BUGHATCH Malware Analysis

Elastic Security Labs provides a technical analysis of BUGHATCH, an in-memory implant used in the CUBA ransomware campaign, detailing how an obfuscated PowerShell loader decodes and executes shellcode, the implant’s information-collection and SeDebugPrivilege token elevation behavior, its custom HTTP(S) communication protocol with a 2-byte XOR session key, multithreaded command execution (reflective PE loading, remote shellcode execution, command/PowerShell execution, process migration/impersonation), and includes a YARA rule and MITRE ATT&CK mappings to aid detection.