Babuk Loader Ransomware
Babuk Loader is a human-operated ransomware targeting businesses worldwide. Despite appearing to be amateurishly constructed, it’s encryption functions are well-implemented, and it has already impacted a large number of organisations.
The ransomware encrypts files on your computer system and demands a ransom to be paid to allegedly recover them.
Babuk Loader infections appears to be customised, with the malware binary containing hard-coded information related to each target.
Once deployed, Babuk Loader will attempt to terminate various security and recovery services as well as database, browser and email programs. It then encrypt all non-system files on local and network drives using a ChaCha8 implementation, the keys for which are then encrypted using a custom elliptic-curve Diffie-Hellman implementation thought to be based on several components.
Indicators of Compromise
File extensions
- __NIST_K571__
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.