SUGARDUMP
SUGARDUMP is a proprietary browser credential harvesting tool that was used by UNC3890 during the C0010 campaign. The first known SUGARDUMP version was used since at least early 2021, a second SMTP C2 version was used from late 2021-early 2022, and a third HTTP C2 variant was used since at least April 2022.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1555 | .003 | 从密码存储中获取凭证: Credentials from Web Browsers |
SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.[1] |
| Enterprise | T1036 | .004 | 伪装: Masquerade Task or Service |
SUGARDUMP's scheduled task has been named |
| .005 | 伪装: Match Legitimate Name or Location |
SUGARDUMP has been named |
||
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols | |
| .003 | 应用层协议: Mail Protocols | |||
| Enterprise | T1560 | .003 | 归档收集数据: Archive via Custom Method |
SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.[1] |
| Enterprise | T1074 | .001 | 数据分段: Local Data Staging |
SUGARDUMP has stored collected data under |
| Enterprise | T1083 | 文件和目录发现 |
SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string |
|
| Enterprise | T1217 | 浏览器信息发现 |
SUGARDUMP has collected browser bookmark and history information.[1] |
|
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.[1] |
| Enterprise | T1518 | 软件发现 |
SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.[1] |
|
| Enterprise | T1041 | 通过C2信道渗出 |
SUGARDUMP has sent stolen credentials and other data to its C2 server.[1] |
|
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
SUGARDUMP has created scheduled tasks called |