Overview

overview

10

Static

static

1

BadRabbit.zip

windows10-2004-x64

10

BadRabbit.zip

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BadRabbit.zip

  • Size

    164KB

  • Sample

    240806-mys4hs1ema

  • MD5

    c279b056c175248970b86d544d4500ac

  • SHA1

    b23b59b579e95d4c5b5c75f011c6b20438c1e223

  • SHA256

    b3c80146802eca48fd4fdd8c7f6e500c360165e4042cfac458d2830e532db4b4

  • SHA512

    22f25554000b76ad6c8801de02a3cf822210e5675fd117e83220a46fe0b5b56684d0b9d57d1262818c0028319ff7f546d9fa18de6613e5b1fbaac4c746516bdb

  • SSDEEP

    3072:y0xwVWSrh1lhL2rypKP/X6OOKeRw+Ums1YElgGaPYwI1bwecpI7kzBrDUEbhg3P+:fTuoeF3uokeOvHS1d1+sNs8wbiWQu9Lm

Score
10/10
badrabbitmimikatzdiscoveryransomware

Malware Config

Targets

    • Target

      BadRabbit.zip

    • Size

      164KB

    • MD5

      c279b056c175248970b86d544d4500ac

    • SHA1

      b23b59b579e95d4c5b5c75f011c6b20438c1e223

    • SHA256

      b3c80146802eca48fd4fdd8c7f6e500c360165e4042cfac458d2830e532db4b4

    • SHA512

      22f25554000b76ad6c8801de02a3cf822210e5675fd117e83220a46fe0b5b56684d0b9d57d1262818c0028319ff7f546d9fa18de6613e5b1fbaac4c746516bdb

    • SSDEEP

      3072:y0xwVWSrh1lhL2rypKP/X6OOKeRw+Ums1YElgGaPYwI1bwecpI7kzBrDUEbhg3P+:fTuoeF3uokeOvHS1d1+sNs8wbiWQu9Lm

    Score
    10/10
    badrabbitmimikatzdiscoveryransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks