Skip to content

Malware

Rook

According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them.

Rook is a Windows malware family.

Background

PCrisk describes Rook as ransomware built on a reworked version of Babuk that locks victims out of their data through encryption. Beyond encrypting files, it alters their names and drops a ransom note named "HowToRestoreYourFiles.txt". The malware tacks the ".Rook" extension onto each affected file, so "1.jpg" becomes "1.jpg.Rook" and "2.jpg" becomes "2.jpg.Rook".


Source: Malpedia (Fraunhofer FKIE).