Babuk Ransomware v3

Reverse Engineering · 16 Jan 2021

Overview

This is a short report for the latest Babuk ransomware sample. This sample is marked as version 3 based on the run-once mutex string.

For this new version, the malware author keeps most of the old functionalities the same except for the encryption scheme and the multithreading approach.

Since I have covered Babuk old sample here, I will only discuss the new changes in this report.

For encryption, Babuk uses ChaCha20 encryption, but the Elliptic-curve Diffie–Hellman (ECDH) key generation and exchange algorithm is changed from NIST K-571 to Curve25519, one of the fastest ECDH curves.

IOCS

Babuk v3 comes in the form of a 32-bit .exe file.

MD5:…