SUGARUSH — Malware Profile

SUGARUSH is a small custom backdoor that can establish a reverse shell over TCP to a hard coded C2 address. SUGARUSH was first identified during analysis of UNC3890's C0010 campaign targeting Israeli companies, which began in late 2020.

MITRE ATT&CK techniques (6)

• T1016.001 Internet Connection Discovery
• T1059.003 Windows Command Shell
• T1095 Non-Application Layer Protocol
• T1543.003 Windows Service
• T1571 Non-Standard Port
• T1680 Local Storage Discovery

Read the full analysis on IntelFusions