SharpStage USES Dropbox
SharpStage implements a Dropbox client to exfiltrate information.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“the exfiltration method is using a Dropbox client”
Malware
malware:sharpstage
Also: SharpStage backdoor
Backdoor that can execute commands and fetch information, using an embedded Dropbox client for data exfiltration and checking for Arabic language settings.
Backdoor that can execute commands and fetch information, using an embedded Dropbox client for data exfiltration and checking for Arabic language settings.
“The other backdoor was SharpStage”
“the exfiltration method is using a Dropbox client”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Dropbox | Explicit | 89 |
| outgoing | USES | Data exfiltration | Explicit | 89 |
| outgoing | USES | sandbox evasion | Explicit | 89 |
SharpStage USES Dropbox
SharpStage implements a Dropbox client to exfiltrate information.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“the exfiltration method is using a Dropbox client”
SharpStage USES Data exfiltration
SharpStage uses Dropbox as its method for exfiltrating data.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“the exfiltration method is using a Dropbox client”
SharpStage USES sandbox evasion
SharpStage checks whether Arabic is installed and will not run without it, which Assaf describes as a way to avoid sandboxes.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“it’s also a clever way to avoid most sandboxes”