badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo
Sample260607-cpdblafz6m

Score

10^/10

Malware Config

Extracted

Path

C:\PerfLogs\README_HOW_TO_UNLOCK.TXT

Ransom Note

YOUR FILE HAS BEEN LOCKED In order to unlock your files, follow the instructions bellow: 1. Download and install Tor Browser 2. After a successful installation, run Tor Browser and wait for its initialization. 3. Type in the address bar: http://zvnvp2rhe3ljwf2m.onion 4. Follow the instructions on the site.

URLs

http://zvnvp2rhe3ljwf2m.onion

Targets

- Target
  https://github.com/Da2dalus/The-MALWARE-Repo
Score

10^/10

adware bootkit defense_evasion discovery evasion execution badrabbit cryptolocker seven impact persistence privilege_escalation ransomware spyware stealer trojan upx
- Family: BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Family: CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Family: Seven, SevenCrypt, 7ev3n
  Seven aka SevenCrypt or 7ev3n is a ransomware.
  ransomware seven
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1