CUBA Ransomware Malware Analysis
ID: ed28d7ba-1d8c-5ec2-9fcf-30ede10e42fc
STIX ID: report--ed28d7ba-1d8c-5ec2-9fcf-30ede10e42fc
Feed Name: Elastic Security Labs
Threat Score
Elastic Security provides a technical analysis of the CUBA (REF9019) ransomware family, describing how it enumerates local and network volumes, terminates services/processes, and encrypts files using ChaCha20 with RSA-wrapped keys. The report includes static metadata, thread and synchronization behavior, excluded paths/types, a YARA rule, and multiple SHA256 indicators to support detection and response.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.