Sugar Ransomware

This report analyzes the "Sugar" (Encoded01) ransomware, a low-profile RaaS targeting small businesses and individuals. The authors describe a 32-bit loader that decrypts and loads a Delphi payload in memory, enumerate API usage and multi-threading anti-analysis tactics, list network calls used for geolocation and a downloaded .dat file, show the ransomware appends the extension "encoded01" and drops a BackFiles_encoded01.txt ransom note, and document a Tor leak/negotiation site that offers low ransom demands. The report includes MITRE ATT&CK mappings, multiple SHA-256 IoCs, and a Yara rule, plus general mitigation recommendations.