Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:04:11 UTC
Home > List all groups > List all tools > List all groups using tool SharpStage
 Tool: SharpStage
Names SharpStage
Category Malware
Type Backdoor, Info stealer, Downloader
Description
(Cybereason) The dropper downloaded from the SharpStage C2 has several backdoor
capabilities including implementation of a Dropbox client API along with a check for
the presence of the Arabic language in order to execute only on desired targets and to
evade sandbox detection, as the default language setting is usually English.
Prior to the language check, the backdoor automatically captures the screen and saves
the image in the %temp% folder.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool SharpStage
Changed Name Country Observed
APT groups
 Molerats, Extreme Jackal, Gaza Cybergang [Gaza] 2012-Jul 2023
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ee189bfb-8bcc-45eb-bb38-ff8fe5da63c1
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ee189bfb-8bcc-45eb-bb38-ff8fe5da63c1
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ee189bfb-8bcc-45eb-bb38-ff8fe5da63c1
Page 2 of 2

APT groups Molerats, Extreme Jackal, Gaza Cybergang [Gaza] 2012-Jul 2023
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2