สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool Rook

Threat Group Cards: A Threat Actor Encyclopedia

Tool: Rook

Names	Rook
Category	Malware
Type	Ransomware
Description	According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note ('HowToRestoreYourFiles.txt'). Rook renames files by appending the '.Rook' extension. For example, it renames '1.jpg' to '1.jpg.Rook', '2.jpg' to '2.jpg.Rook'.
Information	<https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit.md> <https://chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/> <https://seguranca-informatica.pt/rook-ransomware-analysis/> <https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader> <https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/> <https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/win.rook>

Last change to this tool card: 30 November 2023

Download this tool card in JSON format

All groups using tool Rook

Changed	Name	Country	Observed
APT groups
	Bronze Starlight		2021-Mar 2023

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]