ctrlINT What the industry said about every indicator, with the quote

fidel[.]caDomain

Reported by 1 independent source · first reported by Elastic Security Labs · last reported

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “Before encrypting a file, Cuba ransomware prepends a 1024 byte header, the first 256 bytes are the string FIDEL[.]CA and some DWORD bytes values, the next 512 bytes are the encrypted ChaCha20 KEY/IV with the public RSA key and the rest is padded with 0.”

    Elastic Security LabsVendor
    CUBA Ransomware Malware Analysis

Indicators reported together

named in the same reports
Copy these 15 indicators · defanged

Thanks — we review every report.

Report a wrong value
What is wrong with fidel[.]ca here?
No account needed. We do not store your IP address.