Pulse Detail — Threat Intelligence

PULSE NAME

#StopRansomware: Cuba Ransomware

WHITE Oracle02 2023-04-20 Modified: 2023-04-20

145

IOCs

HIGH VOLUME

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint CSA to disseminate known Cuba ransomware IOCs and TTPs associated with Cuba ransomware actors identified through FBI investigations, third-party reporting, and open-source reporting

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1003 T1059 T1068 T1072 T1078 T1090 T1133 T1190 T1558 T1562 T1563 T1566 T1584

Indicators of Compromise (3 / 145 total)

All IPv4 BitcoinAddress CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain email hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	03c835b684b21ded9a4ab285e4f686a3	MD5 of eaced2fcfdcbf3dca4dd77333aaab055345f3ab4	2023-04-20
FileHash-MD5	236f5de8620a6255f9003d054f08574b	—	2023-04-20
FileHash-MD5	4c32ef0836a0af7025e97c6253054bca	—	2023-04-20

References (1)

↗ https://www.cisa.gov/sites/default/files/publications/aa22-335a-stopransomware-cuba-ransomware.pdf