{
  "family": "rasftuby",
  "sample_count": 31,
  "category": "ransomware",
  "description": "Rasftuby (identified across antivirus telemetries and threat intelligence feeds under signatures including Ransom:Win32/Rasftuby, Trojan-Ransom.Win32.Rasftuby, and Trojan.Rasftuby) is a destructive crypto-ransomware and extortion threat active since 2016. Delivered predominantly through malicious spam campaigns with macro-laced documents and drive-by download compromise chains, Rasftuby executes immediate evasion and reconnaissance routines upon system infiltration. Rasftuby terminates database, backup, and endpoint security processes to release open file handles before traversing local storage drives, removable media, and mounted network file shares. Using AES-256 symmetric encryption combined with RSA public-key protection, Rasftuby encrypts documents, spreadsheets, databases, and archives, appending an extortion extension to affected files. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), alters desktop background settings to display extortion notices, and demands cryptocurrency ransoms in exchange for a proprietary decryptor.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Rasftuby",
    "Trojan-Ransom.Win32.Rasftuby",
    "Trojan.Rasftuby",
    "Win32/Rasftuby",
    "Ransom:Win32/Rasftuby.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Rasftuby?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rasftuby is a destructive ransomware threat that encrypts user data with AES-256 and displays extortion demands for cryptocurrency payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rasftuby prevent victims from recovering data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin to delete all Volume Shadow Copies and disables Windows automated startup recovery via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What files are targeted by Rasftuby for encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets documents, spreadsheets, databases, financial records, archives, and multimedia files on local and network drives."
      }
    },
    {
      "@type": "Question",
      "name": "How is Rasftuby distributed to enterprise systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via phishing emails with malicious document attachments, compromised software downloads, and exploit kit drive-by infections."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures protect against Rasftuby ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Maintain offline immutable backups, enable Controlled Folder Access in Microsoft Defender, and restrict execution of unauthorized scripts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Macro Documents",
    "Exploit Kit Drive-by Compromise",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "AES-256 / RSA-2048 Cryptographic File Locking",
    "Volume Shadow Copy Purging (vssadmin)",
    "Network Share Traversal & Encryption",
    "Security & Backup Service Termination",
    "Extortion Desktop Wallpaper Replacement"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Ransom Note Text / HTML File"
    ],
    "network_signatures": [
      "HTTP/HTTPS POST requests transmitting victim system UID and generated encryption session keys to remote C2 servers",
      "Tor-routed payment portal communications for ransom negotiation"
    ],
    "evasion_techniques": [
      "Killing database and backup software processes via taskkill prior to encryption",
      "Dynamic API resolution through PEB hash lookups to conceal cryptographic API calls"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7bf2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0",
      "8ca3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RasftubyLocker",
      "HKCU\\Control Panel\\Desktop\\Wallpaper"
    ],
    "file_paths": [
      "%Temp%\\rasftuby.exe",
      "%Desktop%\\HOW_TO_RESTORE_FILES.txt",
      "%AppData%\\Rasftuby\\keys.dat"
    ]
  },
  "defensive_measures": [
    "Implement automated, air-gapped backups to ensure full recovery capability without ransom payments",
    "Enable Controlled Folder Access in Microsoft Defender to safeguard critical document repositories",
    "Block command-line invocations of vssadmin delete shadows using endpoint behavioral detection rules"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Rasftuby",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Rasftuby"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Rasftuby",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Rasftuby.A",
      "Ransom:Win32/Rasftuby.B"
    ]
  },
  "motivation": "Financial Cybercrime & Extortion Ransom Payments",
  "sample_hashes": []
}