SUGARLOADERMalware
Last reported 2 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 13 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing”
- T1036Masquerading
“Stage 3 (HLOADER) - HLOADER/Discord(fake) is a simple loader used as a persistence mechanism masquerading as the legitimate Discord app for the loading of SUGARLOADER.”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Python”
- T1059.004Unix Shell
“Command and Scripting Interpreter: Unix Shell”
What the reports say
1 report, newest first · the exact sentence from each-
Elastic catches DPRK passing out KANDYKORN“Stage 2 payload .sld and .log: SUGARLOADER”
Indicators in its reports
named in the reports above- 23.254.226[.]90in 1 report
- 2360a69e5fd7217e…0234f7762df1in 1 report
- discord[.]appin 1 report
- 5555494485b460f1…b94d01136320in 1 report
- hxxps://drive.google[.]com/file/d1KW5nQ8MZccug6Mp4QtKyWLT3HIZzHNIL2in 1 report
- 192.119.64[.]43in 1 report
- pesnam.publicvm[.]comin 1 report
- bitscrunnch.linkpc[.]netin 1 report
- jobintro.linkpc[.]netin 1 report
- jobdescription.linkpc[.]netin 1 report
- docsenddata.linkpc[.]netin 1 report
- docsendinfo.linkpc[.]netin 1 report
- datasend.linkpc[.]netin 1 report
- exodus.linkpc[.]netin 1 report
- bitscrunnch.run[.]placein 1 report
- coupang-networks[.]picsin 1 report
- group.pro-tokyo[.]topin 1 report
- hxxps://github[.]com/Prtofin 1 report
- hxxps://github[.]com/wokurksin 1 report
- 3ea2ead8f3cec030…fe8a6cb59940in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.