On April 2021, one of the most known Ransomware Gang called Babuk, decided to change the way they ask for ransom: no more double extortion, no more file encryption but just data exfiltration and a later announcement in case of no deal with the victim. It’s a nice move forward for a Ransomware Gang that, as far as I know, followed the Maze Group double extortion paradigm since 2019. This is what reported on BleepingComputer (HERE) on April.

“Babuk changes direction, we no longer encrypt information on networks, we will get to you and take your data, we will notify you about it if you do not get in touch we make an announcement” – Babuk ransomware

Babuk Ransomware Gang

At the end of April, Babuk gang decided to definitely close their malicious operations making their Babuk Ransomware opensource, but so far no code was shared to the community.

Many Babuk ransomware where disclosed and analyzed during the following weeks, but when I saw this (reference follows) sample called “builder” with static signatures that reminded me the Babuk Ransomware, I decided to take a closer look checking if it definitely was the Babuk builder.


Make a one-time donation

Make a monthly donation

Choose an amount


If you think this content is helpful, please consider to make a little donation. It would help me in building and writing additional contributions to community. By donation you will contribute to community as well. Thank you !

If you think this content is helpful, please consider to make a little donation. It would help me in building and writing additional contributions to community. By donation you will contribute to community as well. Thank you !

DonateDonate monthly

Builder Analysis

So, let’s take a closer look to this sample called builder matching signature from Babuk Ransomware. Sha256: 4fa565cc2ebfe97b996786facdb454e4328a28792e27e80e8b46fe24b44781af , from the time of the analysis, the sample is recognized as malicious from 8 (over 68) AV vendors. I believe it is a nice starting point to investigate our building chain ;).

BabukRansomwareBuilder on VT
Given Namebuilder.bin
TechnologyMicrosoft C/C++
BehaviorRansomware Builder

The sample appears to be not packed. It means that on building chain the attacker need to use an external packer. It might underline a non sophisticated developer chain, in other words, the developer may have no expertise building packers or he/she decided to use external obfuscators/packers during the delivery phase of the derivated artifacts. The builder is a CLI utility asking for a folder. Once you give a folder name it firstly check if the folder exists, and if it doesn’t, the sample creates it. It later builds up the pair keys by using elliptic curve algorithm with a randomly generated 256 key size.

Private and Public Elliptic Curve Keys
Random Key Generation For Elliptic Curve 32×8 (256) Key

After the key generation phase the builder saves such a keys inside the given folder in two separated files : kp.curve25519 and ks.curve25519 which are public and secret parameters for the Montgomery curve. The builder then checks for components in the current folder in order to build the output samples. The needed components are:

  • note.txt: a simple text file wrapping ransom note.
  • e_esxi.out,e_nas_x86.out,e_nas_arm.out,e_win.bin: specific encryption payloads for different targets (ESXI, NAS and Windows Machines)
  • d_esxi.out,d_nas_x86.out,d_nas_arm.out,d_win.bin: specific decryption payloads for different targets (ESXI, NAS and Windows Machines)

The following image shows the main builder function in where it looks for external files (representing payloads) and saves them on local hard drive ready to be implemented into the victims system.

Babuk main building function

The ransomware generation is a simple process. It firstly takes the external payload and it later starts a lstrcp (which is dynamically loaded) to copy the exernal payload to files, implementing the final ransomware. The following image shows the main saving function.

Main Saving Function

The following images show the variables wrapping out the file name (on the left) and the result of the “stringCopy” function (on the right) before saving them to the hard drive.

Once the building function terminates its run the user (actually the attacker) finds the given folder full of ransomware ready to be deployed to victims. The following image shows the built ransomware which happens to be ready to be spread on Windows system, Linux systems on ESX and specific NAS within ARM core.

Final Built Folder


Babuk Builder looks like to be a quite simple piece of code. But even if it’s a simple code it holds some interesting characteristics which could be helpful to compare to future builders. For example the loading sections and the way the builder uses the lstrcp function to copy the loaded payloads. The main building loop and the used algorithm to generate key-pairs.

Babuk Builder IoC