Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. SUGARUSH

SUGARUSH

SUGARUSH is a small custom backdoor that can establish a reverse shell over TCP to a hard coded C2 address.SUGARUSH was first identified during analysis of UNC3890'sC0010 campaign targeting Israeli companies, which began in late 2020.[1]

ID: S1049
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 04 October 2022
Last Modified: 22 October 2025
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1059.003Command and Scripting Interpreter:Windows Command Shell

SUGARUSH has usedcmd for execution on an infected host.[1]

EnterpriseT1543.003Create or Modify System Process:Windows Service

SUGARUSH has created a service namedService1 for persistence.[1]

EnterpriseT1680Local Storage Discovery

MoonWind can obtain the number of drives on the victim machine.[2]

EnterpriseT1095Non-Application Layer Protocol

SUGARUSH has used TCP for C2.[1]

EnterpriseT1571Non-Standard Port

SUGARUSH has used port 4585 for a TCP connection to its C2.[1]

EnterpriseT1016.001System Network Configuration Discovery:Internet Connection Discovery

SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.[1]

Campaigns

IDNameDescription
C0010C0010

[1]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp