Analysis – Sugar Ransomware

New Ransomware group conducting low-profile attacks

Ransomware operations are highly lucrative for cybercriminals. The impact of cyber-attacks has been increasing, which has put law enforcement agencies on high alert, leading to the arrests of Threat Actors (TAs) via their cryptocurrency trails.

The Walmart Security Team has identified a new Ransomware-as-a-Service (RaaS) group, primarily targeting small businesses and individual systems for relatively low ransom amounts. This ransomware is named ‘Sugar’ Ransomware because the affiliate website is sugarpanel.space. The Sugar ransomware appends the extension encoded01 to the end of the encrypted file’s name; hence this ransomware is also often referred to as ‘Encoded01’ ransomware.

Sugar ransomware has not been making news because of its operational tactics. Instead of targeting large organizations and publishing data leaks on dedicated leak websites, Sugar operates quite stealthily and avoids being mentioned in the news.

Cyble Research & Intelligence Labs has analyzed a sample, and our findings have been presented in this blog.

The ransomware binary is a 32-bit console-based executable, as shown in Figure 1.

The ransomware executable imports only one DLL Kernel32.dll and has 8 Import functions, indicating that the ransomware is loading a secondary payload into the system after the initial infection. Figure 2 shows Sugar Ransomware’s imports.

While running from the command line, the ransomware runs in verbose mode and clearly shows the activities that it is performing. The execution of the ransomware is shown below.

The ransomware executable decrypts the Delphi-based final payload and loads it in the device’s memory at the time of execution. Figure 4 shows the Delphi-based payload in the memory.

The payload is a Delphi compiled 32-bit console type executable, as shown in Figure 5.

The Delphi binary imports 10 libraries and 51 APIs. This indicates that the Delphi payload performs the final ransomware activity. Imported libraries are shown in Figure 6.

After initial execution, the ransomware performs certain pre-encryption activities, including getting the operating system version, creating the ransom note, creating the registry keys, etc.

Initially, the ransomware tries to connect to URLs to gain the geolocation of the system using the IP address of the infected system. The URLs contacted by the ransomware are:

• http://www.whatismyip[.]com/ip-address-lookup/
• http://www.ip2location[.]com
• Whatismyipaddress[.]com
• Checkip.dyndns[.]org
• cdn2546713.cdnmegafiles[.]com /data23072021_1[.]dat

The requests created by the ransomware are shown below.

Apart from trying to get the geolocation from the internet, the ransomware attempts to download data23072021_1.dat from the hxxp://cdn2546713.cdnmegafiles[.]com. The purpose of this file is not yet clear as it is not used in any activity by the ransomware. Figure 8 shows the request.

To make reverse engineering of the ransomware difficult, the ransomware creates multiple threads. Figure 9 shows the threads created by the ransomware.

The ransomware calls the following APIs, which retrieve the details of the drive and volume of an infected machine.

• CreateFileW() – get the physical drive details from the infected system
• GetLogicaldriveStringA() – extracts the system volume names from the selected physical drive
• GetVolumeInformationW() – used for getting the individual volume details.

The ransomware creates a mutex with the name 5CC144C38A65833A12F945C66E1428BB to prohibit the execution of multiple ransomware instances, as shown below.

The ransomware has a list of files and folders to exclude from encryption.

• Important folders excluded from the encryption operation are windows, DRIVERS, PerfLogs, temp, and boot.
• File extensions excluded from the encryption are BOOTNXT, bootmgr, pagefile, .exe, .dll, .sys, .lnk, .bat, .cmd, .ttf, .manifest, .ttc, .cat and.msi.

The ransomware calls the following APIs to encrypt the files in the system.

• FindFirstFileW()
• FindNextFileW()
• ReadFile()
• WriteFile()

After this, the ransomware adds the extension encoded01 to theencrypted files.A ransom note, namely BackFiles_encoded01.txt, is also dropped in the folder during encryption. Figure 11 shows the encrypted files and ransom note.

Figure 12 shows the ransom note BackFiles_encoded01.txt dropped by the ransomware. The Threat Actor mentions the victim’s ID and Tor link for ransom negotiations in the ransom note.

