SYMBOLCOMMON_NAMEaka. SYNONYMS
win.babuk (Back to overview)

Babuk

aka: Babyk, Vasa Locker
VTCollection    

Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.

References
2026-08-28 ⋅ ⋅ F6 ⋅ F6
Ragnarök: F6 investigated the attacks of the VantaCore ransomware group
Babuk LockBit
2024-11-22 ⋅ Medium (@lcam) ⋅ Luca Mella
How to target European SME with Ransomware? Through Zyxel!
HellDown Babuk
2024-01-09 ⋅ Avast Decoded ⋅ Threat Research Team
Avast Updates Babuk Ransomware Decryptor in Cooperation with Cisco Talos and Dutch Police
Babuk
2023-12-22 ⋅ PRODAFT ⋅ PRODAFT
Smoke and Mirrors: Understanding The Workings of Wazawaka
Conti Monti Babuk Hive LockBit RagnarLocker Trigona
2023-12-13 ⋅ cocomelonc ⋅ cocomelonc
Malware in the wild book
AsyncRAT Babuk BlackCat BlackLotus Carbanak HelloKitty Paradise Stealc WinDealer
2023-06-17 ⋅ Github (EmissarySpider) ⋅ EmissarySpider
ransomware-descendants
Babuk Conti LockBit
2023-06-15 ⋅ Github (cocomelonc) ⋅ cocomelonc
Malware analysis report: Babuk ransomware
Babuk
2023-05-16 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Russian Hacker “Wazawaka” Indicted for Ransomware
Babuk Hive LockBit LockBit Babuk Hive LockBit
2022-12-07 ⋅ Morphisec ⋅ Morphisec Labs
New Babuk Ransomware Found in Major Attack
Babuk
2022-08-24 ⋅ Trend Micro ⋅ Hitomi Kimura, Ryan Soliven
Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus
Babuk
2022-08-24 ⋅ Trend Micro ⋅ Hitomi Kimura, Ryan Soliven
Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus (IoCs)
Babuk
2022-06-13 ⋅ Jorge Testa ⋅ Jorge Testa
Killing The Bear - Evil Corp
FAKEUPDATES Babuk Blister DoppelPaymer Dridex Entropy FriedEx Hades Macaw Phoenix Locker WastedLoader WastedLocker
2022-05-06 ⋅ cyble ⋅ Cyble Research Labs
Rebranded Babuk Ransomware In Action: DarkAngels Ransomware Performs Targeted Attack
Babuk
2022-04-20 ⋅ Bleeping Computer ⋅ Bill Toulas
Microsoft Exchange servers hacked to deploy Hive ransomware
Babuk BlackByte Conti Hive LockFile
2022-03-24 ⋅ SentinelOne ⋅ Antonio Cocomazzi
Ransomware Encryption Internals: A Behavioral Characterization
Babuk Babuk BlackMatter
2022-03-23 ⋅ splunk ⋅ Shannon Davis
Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-02-23 ⋅ splunk ⋅ Shannon Davis, SURGe
An Empirically Comparative Analysis of Ransomware Binaries
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-02-14 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Wazawaka Goes Waka Waka
Babuk
2021-11-03 ⋅ Cisco Talos ⋅ Caitlin Huey, Chetan Raghuprasad, Vanja Svajcer
Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk
Babuk CHINACHOPPER
2021-10-26 ⋅ Github (vc0RExor) ⋅ Aaron Jornet
Babuk Ransomware
Babuk
2021-10-18 ⋅ McAfee ⋅ Thibault Seret
Is There Really Such a Thing as a Low-Paid Ransomware Operator?
Babuk
2021-10-12 ⋅ CrowdStrike ⋅ CrowdStrike Intelligence Team
ECX: Big Game Hunting on the Rise Following a Notable Reduction in Activity
Babuk BlackMatter DarkSide REvil Avaddon Babuk BlackMatter DarkSide LockBit Mailto REvil
2021-10-01 ⋅ ZeroFox ⋅ Stephan Simon
Babuk Ransomware Variant Delta Plus Used in Live Attacks After Source Code Leaked
Babuk
2021-09-10 ⋅ S2W LAB Inc. ⋅ S2W TALON
Groove x RAMP : The relation between Groove, Babuk, Payload.bin, RAMP, and BlackMatter
Babuk BlackMatter Babuk BlackMatter
2021-09-09 ⋅ Advanced Intelligence ⋅ Anastasia Sentsova, Yelisey Boguslavskiy
Groove VS Babuk; Groove Ransom Manifesto & RAMP Underground Platform Secret Inner Workings
Babuk Babuk
2021-09-08 ⋅ Medium s2wlab ⋅ S2W TALON
Groove’s thoughts on Blackmatter, Babuk, and cheese shortages in the Netherlands
Babuk BlackMatter Babuk BlackMatter
2021-09-08 ⋅ McAfee ⋅ John Fokker, Max Kersten, Thibault Seret
How Groove Gang is Shaking up the Ransomware-as-a-Service Market to Empower Affiliates
Babuk BlackMatter Babuk BlackMatter CTB Locker
2021-09-01 ⋅ Medium s2wlab ⋅ Chaewon Moon, Denise Dasom Kim, Jungyeon Lim, S2W LAB INTELLIGENCE TEAM, Sujin Lim, Yeonghyeon Jeong
BlackMatter x Babuk : Using the same web server for sharing leaked files
Babuk BlackMatter Babuk BlackMatter
2021-08-15 ⋅ Symantec ⋅ Threat Hunter Team
The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-08-05 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Ransomware Gangs and the Name Game Distraction
