Overview

overview

10

Static

static

395a9ab8d0...e6.exe

windows7_x64

8

395a9ab8d0...e6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    395a9ab8d031a088642324c0632ab6009e7da6a5282a9c6265175eb79a9e10e6

  • Size

    440KB

  • Sample

    210515-exng7fhysj

  • MD5

    4a8d3539c3078a16c93c766fef28c605

  • SHA1

    6da0d3b40762f46486f1b989548fdf9d777fc894

  • SHA256

    395a9ab8d031a088642324c0632ab6009e7da6a5282a9c6265175eb79a9e10e6

  • SHA512

    a3124ee40d95c8673e0cbcacd12b2af453f3b6a1a51e494344c822dee47fce97970b0cf0ee31767dee31682b4f017b32f651ff2486cc3ea6586dad14dbbcdef8

Score
10/10
badrabbitransomware

Malware Config

Targets

    • Target

      395a9ab8d031a088642324c0632ab6009e7da6a5282a9c6265175eb79a9e10e6

    • Size

      440KB

    • MD5

      4a8d3539c3078a16c93c766fef28c605

    • SHA1

      6da0d3b40762f46486f1b989548fdf9d777fc894

    • SHA256

      395a9ab8d031a088642324c0632ab6009e7da6a5282a9c6265175eb79a9e10e6

    • SHA512

      a3124ee40d95c8673e0cbcacd12b2af453f3b6a1a51e494344c822dee47fce97970b0cf0ee31767dee31682b4f017b32f651ff2486cc3ea6586dad14dbbcdef8

    Score
    10/10
    badrabbitransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks