MalwareUsed by 1 actor

SharpHide

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TA584

“...pull down secondary modules, including a persistence plugin built with SharpHide... manipulates the Windows Registry by inserting null-byte characters...”

via proofpoint threat insight blogproofpoint.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1112Modify RegistryEvidence1

Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.

T1547.001Registry Run Keys / Startup FolderEvidence3

This executable was created with SharpHide... which was used to create a hidden registry key to run the first XWorm PowerShell script at each boot.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence3

This executable was created with SharpHide... which was used to create a hidden registry key to run the first XWorm PowerShell script at each boot.

Stealth

2 techniques

T1218.009Regsvcs/RegasmEvidence1

The first script will use RegAsm to run XWorm encoded in a Base64 variable... The second script used RegAsm to run an executable encoded in a Base64 variable.

T1564Hide ArtifactsEvidence1

“SharpHide… manipulates the Windows Registry by inserting null-byte characters (\x00) into the key names… entry becomes effectively invisible…”

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

“...runs another remote intermediate PowerShell script… The remote script installs Node.js… then decrypts… loader… Tsundere Bot itself.”

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

proofpoint threat insight blogNews

Jan 26, 2026

Can’t stop, won’t stop: TA584 innovates initial access | Proofpoint US

Persistence tool/plugin used with XWorm to hide malicious Run-key persistence by inserting null bytes into registry key names, making entries difficult to enumerate with standard tools.

proofpointNews

Nov 14, 2024

ClickFix Malware & Social Engineering Threat Grows | Proofpoint US

Tool used to establish persistence by creating a hidden registry key that reruns the XWorm PowerShell script at boot.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

SharpHide

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TA584

“...pull down secondary modules, including a persistence plugin built with SharpHide... manipulates the Windows Registry by inserting null-byte characters...”

via proofpoint threat insight blogproofpoint.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1112Modify RegistryEvidence1

Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.

T1547.001Registry Run Keys / Startup FolderEvidence3

This executable was created with SharpHide... which was used to create a hidden registry key to run the first XWorm PowerShell script at each boot.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence3

This executable was created with SharpHide... which was used to create a hidden registry key to run the first XWorm PowerShell script at each boot.

Stealth

2 techniques

T1218.009Regsvcs/RegasmEvidence1

The first script will use RegAsm to run XWorm encoded in a Base64 variable... The second script used RegAsm to run an executable encoded in a Base64 variable.

T1564Hide ArtifactsEvidence1

“SharpHide… manipulates the Windows Registry by inserting null-byte characters (\x00) into the key names… entry becomes effectively invisible…”

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

“...runs another remote intermediate PowerShell script… The remote script installs Node.js… then decrypts… loader… Tsundere Bot itself.”

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

proofpoint threat insight blogNews

Jan 26, 2026

Can’t stop, won’t stop: TA584 innovates initial access | Proofpoint US

Persistence tool/plugin used with XWorm to hide malicious Run-key persistence by inserting null bytes into registry key names, making entries difficult to enumerate with standard tools.

proofpointNews

Nov 14, 2024

ClickFix Malware & Social Engineering Threat Grows | Proofpoint US

Tool used to establish persistence by creating a hidden registry key that reruns the XWorm PowerShell script at boot.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.