HANNIBAL Stealer: A Rebranded Threat Born from Sharp and TX Lineage

EXECUTIVE SUMMARY

At CYFIRMA, we are committed to delivering timely intelligence on emerging cyber threats and adversarial tactics targeting individuals and organizations. This report provides a detailed analysis of the Hannibal Stealer, a rebranded variant of the Sharp and TX stealers, which was recently cracked by the reverse engineering group, ‘llcppc_reverse’. The malware is developed in C#, operates on the .NET Framework, and is a sophisticated information stealer targeting Chromium – and Gecko-based browsers to extract sensitive data while bypassing Chrome Cookie V20 protection. Its data theft capabilities extend to cryptocurrency wallets, including Exodus, MetaMask, Monero, and more, as well as FTP clients like FileZilla and Total Commander.

INTRODUCTION

The Hannibal stealer compromises VPN credentials, Steam sessions, Telegram files, and Discord tokens, and performs comprehensive system profiling, capturing screenshots, and exfiltrating targeted files. It includes a crypto clipper module for clipboard hijacking, and it is controlled via a dedicated C2 user panel, enabling streamlined data management and exfiltration.

The Hannibal Stealer was first advertised for sale on BreachForums on February 2, 2025, with a subscription pricing set at $150 for 1 month, $300 for 3 months, and $650 for 7 months.

Initially, a Telegram channel was shared for contact, though it is currently inactive. Two Telegram usernames were listed on the post, suggesting they may be the developers behind the stealer. Notably, one of the users listed Hannibal Stealer for sale on a Turkish-speaking forum on February 3, 2025, followed by a post on Darkforums on February 5th, indicating a coordinated multi-platform promotion strategy.

ANALYSIS

Geofencing

The function GetLolocationInfo retrieves the geolocation of a system and IP address by querying ip-api.com and parsing the JSON response to extract the country field. If the country matches one of several nations (e.g., Russia, Belarus, Moldova, Kazakhstan, Kyrgyzstan, Armenia, Azerbaijan, Tadjikistan), the malware terminates execution. This technique ensures the malware avoids running in specific regions. The intent is to evade analysis or prosecution by avoiding systems in the attacker’s likely home territory. This behavior is consistent with geofencing used in many advanced malware campaigns.

Domain-matching

The GetDomainDetect function plays a critical reconnaissance role in identifying high-value credentials stored by the victim:

• Targeted Domain List: It contains a hardcoded list of well-known financial platforms, crypto services, and underground forums (e.g., binance.com, paypal.com, lolz.guru, blockchain.com), which are commonly targeted by cybercriminals for monetization.
• Credential Harvesting: The function scans all .txt files in a given browser-related directory – these files are often dumped login data, cookies, or autofill entries stolen by the malware.
• Keyword Matching: It reads the content line-by-line, tokenizes the data, and compares each word against the domain list. If a match is found, it’s recorded.
• Prioritizing Valuable Data: The purpose is to identify whether the stolen data includes credentials from the listed services. If so, this info can be prioritized for exfiltration, resale, or follow-on attacks.
• Evasion and Focus: By filtering specific domains, the stealer avoids sending redundant or useless data, reducing detection chances and bandwidth usage, while focusing only on high-value targets.

Victim profiling and data exfiltration

This SystemInfo class is part of a stealer malware component designed to gather and exfiltrate detailed system information from an infected machine.

Comprehensive System Profiling: The malware collects critical host details such as OS version, CPU/GPU, RAM, screen resolution, BIOS, HWID, and MAC address using WMI queries (ManagementObjectSearcher). These attributes help uniquely identify the victim’s device.

Network and Geolocation Data: It fetches IP address, country, BSSID (Wi-Fi info), and clipboard contents, potentially containing sensitive or credential-related data. Clipboard theft is often used to capture copied passwords or crypto wallet addresses.

Attribution Marking: The ASCII art includes a Telegram handle (CoderSharp), indicating the threat actor’s branding channel.

Log File Creation: All collected data is dumped into a file (Information.txt) for either local staging before exfiltration by the attacker.

Cryptocurrency wallet theft

This code segment is part of an info-stealer malware specifically designed to target and exfiltrate cryptocurrency wallet data from locally-installed wallet applications such as Jaxx, Litecoin, Bitcoin, Electrum, Ethereum, Monero, and Zcash. By locating and copying wallet files from these applications, the malware aims to harvest sensitive information including private keys and transaction histories, posing a significant risk to the victim’s digital assets.

