General
-
Target
02062da1f52d15e66a08348cded9e478b1e0c7b334de4b42c719710ab2b5bf16.exe
-
Size
270KB
-
Sample
250507-m3kyps1shs
-
MD5
e634fe96f81b8a5198c8ac65a95e58a4
-
SHA1
2008c533a48ead9904a42286abced74e03d47c9e
-
SHA256
02062da1f52d15e66a08348cded9e478b1e0c7b334de4b42c719710ab2b5bf16
-
SHA512
db690e85e07dbf9d205e6126fa0f6f727a0562b99e9081810c814dd7e80acc4a48a81c6c501f3088f27cff03ddba95d97c2a89875ef03aae30098d6e8c2eba41
-
SSDEEP
6144:XdohG/el4VQg/U+Dgx3bMAVVzddi6jWGPxF:XdovlK53DgZMSVFjW0x
Static task
static1
Behavioral task
behavioral1
Sample
02062da1f52d15e66a08348cded9e478b1e0c7b334de4b42c719710ab2b5bf16.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
02062da1f52d15e66a08348cded9e478b1e0c7b334de4b42c719710ab2b5bf16.exe
Resource
win11-20250502-en
Malware Config
Extracted
C:\Recovery\Data breach warning.txt
https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye
Targets
-
-
Target
02062da1f52d15e66a08348cded9e478b1e0c7b334de4b42c719710ab2b5bf16.exe
-
Size
270KB
-
MD5
e634fe96f81b8a5198c8ac65a95e58a4
-
SHA1
2008c533a48ead9904a42286abced74e03d47c9e
-
SHA256
02062da1f52d15e66a08348cded9e478b1e0c7b334de4b42c719710ab2b5bf16
-
SHA512
db690e85e07dbf9d205e6126fa0f6f727a0562b99e9081810c814dd7e80acc4a48a81c6c501f3088f27cff03ddba95d97c2a89875ef03aae30098d6e8c2eba41
-
SSDEEP
6144:XdohG/el4VQg/U+Dgx3bMAVVzddi6jWGPxF:XdovlK53DgZMSVFjW0x
Score10/10-
RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
-
Raworld family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-