Forensic Dissection of the .ftagic041 Ransomware Attack: Inside the Rorschach (BabLock) Architecture

When an enterprise network goes dark and system administrators find their critical SQL databases and virtual machines appended with seemingly random alphanumeric extensions like .ftagic041, initial triage often results in deep confusion. Uploading samples to automated identification portals like ID Ransomware or No More Ransom’s Crypto Sheriff frequently returns blank results. This is not a failure of the tools; it is a testament to the highly polymorphic, deeply customized nature of the Rorschach (also tracked as BabLock) ransomware threat.

Unlike widely marketed Ransomware-as-a-Service (RaaS) operations (such as LockBit or ALPHV/BlackCat) which rely on static branding and public Data Leak Sites (DLS), Rorschach is wielded by apex-level, financially motivated threat actors who prefer to remain off the radar. The malware is written in C++ and compiled dynamically per attack, altering its cryptographic hashes continuously to blind endpoint detection. By combining a highly efficient HC-128 stream cipher with Curve25519 asymmetric cryptography, the Rorschach framework bypasses legacy defense parameters and executes mass file corruption at speeds unprecedented in digital extortion.

1. Threat Identification & Artifact Signatures

Because Rorschach operators generate distinct payloads for every targeted environment, tracking the variant requires deep behavioral and structural analysis rather than relying on simple SHA-1 hashes. The .ftagic041 attack exhibits the exact forensic hallmarks of a BabLock deployment.

2. Advanced Evasion: The DLL Side-Loading Vector

A critical question for network administrators is how Rorschach bypassed their modern Endpoint Detection and Response (EDR) platforms. The answer lies in the malware’s initial execution sequence, which heavily abuses legitimate security software via DLL Side-Loading.

The attackers do not simply drop a malicious .exe file onto the system. Instead, they deploy a multi-component package into a staging directory (such as C:\PerfLogs\ or an obscure subfolder in %AppData%). This staging package typically consists of:

• A Legitimate Executable: Most commonly, attackers use cy.exe, which is a digitally signed Dump Service Tool developed by Palo Alto Networks for the Cortex XDR suite. Because it carries a valid, trusted digital signature, Windows natively trusts the process.
• A Malicious Payload DLL: Placed in the exact same directory, the attackers drop a custom DLL (often named winutils.dll). This DLL is the actual “DarkLoader.”
• The Encrypted Ransomware Configuration: A file (often config.ini) containing the packed BabLock engine.

When the trusted cy.exe runs, Windows automatically searches its local directory for necessary DLL dependencies before checking system folders. It unwittingly loads the malicious winutils.dll into its highly trusted process space. The DLL then unpacks the config.ini file into memory and executes the Rorschach engine seamlessly under the trusted umbrella of the Palo Alto executable, effectively blinding heuristic defense parameters.

3. The Cryptographic Architecture of Rorschach

The Rorschach ransomware engine discards older encryption models (like standard RSA and AES) in favor of a highly optimized, high-speed hybrid cryptographic protocol designed for maximum destruction with minimal CPU overhead.

The HC-128 Stream Cipher and Curve25519 ECC

For the primary encryption of file data, Rorschach utilizes HC-128, a highly secure software stream cipher selected from the eSTREAM portfolio. The malware generates a unique 256-bit HC-128 symmetric key and a 32-bit Initialization Vector (IV) for every target file.

To protect this symmetric key from being extracted by incident responders, Rorschach employs Elliptic Curve Cryptography (ECC), specifically the Curve25519 standard. Upon execution, the malware generates a local public and private key pair for the infected machine. The symmetric HC-128 key is mathematically wrapped using the local Curve25519 public key. The local private key is then encrypted using the attacker’s master public key (which is hardcoded into the ransomware payload).

These encrypted key metadata fragments are then aggregated and appended to the very end of your .ftagic041 files. Reversing this process is computationally infeasible without the threat actor’s master private key, which remains securely hidden on their dark web infrastructure.

4. The Anomaly of Intermittent Encryption

Victims analyzing their corrupted .ftagic041 files—such as SQL text dumps or raw database logs—frequently observe a startling anomaly: the first several lines (or even megabytes) of the file remain perfectly readable in plain text, while the remainder of the file is scrambled garbage. This is not a glitch in the ransomware; it is the deliberate application of Intermittent Encryption (or partial encryption).

Rorschach holds speed records for mass encryption precisely because it refuses to encrypt massive enterprise files from start to finish. Encrypting a 100GB .mdf SQL database completely would generate massive disk I/O, taking hours and triggering automated ransomware tripwires. Instead, Rorschach utilizes a highly calculated skip-step routine:

1. The malware seeks to a specific byte offset within the large target file.
2. It encrypts a predefined, small chunk of data (e.g., 1MB) using the HC-128 stream cipher.
3. It skips a massive segment of data (e.g., 3MB to 5MB), leaving it entirely in plaintext.
4. It repeats this skip-step process until the end of the file is reached.

Because the structural integrity of the file is shattered, the file becomes entirely unreadable by the host application, despite large swaths of raw data remaining technically unencrypted. This allows Rorschach to completely paralyze a corporate domain in under five minutes.

5. Lateral Movement and Autonomous Propagation

If the attackers deploy the initial DLL loader onto an Active Directory Domain Controller, Rorschach quickly shifts from a localized breach to a network-wide collapse. The malware contains autonomous logic to automatically generate a malicious Group Policy Object (GPO).

This malicious GPO forcefuly pushes the ransomware executable package into the %Public% folder of every workstation and server connected to the domain, scheduling an immediate execution task running with SYSTEM privileges. Simultaneously, the malware executes direct system calls to wipe Volume Shadow Copies (vssadmin delete shadows) and systematically clears the Windows Application, Security, System, and Setup event logs, effectively blinding forensic investigators.

6. Laboratory Recovery Vectors & Incident Response Strategy

When primary offline backups are compromised, automated internet recovery tools will only cause further, permanent damage to the sector structures of a Rorschach attack. Enterprise data recovery requires sterile, laboratory-grade intervention.

• Soft-Delete Cloud Recovery: If the attackers attempted to encrypt or delete synchronized cloud backups (e.g., Azure, AWS, SharePoint), incident responders must immediately engage cloud soft-delete recovery protocols. Because Rorschach operates so quickly, the timeline for identifying the clean restore point immediately prior to the breach is very narrow.
• Database Page Extraction & Carving: The intermittent encryption logic that makes Rorschach so fast is also its greatest forensic weakness. For massive corporate assets like Microsoft SQL Server files (.mdf), vast quantities of internal 8KB data pages remain untouched by the cipher. Custom laboratory extraction tools parse the raw disk blocks, bypassing the corrupted intermittent encrypted headers, to extract the underlying data tables and rebuild the relational schema into a fresh, working database container.
• Unallocated Space Carving: Ransomware often operates by reading a file, encrypting it in memory, writing the new encrypted file to disk, and then deleting the original. The space where the original file resided is marked as “unallocated” by the Master File Table (MFT). If the system was contained quickly without rebooting, deep byte-level carving can bypass the encrypted .ftagic041 files entirely and extract the raw, deleted original files directly from the physical disk sectors.