Overview

overview

10

Static

static

1

BadRabbit.zip

windows7-x64

10

BadRabbit.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BadRabbit.zip

  • Size

    393KB

  • Sample

    241013-h1n55avaqd

  • MD5

    61da9939db42e2c3007ece3f163e2d06

  • SHA1

    4bd7e9098de61adecc1bdbd1a01490994d1905fb

  • SHA256

    ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

  • SHA512

    14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

  • SSDEEP

    12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6

Score
10/10
badrabbitmimikatzdiscoveryransomware

Malware Config

Targets

    • Target

      BadRabbit.zip

    • Size

      393KB

    • MD5

      61da9939db42e2c3007ece3f163e2d06

    • SHA1

      4bd7e9098de61adecc1bdbd1a01490994d1905fb

    • SHA256

      ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

    • SHA512

      14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

    • SSDEEP

      12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6

    Score
    10/10
    badrabbitmimikatzdiscoveryransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks