compiled assemblies are heavily obfuscated, making static analysis challenging, yet dynamic sandbox execution reveals a full set of backdoor capabilities. Operationally, SharpStage establishes command‑and‑control (C2) communication over HTTP/HTTPS using custom protocols that mimic legitimate traffic. Once a victim host is compromised, the malware installs persistence via Startup registry keys and scheduled tasks to ensure it survives reboot events. It supports full remote desktop control, keylogging, file upload/download, system information gathering, and can execute arbitrary PowerShell or batch commands through its native .NET command‑shell interface. The threat landscape demonstrates that SharpStage is part of a growing cohort of Windows RATs that prioritize stealth and flexibility. Its use of encrypted traffic and dynamic DNS updates reduces the likelihood of detection by signature‑based engines, while its modular architecture allows adversaries to drop additional modules for lateral movement or credential harvesting. Although limited public analysis exists beyond the initial discovery reports, the observed behaviors align closely with well‑known .NET RAT families such as Turla's "Zebrocy" and Goopy. Collectively, these characteristics indicate that SharpStage poses a significant risk to enterprise networks by enabling attackers to maintain persistent footholds, exfiltrate sensitive data, and pivot laterally across compromised systems.

Key Capabilities

• Establishes encrypted HTTPS C2 channels
• Persistence via registry startup keys and scheduled tasks
• Remote desktop and GUI control
• Keylogging and clipboard monitoring
• File upload/download capabilities
• PowerShell/command execution through embedded shell
• Processes obfuscated .NET binaries to evade static detection

Recommended Actions

• Deploy endpoint detection and response (EDR) solutions that detect anomalous HTTP traffic patterns and .NET process activity.
• Harden registry startup mechanisms by monitoring for new entries in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.