EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
← Back to intelligence
Ransomware

#StopRansomware: Cuba Ransomware

Official source
EudorIA operational summary

What it means

Priority 95/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Cuba. La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.

Why it matters

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Recommended actions

  1. Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
  2. Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
  3. Confermare che backup offline e immutabili siano separati e ripristinabili.
  4. Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Potential operational benefits

  • Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
  • Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
  • Validazione documentata della capacita di ripristino
Indications to confirm against the customer's technical and organisational perimeter.
Relevant controlsVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response
AudienceITSOCCISOManagement
Information centre

Translation in progress

CISA

The official content is available in the original language. The Italian version will be published once automated checks are complete.

Text acquired from the source

Cybersecurity Advisory #StopRansomware: Cuba Ransomware Last Revised January 05, 2023 Alert Code AA22-335A Summary Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities . • Train users to recognize and report phishing attempts . • Enable and enforce phishing-resistant multifactor authentication. Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint CSA to disseminate known Cuba ransomware IOCs and TTPs associated with Cuba ransomware actors identified through FBI investigations, third-party reporting, and open-source reporting. This advisory updates the December 2021 FBI Flash: Indicators of Compromise Associated with Cuba Ransomware. Note: While this ransomware is known by industry as “Cuba ransomware,” there is no indication Cuba ransomware actors have any connection or affiliation with the Republic of Cuba. Since the release of the December 2021 FBI Flash, the number of U.S. entities compromised by Cuba ransomware has doubled, with ransoms demanded and paid on the increase. This year, Cuba ransomware actors have added to their TTPs, and third-party and open-source reports have identified a possible link between Cuba ransomw

Indicatori CISA verificabili

178 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Ultima verifica: 2026-09-26T08:07:18.231680+00:00

