General
-
Target
c10a89fbf0a360fabf69bdd95ee20eb0884abbcabb9617c2407fd1d1dd051576.exe
-
Size
270KB
-
Sample
250105-pvwfkswpgr
-
MD5
5d22a4ed1eef9ee71fae815e633cc673
-
SHA1
b0f434b5aa0ca2d2d4c7156ddc935388465f0741
-
SHA256
c10a89fbf0a360fabf69bdd95ee20eb0884abbcabb9617c2407fd1d1dd051576
-
SHA512
a90063a66fd877f0bea2954b92b57e8aff22b02cd8c869ad488f9ca32f61da6f0bebf2ba01279a718b8a1892dcdfa2857e5677965a02e140ed1e73e8fe4d2a52
-
SSDEEP
6144:XWohG5el4VQg/U+Dgx3bMAVVzddi6jWGPxF:XWo9lK53DgZMSVFjW0x
Static task
static1
Behavioral task
behavioral1
Sample
c10a89fbf0a360fabf69bdd95ee20eb0884abbcabb9617c2407fd1d1dd051576.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c10a89fbf0a360fabf69bdd95ee20eb0884abbcabb9617c2407fd1d1dd051576.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Admin\Documents\Data breach warning.txt
https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye
Targets
-
-
Target
c10a89fbf0a360fabf69bdd95ee20eb0884abbcabb9617c2407fd1d1dd051576.exe
-
Size
270KB
-
MD5
5d22a4ed1eef9ee71fae815e633cc673
-
SHA1
b0f434b5aa0ca2d2d4c7156ddc935388465f0741
-
SHA256
c10a89fbf0a360fabf69bdd95ee20eb0884abbcabb9617c2407fd1d1dd051576
-
SHA512
a90063a66fd877f0bea2954b92b57e8aff22b02cd8c869ad488f9ca32f61da6f0bebf2ba01279a718b8a1892dcdfa2857e5677965a02e140ed1e73e8fe4d2a52
-
SSDEEP
6144:XWohG5el4VQg/U+Dgx3bMAVVzddi6jWGPxF:XWo9lK53DgZMSVFjW0x
Score10/10-
RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
-
Raworld family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-