Does anyone know why some ransomware families (e.g. Cuba but also Phobos if I am not mistaken) pad the file header to get to 1024 bytes?
I mean what would be a reason for the ransomware developer to not just encrypt the entire file but add padding to get to a certain header size?
Before encrypting a file, Cuba ransomware prepends a 1024 byte header, the first 256 bytes are the string FIDEL.CA and some DWORD bytes values, the next 512 bytes are the encrypted ChaCha20 KEY/IV with the public RSA key and the rest is padded with 0.
I get why they add the
FIDEL.CA flag and the key, but why add the additional padding? What's important about the header being 1024 bytes?