A take a look at the brand new Sugar ransomware demanding low ransoms

A brand new Sugar Ransomware operation actively targets particular person computer systems, fairly than company networks, with low ransom calls for.

First found by the Walmart Safety Staff, ‘Sugar’ is a brand new Ransomware-as-a-Service (RaaS) operation that launched in November 2021 however has slowly been selecting up velocity.

The identify of the ransomware is predicated on the operation’s affiliate web site found by Walmart at ‘sugarpanel[.]house’.

Unlikely most ransomware operations you examine within the information, Sugar doesn’t look like focusing on company networks however fairly particular person units, seemingly belonging to shoppers or small companies.

As such, it’s not clear how the ransomware is being distributed or infecting victims.

The Sugar Ransomware

When launched, the Sugar Ransomware will hook up with whatismyipaddress.com and ip2location.com to get the system’s IP handle and geographic location.

It’ll then proceed to obtain a 76MB file from http://cdn2546713.cdnmegafiles[.]com/data23072021_1.dat, however it’s unclear how this file is used.

Lastly, it is going to hook up with the ransomware operation’s command and management server at 179.43.160.195, the place it transmits and receives information associated to the assault. The ransomware will proceed to name  again to the command and management server as it’s executed, seemingly updating the RaaS with the standing of the assault.

When encrypting recordsdata, the ransomware will encrypt each file besides these listed within the following folders or have the next file names:

Excluded folders:

home windows
DRIVERS
PerfLogs
temp
boot

Excluded recordsdata:

BOOTNXT
bootmgr
pagefile
.exe
.dll
.sys
.lnk
.bat
.cmd
.ttf
.manifest
.ttc
.cat
.msi;

The Walmart researchers say that the ransomware encrypts recordsdata utilizing the SCOP encryption algorithm. The encrypted recordsdata may have the .encoded01 extension appended to file names, as proven under.

The ransomware can even create ransom notes named BackFiles_encoded01.txt in every folder that was scanned for recordsdata on the pc.

This ransom notice accommodates data on what occurred to the sufferer’s recordsdata, a singular ID, and a hyperlink to a Tor web site with data on methods to pay the ransom. The Tor web site is situated at chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion.

When visiting the Tor web site, the sufferer can be introduced with their very own web page that accommodates the bitcoin handle to ship a ransom, a chat part, and the flexibility to decrypt 5 recordsdata free of charge.

The ransom calls for by this operation are very low, with assaults seen by BleepingComputer demanding just a few hundred {dollars} to obtain a key. Surprisingly, on our take a look at field, the ensuing ransom demand was solely 0.00009921 bitcoins, value $4.01.

As BleepingComputer examined the ransomware on a digital machine with a small variety of recordsdata, it may point out that the ransomware is producing ransom quantities based mostly on the variety of encrypted recordsdata.

In contrast to most ransomware infections, the malware executable runs even after encryption has completed. Nonetheless, no auto-start setting is created, and it doesn’t seem to proceed encrypting new paperwork.

At the moment, it’s unclear if the ransomware has any weaknesses that would enable decryption free of charge. We are going to replace this text as extra data turns into out there.

Moreover, if you’re affected by this ransomware, please tell us the way you turned contaminated.