General
- Target 2025-11-21_79aea3229b7bbb0d155ee291b74b71b1_amadey_cobalt-strike_coinminer_elex
- Size 144KB
- Sample251121-p2ndjsxme1
- SHA256 7ca97f3443ba3f609b7d8bfccf71282f8c9267eddca7a4004db5a27e6fb18ee0
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!! READ ME !!.txt
Ransom Note
- Greetings! Unfortunately we have to report you that your company were compromised. All your files were encrypted and you can't restore them without our private key. Trying to restore it without our help may cause complete loss of your data. Also we researched whole your corporate network and downloaded all your sensitive data to our servers. If we will not get any contact from you in 3 next days we will public it in our news site. You can find it there ( http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�) Tor Browser is needed ( https://www.torproject.org/download/�) Also we respect your work and time and we are open for communication. In that case we are ready to discuss recovering your files and work. We can grant absolute privacy and compliance with agreements by our side. Also we can provide all necessary evidence to confirm performance of our products and statements. Feel free to contact us with quTox ( https://tox.chat/download.html�) Our ToxID: 37790E2D198DFD20C9D2887D4EF7C3E2951BB84248D192689B64DCCA3C8BD808A1895676B271 Alternative method is email: [email protected] Mark your messages with your personal ID: GA6GD342D0
Emails
URLs
-
http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�
-
https://tox.chat/download.html�
Targets
-
- Target 2025-11-21_79aea3229b7bbb0d155ee291b74b71b1_amadey_cobalt-strike_coinminer_elex
- Size 144KB
- SHA256 7ca97f3443ba3f609b7d8bfccf71282f8c9267eddca7a4004db5a27e6fb18ee0
Score10/10-
Cuba family
-
Cuba, COLDDRAW
Cuba aka COLDDRAW is a ransomware first seen in 2019.