General
-
Target
b26c28bd4d25753835f47fe0bfceb9790c237b36fcdb9051c87aea648381de2c.exe
-
Size
270KB
-
Sample
250105-pf91eswldr
-
MD5
b667c985e344a4a16bc64d18f4fda14e
-
SHA1
2cbc8e3f5acfeeb58929a38620e53e5a0eab30e3
-
SHA256
72692f343a1b7d807ca1d0c3f10ee0b8eb797e1d618b29205b58d9c0fdf7ba61
-
SHA512
d4653c075317cce9f858321220abe1aa04bd5327005a5abb2925aec9c3f7078343780b08be255b78ddba5b1c637659300ac840529ec8284f6e3976c496678052
-
SSDEEP
6144:XiohGXel4VQg/U+Dgx3bMAVVzddi6jWGPxF:Xio3lK53DgZMSVFjW0x
Static task
static1
Behavioral task
behavioral1
Sample
b26c28bd4d25753835f47fe0bfceb9790c237b36fcdb9051c87aea648381de2c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b26c28bd4d25753835f47fe0bfceb9790c237b36fcdb9051c87aea648381de2c.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Data breach warning.txt
https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye
Targets
-
-
Target
b26c28bd4d25753835f47fe0bfceb9790c237b36fcdb9051c87aea648381de2c.exe
-
Size
270KB
-
MD5
b667c985e344a4a16bc64d18f4fda14e
-
SHA1
2cbc8e3f5acfeeb58929a38620e53e5a0eab30e3
-
SHA256
72692f343a1b7d807ca1d0c3f10ee0b8eb797e1d618b29205b58d9c0fdf7ba61
-
SHA512
d4653c075317cce9f858321220abe1aa04bd5327005a5abb2925aec9c3f7078343780b08be255b78ddba5b1c637659300ac840529ec8284f6e3976c496678052
-
SSDEEP
6144:XiohGXel4VQg/U+Dgx3bMAVVzddi6jWGPxF:Xio3lK53DgZMSVFjW0x
Score10/10-
RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
-
Raworld family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-