The BitcoinCore and DashCore classes are engineered to specifically target and extract wallet files (wallet.dat) from the local installations of Bitcoin and Dash desktop clients. The malware leverages the Windows Registry to obtain the strDataDir key, which points to the storage location of the wallet files. Once identified, it copies these sensitive files to designated directories within the malware’s controlled structure (\Wallets\BitcoinCore\ or \DashCore\). These .dat files often contain private keys and transactional metadata, making them valuable assets for cybercriminals. Additionally, internal counters (Counting.bitcoincore, Counting.dashcore, and Counting.Wallets) are used to track the number of successfully exfiltrated wallets.

Wallet hijacking

The malware continuously monitors the clipboard for cryptocurrency wallet addresses. Using regular expressions, it detects addresses for various cryptocurrencies (BTC, ETH, LTC, etc.) and when a match is found, it replaces the victim’s address with the attacker’s predefined wallet address. As a result, the victim unknowingly transfers funds to the attacker’s wallet when pasting the address.

FTP login detail theft

The TotalCommander class is designed to steal the “wcx_ftp.ini” file from the user’s system if Total Commander is installed. It searches for the file in the Total Commander directory (under the user’s AppData folder) and copies it to the malware’s directory (C:\Users\<User>\AppData\Roaming\GHISLER\). This file typically contains FTP connection details, which could include sensitive login information. The counter Counting.totalcmd tracks the number of successful exfiltrations.

Sensitive Data Theft

The code below targets sensitive data from installed browsers, focusing on Chromium-based (e.g., Google Chrome, Opera, Brave) and Gecko-based (e.g., Firefox, Thunderbird) browsers. It searches predefined directories for browser data and extracts credentials, cookies, autofill, and credit card information. Using specialized functions, the malware decrypts encrypted data stored in files like “Login Data” and “Web Data”, storing this stolen data for later exfiltration. The decryption process relies on keys extracted from browser-specific files (e.g., “Local State” for Chromium).

VPN data theft

The below code involves two classes, CyberGhost and ExpressVPN, both of which are designed to copy files from directories (C:\Users\<User>\AppData\Roaming\CyberGhost) associated with the respective VPN services to a new directory.

• CyberGhost Class: This class checks if the CyberGhost VPN directory exists under the ApplicationData folder. If it exists, it copies all files and subdirectories from the source directory to a target directory, creating the target directory if necessary. The Counting.cgv variable is incremented each time a file or directory is copied, keeping track of the number of operations.
• ExpressVPN Class: Similar to CyberGhost, this class handles files related to ExpressVPN. It copies files and directories from the ApplicationData folder to a specified target directory. It also increments the Counting.express variable after each file or directory copy operation.

This info stealer also extracts details from several other VPN services, including NordVPN, OpenVPN, PIA VPN, and ProtonVPN.

Data exfiltration and C2

V20Collect Class Targets browser cookies and extracts sensitive data from web browsers.

• GetCookiesFromBrowser: Uses browser debugging tools to collect cookies from a specified browser.
• StartBrowser and CloseBrowser: Manages browser processes to extract cookies. Ensures all session cookies are successfully extracted.”
• GetCookies: Retrieves cookies by communicating with a WebSocket interface exposed by a browser.

Otstuk Class Handles the creation of zip archives containing stolen data and sends it either to a Telegram bot or a private server.

• CreateZipArchive: Compresses stolen files and data from the malware directory into a zip archive, then either sends to a Telegram bot or a private custom server created in PHP.

EXTERNAL THREAT LANDSCAPE MANAGEMENT

As of now, Hannibal Stealer maintains an active Telegram channel, boasting 9,587 subscribers. The group was created on September 21st, 2024.

On March 16th, 2025, the group launched an EXE installer service branded as HANNIBAL INSTALL SERVICES, offering bulk install packages at the following rates:

• 100 test installs – $15
• 500 installs – $40
• 1,000 installs – $70
• 5,000 installs – $360
• 10,000 installs – $500
• 20,000 installs – $900

Buyers were directed to contact three different users, potentially pointing to multiple developers or operators’ involvement in the project.

In addition to the main channel, there is a secondary Telegram channel, which has 18 subscribers.

Additionally, a newer channel was launched on March 28th, 2025, and currently has 107 subscribers.

This channel shared the latest Hannibal Stealer update on April 19th, indicating ongoing development and active maintenance of the malware.

