New SugarGh0st RAT targets Uzbekistan government and South Korea

MITRE Techniques

• [T1566.001] Phishing: Attachment – The initial vector is described as a phishing email with an attached malicious RAR archive sent to a Ministry employee. [“The initial vector of the campaign is likely a phishing email with an attached malicious RAR archive file sent to an employee of the Ministry of Foreign Affairs.”]
• [T1023] Shortcut Modification – Infection chains leverage Windows Shortcut (LNK) files embedded with malicious JavaScript to deliver components. [“Two infection chains leveraging Windows Shortcut embedded with malicious JavaScript to deliver the components to drop and launch the SugarGh0st payload.”]
• [T1059.007] JavaScript – The attack uses heavily obfuscated JavaScript as the dropper. [“The JavaScript dropper is a heavily obfuscated script embedded with base64 encoded data of the other components of the attack.”]
• [T1027] Obfuscated/Compressed Files and Information – Obfuscated JavaScript and encoded payloads are used to conceal the dropper and components. [“heavily obfuscated script embedded with base64 encoded data.”]
• [T1218.005] Rundll32 – The dropper sideloads a DLL and executes via a copied rundll32, enabling execution of the loader. [“sideloading it with a copied rundll32.”]
• [T1055] Process Injection – The loader injects and runs shellcode via DynamicWrapperX to execute SugarGh0st in memory. [“DynamixWrapperX loader to inject and run the shellcode.”]
• [T1060] Registry Run Keys/Startup Folder – The second infection chain creates a Run key (CTFMON.exe) for persistence. [“creating a registry subkey called ‘CTFMON.exe’ in the Run registry key.”]
• [T1056.001] Keylogging – SugarGh0st implements real-time and offline keylogging. [“starts the keylogging function.”]
• [T1113] Screen Capture – SugarGh0st can take screenshots of the victim machine’s desktop. [“take screenshots of the victim machine’s current desktop.”]
• [T1125] Video Capture – SugarGh0st can access the machine’s camera to capture video/images. [“access the machine camera to capture the screen.”]
• [T1071.001] Web Protocols (C2) – The malware uses C2 domains and sockets to communicate, including heartbeat patterns. [“WSAStartup functions, a hardcoded C2 domain and port to establish the connection to the C2 server.”]
• [T1070.001] Clear Windows Event Logs – The malware can clear event logs to hinder detection. [“clears the machine’s Application, Security and System event logs to hide the malicious operations.”]