badrabbit | 87b6249fbae56b7247812e9dbfcce9ef28331da218b2af26900ab4890a1f285a

General

Target
uninstall.exe
Size 77KB
Sample260710-fa8qqsev31
SHA256 87b6249fbae56b7247812e9dbfcce9ef28331da218b2af26900ab4890a1f285a
MD5 14c04fb114a1946e4218826110690311
SHA1 dc655b4b5ac8c28ba115cae88884eb0c231f2295
SHA512 0c530695770f718c9e24d6c99c053c090aa5f202d7ce5c318b5d8d4fcaa3e9a81c3b76c2e9c355e82ff2da77e0babcab95a55232ca6272d3b1f70312fe7cd0ba
SSDEEP 1536:krX4tpfcUjrwLxZYE8ksu+gdLeAyNxY7hJUAPtKfJBP9nD3r5OB:+X47fcIrwR8ksu+ceA9FCOKXP1D3r5OB
TLSH
T1FA73D00573E0C8B3E6B607301D7A5BB76FF9E92212A44B5753006B0EBD63680DE1E792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  uninstall.exe
- Size 77KB
- SHA256 87b6249fbae56b7247812e9dbfcce9ef28331da218b2af26900ab4890a1f285a
- MD5 14c04fb114a1946e4218826110690311
- SHA1 dc655b4b5ac8c28ba115cae88884eb0c231f2295
- SHA512 0c530695770f718c9e24d6c99c053c090aa5f202d7ce5c318b5d8d4fcaa3e9a81c3b76c2e9c355e82ff2da77e0babcab95a55232ca6272d3b1f70312fe7cd0ba
- SSDEEP 1536:krX4tpfcUjrwLxZYE8ksu+gdLeAyNxY7hJUAPtKfJBP9nD3r5OB:+X47fcIrwR8ksu+ceA9FCOKXP1D3r5OB
- TLSH
  T1FA73D00573E0C8B3E6B607301D7A5BB76FF9E92212A44B5753006B0EBD63680DE1E792
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery upx
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit discovery execution badrabbit mimikatz persistence ransomware
- Family: BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral2