Raworld ransomware

Who Raworld is

RA Group, also known as RA World, first surfaced in April 2023, utilizing a custom variant of the Babuk ransomware.

Recorded activity

Disclosures attributed to Raworld in this database run from March 2024 to December 2024, totalling 84 victims — 0.4% of everything tracked here. Raworld has listed victims in 19 countries in this database, most often United States, followed by Germany and United Kingdom. The sectors appearing most in its listings are Manufacturing, Business Services, Technology.

Tooling observed in Raworld operations

• ProcDump
• PsExec
• NPS
• Impacket

Software reported in use by Raworld. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

Indicators of compromise

• b8846b3e1adfc89aa767687364fecf6a
• 0b1d2e7bd7f535e427aa80adbb6a95d6
• a3a62b5aed61ace35c9aadde1f5cefde
• 1eef02b9cecf23c530b292c68a481a1c
• e5a972cc589109be1aae14cdb5fd6984
• f2070b889c7aa58ca153c6d1b3dc953e
• 66.78.40.205
• 161.35.200.18

Showing a sample of 60 MD5, 2 IP on file. Hashes and network indicators published for Raworld. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

rule ransomware_win_raworld {
    meta:
        id = "a9ed9c5a-7a0e-4c2e-90f4-d52f5589b2b8"
        version = "1.0"
        description = "Detects files related to stage 1 of a campaign from the ransomware group RA World."
        author = "Sekoia.io"
        creation_date = "2024-07-24"
        classification = "TLP:CLEAR"
        
    strings:
        $s1 = "Loder.exe" ascii fullword
        $s2 = "Stage2.exe" wide
        $s3 = "SYSVOL" wide
        $s4 = "Finish.exe" wide
        $s5 = "Exclude.exe" wide
        $s6 = "Stage3.exe" wide
        $s7 = "Pay.txt" ascii fullword
        $s8 = "RA World" ascii fullword
        $s9 = "Stage1.exe" ascii fullword
        
    condition:
        4 of them
}

Community-contributed rules for Raworld, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.