DarkSide RansomEXX Babuk Cerber Conti DarkSide DoppelPaymer Egregor FriedEx Gandcrab Hermes Maze RansomEXX REvil Ryuk Sekhmet
2021-07-28 ⋅ KELA ⋅ Victoria Kivilevich
New Russian-Speaking Forum – A New Place for RaaS?
Babuk
2021-07-28 ⋅ McAfee ⋅ Noël Keijzer, Thibault Seret
Babuk: Moving to VM and *nix Systems Before Stepping Away
Babuk
2021-07-05 ⋅ Lab52 ⋅ Th3spis
Quick review of Babuk ransomware builder
Babuk
2021-07-04 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
Babuk Ransomware: The Builder
Babuk Babuk
2021-07-01 ⋅ BleepingComputer ⋅ Ionut Ilascu
Babuk ransomware is back, uses new version on corporate networks
Babuk
2021-06-30 ⋅ BleepingComputer ⋅ Lawrence Abrams
Leaked Babuk Locker ransomware builder used in new attacks
Babuk
2021-06-27 ⋅ Twitter (@GossiTheDog) ⋅ Kevin Beaumont
Tweet on babuk ransomware builder
Babuk
2021-06-27 ⋅ The Record ⋅ Catalin Cimpanu
Builder for Babuk Locker ransomware leaked online
Babuk
2021-06-10 ⋅ McAfee ⋅ ATR Operational Intelligence Team
Are Virtual Machines the New Gold for Cyber Criminals?
Babuk DarkSide
2021-06-06 ⋅ Bleeping Computer ⋅ Lawrence Abrams
New Evil Corp ransomware mimics PayloadBin gang to evade US sanctions
Babuk FriedEx PayloadBIN WastedLocker
2021-06-03 ⋅ Medium s2wlab ⋅ Denise Dasom Kim, Hyunmin Suh, Jungyeon Lim, YH Jeong
W1 Jun | EN | Story of the week: Ransomware on the Darkweb
DarkSide Babuk DarkSide
2021-05-31 ⋅ DataBreaches.net ⋅ Dissent
Babuk re-organizes as Payload Bin, offers its first leak
Babuk HelloKitty
2021-05-25 ⋅ Medium s2wlab ⋅ Denise Dasom Kim, Hyunmin Suh, Jungyeon Lim
W4 May | EN | Story of the week: Ransomware on the Darkweb
Babuk REvil
2021-05-12 ⋅ Kaspersky ⋅ Dmitry Galov, Ivan Kwiatkowski, Leonid Bezvershenko
Ransomware world in 2021: who, how and why
Babuk REvil
2021-05-10 ⋅ DarkTracer ⋅ DarkTracer
Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-05-07 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Data leak marketplaces aim to take over the extortion economy
Babuk Maze
2021-04-29 ⋅ ⋅ Sekurak.pl ⋅ Sekurak
Udało nam się zrealizować wywiad z grupą ransomware (Babuk), która zaszyfrowała policję metropolitarną w Waszyngtonie
Babuk
2021-04-25 ⋅ Vulnerability.ch Blog ⋅ Corsin Camichel
Ransomware and Data Leak Site Publication Time Analysis
Avaddon Babuk Clop Conti DarkSide DoppelPaymer Mespinoza Nefilim REvil
2021-02-24 ⋅ McAfee ⋅ Alexandre Mundo, John Fokker, Thibault Seret, Thomas Roccia
Technical Analysis of Babuk Ransomware
Babuk
2021-02-08 ⋅ Medium Sebdraven ⋅ sebdraven
Babuk is distributed packed
Babuk
2021-02-05 ⋅ Trend Micro ⋅ Don Ovid Ladores, Junestherry Salvador, Llalum Victoria, Monte de Jesus, Nikko Tamana, Raphael Centeno
New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker
Babuk TeslaCrypt
2021-02-02 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Babyk Ransomware won't hit charities, unless they support LGBT, BLM
Babuk
2021-01-26 ⋅ Medium s2wlab ⋅ Hyunmin Suh
W4 Jan | EN | Story of the week: Ransomware on the Darkweb
Avaddon Babuk LockBit
2021-01-16 ⋅ Chuongdong blog ⋅ Chuong Dong
Babuk Ransomware v3
Babuk
2021-01-05 ⋅ Twitter (@Sebdraven) ⋅ Sébastien Larinier
Tweet on link between Babuk and Vasa locker
Babuk
2021-01-03 ⋅ Chuongdong blog ⋅ Chuong Dong
Babuk Ransomware
Babuk
2021-01-01 ⋅ Sogeti ⋅ Sogeti
Babuk ransomware
Babuk
Yara Rules
[TLP:WHITE] win_babuk_auto (20260917 | Detects win.babuk.)
rule win_babuk_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.babuk."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff15???????? 6800000100 e8???????? 83c404 }
            // n = 4, score = 800
            //   ff15????????         |                     
            //   6800000100           | push                0x10000
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_1 = { 50 ff15???????? 83f803 7502 }
            // n = 4, score = 800
            //   50                   | push                eax
            //   ff15????????         |                     
            //   83f803               | cmp                 eax, 3
            //   7502                 | jne                 4

