WinRAR Archive .R00, .R01, .R05, .R15, .R20, .R25 Malicious Email Attachments
Online users who have received unexpected email messages with attached files with names ending with ".r00", ".r01", ".r02", ".r03", ".r05", ".r10", ".r12", ".r15", ".r20", ".r25" and so on... are asked not to open them. This is because the fake email messages are being sent by cyber criminals and the attachments are WinRAR compressed archived files that contain malware, malicious programs or computer viruses. And, any attempt to open the malicious attachments will result in the recipients getting their computers infected with a virus, Trojan horse, spyware, ransomware or other malware.
A Malicious WinRAR Archive .R00, .R01... Email Message
Subject: INVOICE NO 3
Date: Tue 15/08/2017 08:07
From: Sadiya Sayeed
Attachment: INVOICE NO 3.r20Dear sir/madam,
Find and open attached document by double clicking it, because document is protected.
advice according invoice.
best regards
--
Sadia Saeed
Sales & Technical Manager
Mobile: +63 926 618 1579
+63 998 889 2257
Tel: +63 442 4295
sadia.asn@gmail.com
The .RAR compression is similar to ZIP which is the most popular file compression or archive formats.
Cyber criminals usually store their malware in compressed files to help prevent antivirus software from detecting them. In other words, they do it because the compressed malicious email attachments may bypass the recipients' antivirus software.
What is a ".RAR" file?
RAR is the native format of WinRAR archiver. Like other archives, RAR files are data containers, they store one or several files in the compressed form. The data-containers or split multi-volume RAR compressed files archive use file extensions or names ending with:
".r00",".r01", ".r02", ".r03", ,".r04", ".r05", ".r06", ".r07", ".r08", ".r09", ".r10", ".r11", ".r12", ".r13", ".r14", ".r15", ".r16", ".r17", ".r18", ".r19", ".r20", ".r21", ".r22", ".r23", ".r24", ".r25", ".r26", ". r27", ". 28", ". 29", ". 30" and so on.
After you have downloaded RAR file from the Internet, you need to unpack its contents in order to use it.
Check the comment section for additional information, or share what you know or ask a question about this article, by clicking the 'View or Write Comment' button below.
Note: Some of the information in samples on this website may have been impersonated or spoofed.