Rook
Description
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (‘HowToRestoreYourFiles.txt’). Rook renames files by appending the ‘.Rook’ extension. For example, it renames ‘1.jpg’ to ‘1.jpg.Rook’, ‘2.jpg’ to ‘2.jpg.Rook’.
Names
| Name |
|---|
| Rook |
Category
Malware
Type
- Ransomware
Information
- https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit.md
- https://chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/
- https://seguranca-informatica.pt/rook-ransomware-analysis/
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader
- https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/
- https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/
Malpedia
Other Information
Uuid
c454ae0f-ae6d-4d20-a7dc-78665a109e37
Last Card Change
2023-11-30