        $sequence_2 = { 8b4dfc 8b5508 8b44ca04 50 8b0cca 51 e8???????? }
            // n = 7, score = 600
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   8b44ca04             | mov                 eax, dword ptr [edx + ecx*8 + 4]
            //   50                   | push                eax
            //   8b0cca               | mov                 ecx, dword ptr [edx + ecx*8]
            //   51                   | push                ecx
            //   e8????????           |                     

        $sequence_3 = { 8945fc 837dfc0a 0f83dc000000 8b4dfc 8b5508 8b44ca04 }
            // n = 6, score = 600
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   837dfc0a             | cmp                 dword ptr [ebp - 4], 0xa
            //   0f83dc000000         | jae                 0xe2
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   8b44ca04             | mov                 eax, dword ptr [edx + ecx*8 + 4]

        $sequence_4 = { 8bec 8b4508 25ff000000 b901000000 }
            // n = 4, score = 600
            //   8bec                 | mov                 ebp, esp
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   25ff000000           | and                 eax, 0xff
            //   b901000000           | mov                 ecx, 1

        $sequence_5 = { b908000000 6bf100 8b45ec 8b55f0 b11a }
            // n = 5, score = 600
            //   b908000000           | mov                 ecx, 8
            //   6bf100               | imul                esi, ecx, 0
            //   8b45ec               | mov                 eax, dword ptr [ebp - 0x14]
            //   8b55f0               | mov                 edx, dword ptr [ebp - 0x10]
            //   b11a                 | mov                 cl, 0x1a

