McAfee Cuba April 2021

Cuba can query service status using QueryServiceStatusEx function.

Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.

Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.

Cuba has a packed payload when delivered.

Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.

Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.

Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.

Cuba can enumerate processes running on a victim's machine.

Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.

Cuba has used cmd.exe /c and batch files for execution.

Cuba can use the command cmd.exe /c del to delete its artifacts from the system.

Cuba can enumerate files by using a variety of functions.

Cuba can download files from its C2 server.

Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.

Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.

Cuba can discover shared resources using the NetShareEnum API call.

Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.

Cuba has a hardcoded list of services and processes to terminate.

Cuba can modify services by using the OpenService and ChangeServiceConfig functions.

Cuba has executed hidden PowerShell windows.

Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.

Cuba loaded the payload into memory using PowerShell.

Cuba can enumerate local drives, disk type, and disk free space.