badrabbit

Target
Malware.zip
Size 6.4MB
Sample250209-dn49cstkez
SHA256 2a45e44be359fba4c85591e7b13d1ec772ed181adc41254d8b00d31b2d15878e
MD5 2570272f3d1d089334463f58135099be
SHA1 c3c47f1a8420d11be52cf69f2cafcec450b36b36
SHA512 4921f1e3fa8dc8b019587aad62a67b449175fe6cfb8e7b01474a3eb5683c1c475f34247e4a6b248bea3e432ed413721519a52b2d1ef0f3f088876cd98cec31f9
SSDEEP 196608:Pjlmaezq3Z39giBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiB:PYaIwgiKt2O9/rH6T6yigHRHGxB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Bad Rabit.exe
- Size 431KB
- SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
- MD5 fbbdc39af1139aebba4da004475e8839
- SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
- SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
- SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

badrabbit mimikatz adware discovery persistence privilege_escalation ransomware stealer
- BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Badrabbit family
  badrabbit
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Mimikatz family
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Blocklisted process makes network request
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3