        $sequence_6 = { eb09 8b45fc 83c002 8945fc 837dfc0a 0f83dc000000 }
            // n = 6, score = 600
            //   eb09                 | jmp                 0xb
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   83c002               | add                 eax, 2
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   837dfc0a             | cmp                 dword ptr [ebp - 4], 0xa
            //   0f83dc000000         | jae                 0xe2

        $sequence_7 = { 50 e8???????? 83c408 8945ec 8955f0 b908000000 6bf100 }
            // n = 7, score = 600
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax
            //   8955f0               | mov                 dword ptr [ebp - 0x10], edx
            //   b908000000           | mov                 ecx, 8
            //   6bf100               | imul                esi, ecx, 0

        $sequence_8 = { 6a00 8b45a4 50 6a01 8b4da8 51 }
            // n = 6, score = 600
            //   6a00                 | push                0
            //   8b45a4               | mov                 eax, dword ptr [ebp - 0x5c]
            //   50                   | push                eax
            //   6a01                 | push                1
            //   8b4da8               | mov                 ecx, dword ptr [ebp - 0x58]
            //   51                   | push                ecx

        $sequence_9 = { 8d148d04000000 8955ec 8b45e0 8b4dec 8d540102 52 6a00 }
            // n = 7, score = 600
            //   8d148d04000000       | lea                 edx, [ecx*4 + 4]
            //   8955ec               | mov                 dword ptr [ebp - 0x14], edx
            //   8b45e0               | mov                 eax, dword ptr [ebp - 0x20]
            //   8b4dec               | mov                 ecx, dword ptr [ebp - 0x14]
            //   8d540102             | lea                 edx, [ecx + eax + 2]
            //   52                   | push                edx
            //   6a00                 | push                0

        $sequence_10 = { 8b8c8508fdffff 51 ff15???????? eb02 eb21 6800800000 }
            // n = 6, score = 600
            //   8b8c8508fdffff       | mov                 ecx, dword ptr [ebp + eax*4 - 0x2f8]
            //   51                   | push                ecx
            //   ff15????????         |                     
            //   eb02                 | jmp                 4
            //   eb21                 | jmp                 0x23
            //   6800800000           | push                0x8000

        $sequence_11 = { b804000000 6bc800 8b5508 c7040a65787061 b804000000 }
            // n = 5, score = 600
            //   b804000000           | mov                 eax, 4
            //   6bc800               | imul                ecx, eax, 0
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   c7040a65787061       | mov                 dword ptr [edx + ecx], 0x61707865
            //   b804000000           | mov                 eax, 4

        $sequence_12 = { c7040100000000 c744010400000000 ba08000000 6bc200 8b4d08 8b540104 52 }
            // n = 7, score = 600
            //   c7040100000000       | mov                 dword ptr [ecx + eax], 0
            //   c744010400000000     | mov                 dword ptr [ecx + eax + 4], 0
            //   ba08000000           | mov                 edx, 8
            //   6bc200               | imul                eax, edx, 0
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8b540104             | mov                 edx, dword ptr [ecx + eax + 4]
            //   52                   | push                edx

        $sequence_13 = { 8b0cca 51 e8???????? 83c408 8945f4 8955f8 }
            // n = 6, score = 600
            //   8b0cca               | mov                 ecx, dword ptr [edx + ecx*8]
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   8955f8               | mov                 dword ptr [ebp - 8], edx

        $sequence_14 = { e8???????? 83c408 8b4d18 8b5508 89048a 8b4514 8b4d08 }
            // n = 7, score = 600
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   8b4d18               | mov                 ecx, dword ptr [ebp + 0x18]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   89048a               | mov                 dword ptr [edx + ecx*4], eax
            //   8b4514               | mov                 eax, dword ptr [ebp + 0x14]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]

        $sequence_15 = { 8b5508 c7040a00000000 c7440a0400000000 c745fc00000000 eb09 }
            // n = 5, score = 600
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   c7040a00000000       | mov                 dword ptr [edx + ecx], 0
            //   c7440a0400000000     | mov                 dword ptr [edx + ecx + 4], 0
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   eb09                 | jmp                 0xb

    condition:
        7 of them and filesize < 183296
}
Download all Yara Rules