badrabbit

General

Target

launcher.exe
Size

6.2MB
Sample

220703-xdfykaeef5
MD5

fb6654c9f9dd0d185af6c783a988092a
SHA1

6d96284917eef659e535e40a5c86e95735caea7a
SHA256

15a16fabdf75ea76c43d28dec7a1d4535fcde8835a4e8e15b338c08249cfad76
SHA512

203019f37769e6ea726157b668cc903fb4f5b4c7c951c58cb7cea3f485234633ebc66858c1548e0eb48abf286a005ed631e19b97c04fd725c924039589583fd2

Score

10^/10

Malware Config

Targets

- Target
  
  launcher.exe
- Size
  
  6.2MB
- MD5
  
  fb6654c9f9dd0d185af6c783a988092a
- SHA1
  
  6d96284917eef659e535e40a5c86e95735caea7a
- SHA256
  
  15a16fabdf75ea76c43d28dec7a1d4535fcde8835a4e8e15b338c08249cfad76
- SHA512
  
  203019f37769e6ea726157b668cc903fb4f5b4c7c951c58cb7cea3f485234633ebc66858c1548e0eb48abf286a005ed631e19b97c04fd725c924039589583fd2
Score

10^/10

badrabbit bootkit discovery evasion persistence ransomware suricata trojan upx
- BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- suricata: ET MALWARE Ponmocup C2 Post-infection Checkin
  suricata: ET MALWARE Ponmocup C2 Post-infection Checkin
  suricata
- suricata: ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
  suricata: ET MALWARE Spoofed MSIE 8 User-Agent Likely Ponmocup
  suricata
- Adds policy Run key to start application
  persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2