SharpDisco

Executive Summary

SharpDisco is a minimalistic C# dropper used by MoustachedBouncer since at least 2020, designed to load and execute additional malicious plug‑ins on Windows systems. The loader hides its presence in benign directories and dynamically injects payloads, making it a flexible foothold for a variety of adversarial actions such as credential theft or ransomware deployment. Security teams should treat any unknown C# executable that writes data to %AppData%/Local and loads DLLs using reflection as suspicious.

SharpDisco is a lightweight dropper application written in C# that first appeared in the public threat landscape during 2020. It functions primarily as a loader for malicious plug‑ins and modules used by the advanced group MoustachedBouncer, as reported by ESET in August 2023. Once executed on a target Windows system, SharpDisco downloads or extracts additional binaries to a local folder, then dynamically loads them using the standard .NET reflection mechanism. The dropper itself is intentionally small and unobtrusive; it hides its activity behind legitimate-looking process names (often matching the name of the first plug‑in) and may write configuration files in uncommon directories such as %AppData%/Local/SharpDisco to evade simple file‑based detection. The malware’s design mirrors typical supply‑chain or “plug‑and‑play” loaders, enabling adversaries to rapidly change functional capabilities by swapping out plug‑ins while keeping the main stub constant. This architectural choice complicates attribution and makes it harder for security teams to identify the specific threat actor based solely on file hashes. Impact-wise, SharpDisco facilitates a range of downstream malicious actions – from credential theft and lateral movement to data exfiltration or ransomware delivery – depending on which plug‑ins are deployed. Its ability to run arbitrary code within the victim environment provides adversaries with a versatile foothold that can be reused across multiple campaigns.

Key Capabilities

• Drops additional binaries to disk in hidden or uncommon directories
• Uses .NET reflection to dynamically load plug‑in modules
• Writes configuration files under %AppData% to conceal activity
• Can inject plug‑ins into running processes via DLL load mechanisms
• Employs obfuscation techniques typical of dropper stubs

ATT&CK Techniques

Recommended Actions

• Monitor for the creation of new executables or DLLs in %AppData% or other non-system directories
• Block execution of any unknown .NET assemblies that perform dynamic reflection loading
• Use endpoint detection and response solutions to detect process injection events
• Whitelist legitimate C# application names and cross‑check unexpected instances against whitelists

Suggested Tags