SUGARDUMP

Malware updated a month ago (2024-11-29T13:31:39.245Z)
Download STIX
Preview STIX
Sugardump is a sophisticated malware, first detected in 2022, that has primarily targeted Israel-based transportation sector organizations. As a credential harvesting utility, it specializes in password collection from Chromium-based browsers such as Chrome, Opera, and Edge. The malware infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Upon gaining initial access, it utilizes a broad toolset to gain full control over the victim's environment. Various versions of Sugardump have been identified, with each iteration becoming more advanced, demonstrating its developers' adaptability and persistent threat. The most recent versions of Sugardump exfiltrate stolen credentials through different means. The HTTP-based version sends the stolen data to a dedicated server over HTTP, while the SMTP-based version uses Gmail, Yahoo, and Yandex email addresses for exfiltration. Notably, the collected data is encoded using base64 and stored under "CrashLog.txt", which is then sent via email from specific addresses. The subject of these emails is typically "VLC Player", effectively disguising the malicious activity. The use of the word “KHODA” in Sugardump’s encryption key suggests that the developers may be Farsi speakers. In addition to extracting login credentials, newer versions of Sugardump also extract browser-related information like version details, browsing history, bookmarks, and cookies. This comprehensive extraction amplifies the potential damage and risk posed by this malware. Given its continuous evolution and the severity of its impact, organizations are advised to remain vigilant and implement robust cybersecurity measures to counteract this threat.
Description last updated: 2024-05-05T03:32:39.229Z
What's your take? (Question 1 of 0)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the SUGARDUMP Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more