Scarica STIX 2.1
TipoIndicatore (non cliccabile)File
SHA-256a7c207b9b83648f69d6387780b1168e2f1eabd23ae6e162dd700ae8112f8b96cshar.bat
SHA-256952b34f6370294c5a0bb122febfaa80612fef1f32eddd48a3d0556c4286b7474tug4rigd.dll
SHA-25601242b35b6def71e42cc985e97d618e2fabd616b16d23f7081d575364d09ca74systav332.bat
SHA-2561807549af1c8fdc5b04c564f4026e41790c554f339514d326f8b55cb7b9b4f79s64174.bat
SHA-25610a5612044599128981cb41d71d7390c15e7a2a0c2848ad751c3da1cbec510a2s64174.bat
MD523cea76078dd3829bd2b7e00f2bfe2adra.ps1
SHA-1d5dab3f20d47bf4ca4910949015844d660e99ca9ra.ps1
SHA-256571f8db67d463ae80098edc7a1a0cad59153ce6592e42d370a45df46f18a4ad8ra.ps1
SHA-256e0d89c88378dcb1b6c9ce2d2820f8d773613402998b8dcdb024858010dec72edprt3389.bat
SHA-2560afed8d1b7c36008de188c20d7f0e2283251a174261547aab7fb56e31d767666pass.ps1
SHA-2562eb3ef8a7a2c498e87f3820510752043b20cbe35b0cbd9af3f69e8b8fe482676open.bat
MD5a1649dec72c316587b10d92993aee1ecnpalll.exe
SHA-19959e90d255c0221e9754db53e321ab4c7434488npalll.exe
SHA-256bd270853db17f94c2b8e4bd9fa089756a147ed45cbc44d6c2b0c78f361978906npalll.exe
SHA-256c646199a9799b6158de419b1b7e36b46c7b7413d6c35bfffaeaa8700b2dcc427newpass.ps1
SHA-256b9afe016dbdba389000b01ce7645e7eea1b0a50827cded1cbaa48fbc715197bbkomar.bat
SHA-2561b943afac4f476d523310b8e3afe7bca761b8cbaa9ea2b9f01237ca4652fc834ff.exe
SHA-2561f842f84750048bb44843c277edeaa8469697e97c4dbf8dc571ec552266bec9fcheckk.txt
SHA-256b5d202456ac2ce7d1285b9c0e2e5b7ddc03da1cbca51b5da98d9ad72e7f773b8av.bat
SHA-256310afba59ab8e1bda3ef750a64bf39133e15c89e8c7cf4ac65ee463b26b136baaus.exe
SHA-2560c2ffed470e954d2bf22807ba52c1ffd1ecce15779c0afdf15c292e3444cf674aus.exe
SHA-256db3b1f224aec1a7c58946d819d729d0903751d1867113aae5cca87e38c653cf4all.dll
SHA-256ecefd9bb8b3783a81ab934b44eb3d84df5e58f0289f089ef6760264352cf878aall.bat
SHA-256fd87ca28899823b37b2c239fbbd236c555bcab7768d67203f86d37ede19dd975agent.bat
SHA-256f538b035c3de87f9f8294bec272c1182f90832a4e86db1e47cbb1ab26c9f3a0ba99.exe
SHA-2563d4502066a338e19df58aa4936c37427feecce9ab8d43abff4a7367643ae39cea91.exe
SHA-2568a3d71c668574ad6e7406d3227ba5adc5a230dd3057edddc4d0ec5f8134d76c3a220.dll
SHA-256af4523186fe4a5e2833bbbe14939d8c3bd352a47a2f77592d8adcb569621ce02
SHA-2567e00bfb622072f53733074795ab581cf6d1a8b4fc269a50919dda6350209913c
SHA-2560d5e3483299242bf504bd3780487f66f2ec4f48a7b38baa6c6bc8ba16e4fb605
SHA-25688d13669a994d2e04ec0a9940f07ab8aab8563eb845a9c13f2b0fec497df5b179479p.ps1
SHA-256f8144fa96c036a8204c7bc285e295f9cd2d1deb0379e39ee8a8414531104dc4a9479p.bat
SHA-25608eb4366fc0722696edb03981f00778701266a2e57c40cd2e9d765bf8b0a34d09479.bat
SHA-256857f28b8fe31cf5db6d45d909547b151a66532951f26cda5f3320d2d4461b58345.dll
SHA-256f5db51115fa0c910262828d0943171d640b4748e51c9a140d06ea81ae6ea171023246st.dll
SHA-256f869e8fbd8aa1f037ad862cf6e8bbbf797ff49556fb100f2197be4ee196a89ae
SHA-256b160bd46b6efc6d79bfb76cf3eeacca2300050248969decba139e9e1cbeebf53
SHA-2560cf6399db55d40bc790a399c6bbded375f5a278dc57a143e4b21ea3f402f551f23246s.dll
SHA-25602a733920c7e69469164316e3e96850d55fca9f5f9d19a241fad906466ec8ae8
ipv4-addr216[.]45[.]55[.]3
ipv4-addr141[.]98[.]87[.]124
ipv4-addr84[.]17[.]52[.]135
ipv4-addr212[.]192[.]241[.]230
ipv4-addr209[.]76[.]253[.]84
ipv4-addr45[.]91[.]83[.]176
ipv4-addr45[.]86[.]162[.]34
ipv4-addr103[.]27[.]203[.]197
ipv4-addr193[.]34[.]167[.]17
ipv4-addr103[.]114[.]163[.]197
ipv4-addr45[.]164[.]21[.]13
ipv4-addr192[.]137[.]101[.]205
ipv4-addr192[.]137[.]100[.]98