On April 14th, the Telegram channel linked to Hannibal Stealer promoted a hacktivist group, sharing a screenshot of their politically-charged defacement message.

The hacktivist group claimed responsibility for hacking a server to protest anti-democratic practices in Turkey, framing their actions as socially motivated.

The endorsement of this message by the stealer’s channel suggests a possible affiliation or ideological alignment with at least one of Hannibal’s developers.

This convergence of financially driven malware and hacktivist agendas indicates a growing overlap between cybercrime and political activism in the threat landscape.

Current findings reveal that the Telegram IDs listed in recent Hannibal Stealer sales posts on dark web forums directly match those found in older threads by the user “TXSUPPORT” on BreachForum, where “TX Stealer” was promoted on November 17th, 2024, followed by “SHARP Stealer” on December 24th, 2024.

This overlap strongly suggests that Hannibal Stealer is likely a rebranded or incrementally modified version of earlier stealers, namely, SHARP and TX Stealer. The threat actor behind these appears to operate in cycles: first selling SHARP Stealer, then after being banned, pivoting to TX Stealer, and now promoting it as Hannibal Stealer. Despite the name changes, the marketing language and feature set have remained largely the same, pointing to minimal underlying innovation.

Analysis of the Hannibal Stealer source code indicates that the main modification involves changes to the log delivery mechanism, transitioning from Telegram-based exfiltration to an alternative (C2) Server.

From a functional standpoint, Hannibal appears to be a recycled variant built on the same core codebase as earlier stealers, with minimal innovation beyond its rebranded identity and updated communication methods.

PANELS

The HANNIBAL control panel, developed using the Django (Python) framework, provides a structured interface designed for executing targeted attacks, including the theft of Steam and Discord tokens. It actively collects and manages logs containing stolen credentials, tokens, and system data, while also handling stealer settings, user access, and payload deployment.

In addition to these functions, the panel offers comprehensive monitoring capabilities, granting access to browser-stored passwords, cryptocurrency wallets, Telegram sessions, system details, files from specific directories, and captured screenshots, consolidating all the exfiltrated data into a unified log for easy access and management.

Recent active panels associated with the Hannibal Stealer indicate ongoing operations and infrastructure maintenance, providing real-time access to stolen data and attacker tools, reflecting continued usage by threat actors. Below are the observed active panels:

Diamond Model

MITRE ATTACK FRAMEWORK

CONCLUSION

The Hannibal Stealer exemplifies the modern evolution of info-stealers — modular, aggressively marketed, and persistently active across multiple platforms. While the codebase reveals minimal innovation compared to its predecessors (TX and SHARP), its expanded target set, efficient data exfiltration routines, and integration with a Django-based control panel make it a formidable tool in the cybercriminal arsenal.

The use of geofencing, targeted domain matching, and modular collection mechanisms demonstrates a refined focus on monetizable assets. Moreover, the stealer’s active ecosystem, from installation services to public endorsement of hacktivist causes, highlights its dual role in financial cybercrime and ideological influence operations. Continued tracking of its infrastructure and evolution will be crucial for proactive defense and takedown efforts.

RECOMMENDATIONS

Strategic Recommendations

• Enhance Threat Intelligence Integration: Invest in cyber threat intelligence (CTI) platforms that ingest and correlate dark web, Telegram, and malware panel activity to detect emerging threats like Hannibal Stealer early.
• Strengthen Industry Collaboration and Information Sharing: Join cyber threat intelligence sharing alliances to exchange indicators of compromise (IOCs), TTPs, and campaign data related to rebranded infostealers such as Hannibal.

Tactical Recommendations

• Harden Endpoint Defenses: Use EDR solutions with memory scanning and anomaly detection to identify malicious .NET activity and process injection from known malware loaders.
• Monitor for Anomalous Application Layer Activities: Configure EDR/XDR solutions to alert on unusual access patterns to sensitive directories (e.g., browser storage, VPN config paths) and unapproved usage of system utilities (e.g., System.IO, Environment.SpecialFolder.ApplicationData) often abused by Hannibal Stealer variants.

Operational Recommendations

• Block Known Indicators of Compromise (IOCs): Continuously update firewalls, proxies, and DNS filters to block IPs, domains, and file hashes associated with Hannibal Stealer and its delivery methods.
• Monitor and Alert for VPN and Browser Credential Access: Set up alerts on unauthorized access to browser login stores, crypto wallet directories, and VPN configuration paths within enterprise environments.

INDICATORS OF COMPROMISES