After following the instructions, we could open the main page of the Sugar ransomware Tor website, as shown in Figure 13.

The Sugar ransomware website has provided an option to decrypt 5 encrypted files and the ransom demand. The ransom demanded by the Threat Actors is extremely low compared to other well-known ransomware gangs. Figure 14 shows the details of the ransom demand page.

The Ransomware gang also provided a chat page for the victims to connect to the Threat Actors, as shown below.

Conclusion

With a surge in law enforcement operations against cybercriminals, Threat Actors are attempting to make their operations more low profile to avoid becoming a priority target of law enforcement agencies. In the near future, cybercriminals could move to this low-profile, low-ransom demand model resulting in an increase in the volume of attacks. One drawback to this approach could be a reduction of sophistication in ransomware.

Our Recommendations 

​We have listed essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:  

Safety Measures Needed to Prevent Ransomware Attacks

• Conduct regular backup practices and keep those backups offline or in a separate network.
• Turn on the automatic software update feature on your computer, mobile, and other connected devices wherever possible and pragmatic. 
• Use a reputed anti-virus and Internet security software package on your connected devices, including PC, laptop, and mobile.
• Refrain from opening untrusted links and email attachments without verifying their authenticity.

Users Should Take the Following Steps After the Ransomware Attack

• Detach infected devices on the same network.
• Disconnect external storage devices if connected.
• Inspect system logs for suspicious events.​

MITRE ATT&CK® Techniques 

​Tactic	​Technique ID	​Technique Name
Execution	T1059	Command and Scripting Interpreter
Défense Evasion	T1112 T1027 T1562.001	Modify Registry Obfuscated Files or Information Impair Defenses: Disable or Modify Tools
Discovery	T1082 T1083	System Information Discovery File and Directory Discovery
Impact	T1490 T1489 T1486	Inhibit System Recovery  Service Stop Data Encrypted for Impact

Indicators Of Compromise (IoCs)

​Indicators	​Indicator type	​Description
09ad72ac1eedef1ee80aa857e300161bc701a2d06105403fb7f3992cbf37c8b9	SHA-256	Ransomware Executable
1d4f0f02e613ccbbc47e32967371aa00f8d3dfcf388c39f0c55a911b8256f654	SHA-256	Ransomware Executable
315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9	SHA-256	Ransomware Executable
dc597b3f82053e858c7cb48ae7777616edc78701f02b571a459025304a22c0a4	SHA-256	Ransomware Executable
23cd18485e6cc236a17e328ef029c9702e870436999ff7ff5019d6aaf9b09d82	SHA-256	Ransomware Executable
e72db54eea9cacd5aeb58929c6f0937a3d9fb00e5754c1381b16523c51114cf1	SHA-256	Ransomware Executable
0125d8e744bb40ee8bf74beb9c43eb4ffc4e5217cf80a1843f8d19dfb888ad68	SHA-256	Ransomware Executable
6f1d31b6739b9eecd2deaca9d433d6eeaeb4231b6cc77cda140d97ad40915082	SHA-256	Ransomware Executable
b6c27f687fbb1b0e6a45bade47a843e34896934624c3130a63a787b50df149ed	SHA-256	Ransomware Executable
c461aab15e56d817d3e2ec5c791521fdaa66acb4e65ec80dbb0639f2c624232a	SHA-256	Ransomware Executable

 Yara Rule

rule sugar_ransomware
{
	strings:
		$s1 = "This program cannot be run in DOS mode." fullword ascii
		$s2 = "VirtualAlloc" fullword ascii
		$s3 = "VirtualFree" fullword ascii
		$s4 = "LoadLibraryA" fullword ascii
		$s5 = "lstrcmpA" fullword ascii
		$s6 = { 33 8A ?? ?? ?? ?? 89 8A ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 4D ?? 8A 80 ?? ?? ?? ?? 88 01 }  
		
		
	condition:
		$s1 and $s2 and $s3 and $s4 and $s5 and $s6
}