General
-
Target
18061dca0d4da1cd8297607c132010c56c0d82520a0f922ba24dd65bc55a29ac.exe
-
Size
270KB
-
Sample
250507-mdsx1shk51
-
MD5
bf668193bda2db88922e5db1c360d0c1
-
SHA1
a671fe4e1bec303ae44e0dda41aebb12b14be4ca
-
SHA256
18061dca0d4da1cd8297607c132010c56c0d82520a0f922ba24dd65bc55a29ac
-
SHA512
15c6b185c67354204b159a971111fdab266f99a90a83a967e10eb1b6442999850a76fb91179c1de527e1578d342c6429366c39afa39235aaab105cc77984e1df
-
SSDEEP
6144:XxohG0el4VQg/U+Dgx3bMAVVzddi6jWGPxF:Xxo8lK53DgZMSVFjW0x
Static task
static1
Behavioral task
behavioral1
Sample
18061dca0d4da1cd8297607c132010c56c0d82520a0f922ba24dd65bc55a29ac.exe
Resource
win10v2004-20250502-en
Malware Config
Extracted
C:\Recovery\WindowsRE\Data breach warning.txt
https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye
Targets
-
-
Target
18061dca0d4da1cd8297607c132010c56c0d82520a0f922ba24dd65bc55a29ac.exe
-
Size
270KB
-
MD5
bf668193bda2db88922e5db1c360d0c1
-
SHA1
a671fe4e1bec303ae44e0dda41aebb12b14be4ca
-
SHA256
18061dca0d4da1cd8297607c132010c56c0d82520a0f922ba24dd65bc55a29ac
-
SHA512
15c6b185c67354204b159a971111fdab266f99a90a83a967e10eb1b6442999850a76fb91179c1de527e1578d342c6429366c39afa39235aaab105cc77984e1df
-
SSDEEP
6144:XxohG0el4VQg/U+Dgx3bMAVVzddi6jWGPxF:Xxo8lK53DgZMSVFjW0x
Score10/10-
RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
-
Raworld family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (166) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-