ipv4-addr37[.]44[.]253[.]21
ipv4-addr192[.]137[.]100[.]96
ipv4-addr37[.]120[.]247[.]39
ipv4-addr92[.]222[.]172[.]172
ipv4-addr159[.]203[.]70[.]39
ipv4-addr222[.]252[.]53[.]33
ipv4-addr192[.]137[.]101[.]46
ipv4-addr217[.]79[.]43[.]148
ipv4-addr216[.]45[.]55[.]30
email-addrcuba_support[@]exploit[.]im
email-addrinbox[@]mail[.]supports24[.]net
email-addradmin[@]encryption-support[.]com
SHA-1241ce8af441db2d61f3eb7852f434642739a6cc3
SHA-25674fbf3cc44dd070bd5cb87ca2eed03e1bbeec4fec644a25621052f0a73abbe84
MD54c32ef0836a0af7025e97c6253054bca
SHA-186ed4544eeca78dc64881a916fe1e1f73dc17f7b
SHA-2561d142c36c6cdd393fe543a6b7782f25a9cbafca17a1cfa0f3fc0f5a9431dbf3f
MD5236f5de8620a6255f9003d054f08574b
SHA-19b546bd99272cf4689194d698c830a2510194722
MD503c835b684b21ded9a4ab285e4f686a3
SHA-1eaced2fcfdcbf3dca4dd77333aaab055345f3ab4
SHA-2560f385cc69a93abeaf84994e7887cb173e889d309a515b55b2205805bdfe468a3
MD5250cb957728dba0f3ae2c1c1e9bae241netping.dll
SHA-1aa3f37a75d3ba2ee74955c06eb308ad0cd6bca2enetping.dll
SHA-256f1103e627311e73d5f29e877243e7ca203292f9419303c661aec57745eb4f26cnetping.dll
ipv4-addr149[.]255[.]35[.]131
ipv4-addr23[.]227[.]198[.]246
ipv4-addr92[.]222[.]172[.]39
ipv4-addr38[.]108[.]119[.]121
MD5a839b2a598fc598044f9814873d7fc84agent64.bin
SHA-18bebb8830366bd649c488903ef8f4e166965276dagent64.bin
SHA-256bff4dd37febd5465e0091d9ea68006be475c0191bd8c7a79a44fbf4b99544ef1agent64.bin
MD5cf6ec2999b5d67df89a5350dfcff611dkomar64.dll
SHA-133fe4c6f5e7803bc0b9d977abd8b816712cbf300komar64.dll
SHA-2568e64bacaf40110547b334eadcb0792bdc891d7ae298fbfff1367125797b6036bkomar64.dll
ipv4-addr31[.]184[.]192[.]44
email-addradmin[@]cuba-supp[.]com
MD5c9d3b29e0b7662dafc6a1839ad54a6fba82.exe
SHA-1d0bbbc1866062f9a772776be6b7ef135d6c5e002a82.exe
SHA-2564306c5d152cdd86f3506f91633ef3ae7d8cf0dd25f3e37bec43423c4742f4c42a82.exe
ipv4-addr64[.]235[.]39[.]82
ipv4-addr144[.]172[.]83[.]13
ipv4-addr108[.]170[.]31[.]115
MD57d82030186936aa9fb21256d9593d992komar2.ps1
SHA-109e04ba053edcf4ca38541cbd735568945a5948dkomar2.ps1
SHA-25661971d3cbf88d6658e5209de443e212100afc8f033057d9a4e79000f6f0f7cc4komar2.ps1
SHA-2561817cc163482eb21308adbd43fb6be57fcb5ff11fd74b344469190bb48d8163bagent13.ps1
ipv4-addr154[.]35[.]175[.]225
ipv4-addr195[.]54[.]160[.]149
MD56345ac3f61b9f4ce64e82d3896baf1faveeamp.exe
SHA-113ab5762ff5023163b1ca7c7749112b3673cd3dbveeamp.exe
SHA-2569aa1f37517458d635eae4f9b43cb4770880ea0ee171e7e4ad155bbdee0cbe732veeamp.exe
ipv4-addr104[.]217[.]8[.]100
MD525a089f2082a5fcb0f4c1a12724a5521zero.exe
SHA-18a06c836c05537fcd8c600141073132d28e1172dzero.exe
SHA-2563a8b7c1fe9bd9451c0a51e4122605efc98e7e4e13ed117139a13e4749e211ed0zero.exe
ipv4-addr64[.]52[.]169[.]174
ipv4-addr79[.]141[.]169[.]220
ipv4-addr185[.]153[.]199[.]169
ipv4-addr45[.]32[.]229[.]66
ipv4-addr107[.]189[.]10[.]143
ipv4-addr204[.]13[.]164[.]118
ipv4-addr199[.]58[.]81[.]140
ipv4-addr213[.]32[.]39[.]43
MD575b55bb34dac9d02740b9ad6b682036075b55bb34dac9d02740b9ad6b6820360
SHA-1a17c21b909c56d93d978014e63fb06926eaea8e775b55bb34dac9d02740b9ad6b6820360
SHA-256141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b6994475b55bb34dac9d02740b9ad6b6820360
SSDEEP3072:yDlGttzhA9HY4ZUFxPkwlmlGev5Vy16cEZ3:yDlGtEC1xn/O5r375b55bb34dac9d02740b9ad6b6820360
ipv4-addr128[.]31[.]0[.]34
ipv4-addr94[.]103[.]9[.]79
ipv4-addr194[.]109[.]206[.]212
ipv4-addr131[.]188[.]40[.]189
ipv4-addr128[.]31[.]0[.]39
ipv4-addr193[.]23[.]244[.]244
ipv4-addr171[.]25[.]193[.]9
ipv4-addr86[.]59[.]21[.]38

