cuba | ceb4a8bec5139b226b4cacd798d013c22705e8de8a53e7380e3f4082fa3e7ec4

General

Target
2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry
Size 3.4MB
Sample260604-1lgrlsfz5z
SHA256 ceb4a8bec5139b226b4cacd798d013c22705e8de8a53e7380e3f4082fa3e7ec4
MD5 7e5acd3da28f7cb0ef653a1a62b38e4e
SHA1 5942fc52f6197cd337cdbfd9ee5355185448bb7c
SHA512 d7fc2bb736bd8d85ccf8ed5edee134b88a13cd38a08a4755711dbb42730f74f7d7bbed170bc800bb68af7c90a54e5cdbc8086c7acdad3f02389c783efead89d2
SSDEEP 49152:PCwsbCANnKXferL7Vwe/Gg0P+Wh5D2y9WZ1tc6guoQ:aws2ANnKXOaeOgmhZqK6guo
TLSH
T1A3F5BE43B5920472C3C84A72DE67D9B39B217E7E1BF30676BA58FEC43B352447A21225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!! READ ME !!.txt

Ransom Note

Greetings! Unfortunately we have to report you that your company were compromised. All your files were encrypted and you can't restore them without our private key. Trying to restore it without our help may cause complete loss of your data. Also we researched whole your corporate network and downloaded all your sensitive data to our servers. If we will not get any contact from you in 3 next days we will public it in our news site. You can find it there ( http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�) Tor Browser is needed ( https://www.torproject.org/download/�) Also we respect your work and time and we are open for communication. In that case we are ready to discuss recovering your files and work. We can grant absolute privacy and compliance with agreements by our side. Also we can provide all necessary evidence to confirm performance of our products and statements. Feel free to contact us with quTox ( https://tox.chat/download.html�) Our ToxID: 37790E2D198DFD20C9D2887D4EF7C3E2951BB84248D192689B64DCCA3C8BD808A1895676B271 Alternative method is email: [email protected] Mark your messages with your personal ID: GA6GD342D0

Emails

[email protected]

URLs

http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�
https://tox.chat/download.html�

Targets

- Target
  2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry
- Size 3.4MB
- SHA256 ceb4a8bec5139b226b4cacd798d013c22705e8de8a53e7380e3f4082fa3e7ec4
- MD5 7e5acd3da28f7cb0ef653a1a62b38e4e
- SHA1 5942fc52f6197cd337cdbfd9ee5355185448bb7c
- SHA512 d7fc2bb736bd8d85ccf8ed5edee134b88a13cd38a08a4755711dbb42730f74f7d7bbed170bc800bb68af7c90a54e5cdbc8086c7acdad3f02389c783efead89d2
- SSDEEP 49152:PCwsbCANnKXferL7Vwe/Gg0P+Wh5D2y9WZ1tc6guoQ:aws2ANnKXOaeOgmhZqK6guo
- TLSH
  T1A3F5BE43B5920472C3C84A72DE67D9B39B217E7E1BF30676BA58FEC43B352447A21225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery cuba gh0strat purplefox persistence ransomware rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Cuba, COLDDRAW
  Cuba aka COLDDRAW is a ransomware first seen in 2019.
  ransomware cuba
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2