Booba Team Ransomware Recovery Toolkit

Tools for recovering files encrypted by the Booba Team ransomware. Partial recovery is cipher-independent; full decryption support currently targets the legacy Babuk-derived HC-128 + Curve25519 path.

Full documentation →

---

What this ransomware does

Every file is encrypted in place and receives a .booba extension. The verified sample set encrypts the first 5% and leaves the remaining 95% intact, then appends a 240-byte metadata footer. Linux/NIX binary analysis also shows a configurable percent option, so alternate Booba runs may use a different leading encrypted region.

[ encrypted leading percent ][ intact remaining body ][ 240-byte footer ]

---

Quick start

Windows — no install required:
Download BoobaRecovery.exe from the Releases page, run it, and follow the GUI.

From source:

pip install -r requirements.txt
python3 booba_recover.py <encrypted_dir> <output_dir>
python3 booba_recover.py --percent auto <encrypted_dir> <output_dir>
python3 booba_recover.py --percent 10 <encrypted_dir> <output_dir>

Linux single-file GUI build:

./build-linux.sh
dist/BoobaRecovery-linux-$(uname -m)

---

Recovery approaches

Approach	Key needed	Result
Partial recovery (booba_recover.py / GUI)	None	Remaining unencrypted body; ~95% for the verified default samples
Full decryption (booba_decrypt.py --mode full)	Attacker Curve25519 private key for the supported HC-128 variant	100% original
Raw ChaCha lab path (booba_decrypt.py --mode full-chacha-raw)	Confirmed raw ChaCha key/nonce/counter material	100% original for that confirmed stream layout
Known-plaintext (booba_decrypt.py --mode known-plaintext)	None (2 SQL files only)	100% for those files

---

GUI

---

Tools

Tool	Purpose
gui.py / BoobaRecovery.exe	Point-and-click batch recovery
booba_recover.py	CLI batch partial recovery with --percent auto or explicit percent override
booba_decrypt.py	Full decryption with attacker key, raw ChaCha lab path, known-plaintext, footer analysis
reconstruct_pdf.py	Deep PDF xref repair
reconstruct_dwg.py	Merge DXF companions into a single clean DXF
build-linux.sh	Build a one-file Linux GUI executable

Supports 40+ file formats including DOCX, XLSX, PPTX/PPTM, PDF, DWG, VSD/VSDX, images, audio, video, archives, databases, email, CAD, 3D geometry, and text-like ANSYS Electronics Desktop / HFSS project artifacts. See Format Support for the full list.

Format detection also handles copied sample names such as file.vstx(1).booba and file.xlsx - Copy.booba, so those files still use their format-specific recovery paths and write recovered outputs with openable final extensions.

PowerPoint OOXML files such as .pptx, .pptm, .potx, and .ppsx are rebuilt into clean ZIP packages when possible. Missing root presentation metadata is synthesized, and a .txt companion captures recovered slide and notes text.

When LibreOffice is installed, recovered Visio files are also opened through LibreOffice Draw and resaved as companions: .svg for Visio-client import/open workflows, .pdf for preview, and .odg for editable Draw review. A .libreoffice.txt companion records successful conversions or import failures.

ANSYS Electronics Desktop / HFSS text artifacts such as .aedt, .asol, .solinfo, .profile, and .sd are recovered as text-like engineering files. The encrypted leading region is still lost without full decryption keys, so the first project/root blocks may be truncated.

---

Dependencies

pip install -r requirements.txt   # openpyxl, ezdxf
pip install cryptography          # only for --mode full decryption
libreoffice                       # optional Visio SVG/PDF/ODG companions

---

Documentation

• GUI Usage
• Format Support
• Command Line Reference
• Building the EXE