Provenance

Allegato ufficiale CISA · 2022-12-02T14:43:48Z

SHA-512: cf3483cf919f756e00c3cf173e4fe0b598770b9068b367911b71b3175c916e460e20ba720e3fd716e04ad70f81d57558d4b29a6616448dec528ee9ebd6d06aa6

TipoIndicatore (non cliccabile)File
urlhttp://nastylgilast[.]com/ugr/gate[.]php
urlhttp://nagirlstylast[.]com/ls6/gate[.]php
urlhttp://johntotrepwron[.]com/ls5/gate[.]php
urlhttp://tandugolastsp[.]com/ls6/gate[.]php
urlhttp://thehentoftbet[.]ru/ls5/gate[.]php
urlhttp://toftoflethens[.]com/ugr/gate[.]php
urlhttp://torsketronand[.]ru/ls5/gate[.]php
urlhttp://witorophron[.]com/ugr/gate[.]php
urlhttp://facabeand[.]com/sliva/gate[.]php
urlhttp://babbedidndu[.]ru/ls5/forum[.]php
domain-namevu42i55fqimjx6koo7oqh3zzvy2xghqe7ot4h2ftcv2pimbauupjyqyd[.]onion
ipv4-addr31[.]184[.]198[.]74
ipv4-addr31[.]184[.]198[.]80
ipv4-addr31[.]184[.]198[.]82
ipv4-addr31[.]184[.]198[.]84
ipv4-addr31[.]184[.]198[.]85
ipv4-addr31[.]184[.]198[.]86
ipv4-addr31[.]184[.]198[.]90
ipv4-addr170[.]39[.]212[.]69
ipv4-addr62[.]210[.]54[.]235
ipv4-addr31[.]184[.]199[.]82
email-addrwaterstatus[@]cock[.]li
email-addrfrankstore[@]cock[.]li
email-addrfilebase[@]cock[.]li
email-addrsonom[@]cock[.]li
email-addrberkberk[@]cock[.]li
email-addrmagikkey[@]cock[.]li
email-addrclevelandgravett[@]yahoo[.]com
ipv4-addr31[.]184[.]198[.]111
email-addrcuba_support[@]exploit[.]im
email-addradmin[@]encryption-support[.]com
ipv4-addr46[.]17[.]106[.]230
ipv4-addr31[.]184[.]198[.]83
email-addradmin[@]cuba-supp[.]com
email-addrcloudkey[@]cock[.]li
ipv4-addr104[.]217[.]8[.]100
ipv4-addr185[.]153[.]199[.]168
ipv4-addr185[.]153[.]199[.]163
ipv4-addr209[.]127[.]187[.]245
ipv4-addr31[.]44[.]184[.]84
ipv4-addr185[.]153[.]199[.]162
ipv4-addr104[.]238[.]134[.]63
ipv4-addr185[.]153[.]199[.]164
ipv4-addr31[.]44[.]184[.]100
ipv4-addr31[.]184[.]194[.]42
urlhttp://fabickng[.]ru/7/forum[.]php
ipv4-addr69[.]30[.]232[.]138
urlhttp://nastylgilast[.]com/ls6/gate[.]php
urlhttp://tycahatit[.]ru/ls5/gate[.]php
urlhttp://leftthenhispar[.]ru/ls5/gate[.]php
urlhttp://tinheranter[.]com/ls5/gate[.]php
urlhttp://ningwitjohnno[.]ru/ls5/gate[.]php
urlhttp://reninparwil[.]com/ls5/gate[.]php
urlhttp://otinrofha[.]ru/ls4/gate[.]php

Provenance

Allegato ufficiale CISA · 2022-12-12T22:11:48Z

SHA-512: 4e5a7ab238dfbf5e08620da140729a0ca15ae7c8f1c9b958791fd1a4081430573173809eae5480519187d08d3ca8f01ad400b63222160f9420cf905d98e06cc5

Source
CISA Cybersecurity Advisories
Publishing entity
CISA
Entity type
National authority
Area
North America · US
Original language
en · translation in preparation
Publication
05/01/2023 13:00
Sharing
TLP:CLEAR
MITRE ATT&CK
T1003.001, T1059.001, T1068, T1072, T1078, T1090, T1133, T1190, T1486, T1537, T1558.003, T1562.001, T1563.002, T1566, T1584.001
CVE
CVE-2022-24521, CVE-2020-1472
Classification
Critical
Group attributed by the source
Cuba
Stated country
US
Technical scope

Affected products and versions

Verification in progress
Information not yet acquired.

The collector will check NVD and the available official vendor advisories.

Action indicated by the source

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Official technical references

Open the original source