Overview

overview

10

Static

static

7148ca8cc9...db.exe

windows7_x64

10

7148ca8cc9...db.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db

  • Size

    88KB

  • Sample

    210516-6nrrw65t1s

  • MD5

    b9fd952b27bc30f2561efbd2b2919ec7

  • SHA1

    a8066d045f15b399bd1cb684b687537f56eb703f

  • SHA256

    7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db

  • SHA512

    55d9eee46fedf05e33a64a66382a26903140c25a55500adbbab1a4f87cae530abe9a1da98a4f5b61a0a9d10835fc883f21eba438e00e1c907edd3e5848fafd7e

Score
10/10
badrabbitpersistenceransomware

Malware Config

Targets

    • Target

      7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db

    • Size

      88KB

    • MD5

      b9fd952b27bc30f2561efbd2b2919ec7

    • SHA1

      a8066d045f15b399bd1cb684b687537f56eb703f

    • SHA256

      7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db

    • SHA512

      55d9eee46fedf05e33a64a66382a26903140c25a55500adbbab1a4f87cae530abe9a1da98a4f5b61a0a9d10835fc883f21eba438e00e1c907edd3e5848fafd7e

    Score
    10/10
    persistencebadrabbitransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Modifies system executable filetype association

      persistence

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Sets file execution options in registry

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks