Loading malware…
BUGHATCH is a custom Windows malware family associated with Cuba ransomware intrusions and the threat cluster tracked as UNC2596. It functions primarily as an in-memory downloader and backdoor within a bespoke command-and-control framework, typically used during staging and post-compromise operations to retrieve and execute additional payloads. Reported deployments place it in Cuba ransomware campaigns observed in 2022, where it was used alongside other tooling such as the TERMITE memory-only dropper, WEDGECUT, BURNTCIGAR, Cobalt Strike, and NetSupport Manager.
BUGHATCH is designed to download and execute arbitrary code and operator commands from its command-and-control infrastructure. Documented execution options include running system commands, PowerShell scripts, shellcode, DLLs, and portable executables, including reflective loading and injection into local or remote processes. It supports process injection into suspended child processes, agent spawning for different architectures, token impersonation, process migration, self-deletion, and process termination. It also attempts privilege-related actions such as enabling SeDebugPrivilege.
The malware performs host fingerprinting before or during beaconing, collecting system and user context information including operating system details, processor architecture, computer identity, account context, token group membership, network adapter information, and process metadata. Communications use HTTP or HTTPS with an additional custom protocol and XOR-based encryption layer. Implementations described publicly derive a session key from performance counter values and use multithreaded command handling to process tasks and return output efficiently.
Observed delivery in Cuba intrusions includes execution via obfuscated in-memory PowerShell stagers and the TERMITE loader, which decode shellcode and reflectively load the implant without writing the final payload conventionally to disk. BUGHATCH has also been described as fetching PowerShell scripts and files from command-and-control infrastructure while remaining memory-resident to reduce detection opportunities.
Within the broader Cuba intrusion lifecycle, BUGHATCH serves as a flexible post-exploitation component that helps operators maintain access, stage follow-on tooling, and prepare for lateral movement, credential theft, defense evasion, data theft, and eventual ransomware deployment. Victimology reported for the associated Cuba operations includes organizations in critical infrastructure and sectors such as retail and manufacturing, with a concentration in North America and additional activity in Europe and Asia.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
We observed the execution of the ProxyLogon exploit. Previous research has observed this threat group leveraging ProxyLogon and ProxyShell vulnerabilities to gain initial access.
Previous research has observed this threat group leveraging ProxyLogon and ProxyShell vulnerabilities to gain initial access.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Bughatch is a downloader that fetches PowerShell scripts and files from the C&C server. To evade detection, it loads in memory from a remote URL.
BUGHATCH is the name given to a Cuba Ransomware associated downloader by Mandiant... Based on analysis of the Agent32.bin file, we believe that this is the BUGHATCH malware.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
ExecutePowershell Executes a Powershell script/command ... The malware can either write the script to a file in the temporary folder with a randomly generated name
Command 3 Process injection of a PE file in a suspended child process
The malware creates a suspended svchost.exe process with CreateProcessA API, allocates a memory region for the shellcode sent by the C2 server with VirtualAllocEx, and writes to it with WriteProcessMemory, it then sets the suspended thread instruction pointer to point to the injected shellcode with SetThreadContext and finally it will resume the thread with ResumeThread
ImpersonateToken ... an attacker can either impersonate the explorer.exe token or create a token from credentials (Domain\Username, Password) sent by the C2 to spawn another instance of the current process.
Command 3 Process injection of a PE file in a suspended child process
The malware creates a suspended svchost.exe process with CreateProcessA API, allocates a memory region for the shellcode sent by the C2 server with VirtualAllocEx, and writes to it with WriteProcessMemory, it then sets the suspended thread instruction pointer to point to the injected shellcode with SetThreadContext and finally it will resume the thread with ResumeThread
SelfDeleteExitProcess ... executes the following command to self-delete: cmd.exe /c del FILEPATH >> NUL
ImpersonateToken ... an attacker can either impersonate the explorer.exe token or create a token from credentials (Domain\Username, Password) sent by the C2 to spawn another instance of the current process.
It collects the addresses of network interfaces connected to the infected machine by using the GetIpAddrTable Windows API.
It then retrieves the username and domain of the user account with the LookupAccountSidW API and concatenates the 2 strings in the following format: DOMAIN\USERNAME
the C2 then responds with the operator’s command if available, or else the agent sleeps for 60 seconds ... The main loop is made up of the following: Send POST request ... Sleep for 60 seconds
When launched, the malware will first send an HTTP POST request to the C2 server ... the C2 then responds with the operator’s command
The shellcode downloads another shellcode blob and the encrypted PE implant from the C2 server ... the malware will then do an HTTP GET request to download a packed agent in shellcode format
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Downloader malware used by Cuba ransomware group to fetch additional payloads during attacks.
Bughatch is a custom backdoor used by the Cuba ransomware group. It is deployed in process memory, connects to a C2 server, collects system and network information, and can download and execute additional payloads such as Cobalt Strike Beacon or Metasploit modules.
Named as associated malware in the broader CUBA campaign, but no functional details are provided in this reference.
A custom in-memory implant/downloader used in CUBA ransomware campaigns. It fingerprints infected hosts, communicates over HTTP(S) with a custom XOR-encrypted protocol, receives commands from C2, and can execute arbitrary payloads via reflective PE loading, DLL injection, shellcode execution, PowerShell/CMD execution, token impersonation, process migration, and spawning additional agents.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.