badrabbit | d6bb5aeaf649fd569e6ec0c27295d0342fd8d371969d617b282ca02b0b202b3c

General

Target
Ransomware
Size 261KB
Sample260726-y2f4xa1cpg
SHA256 d6bb5aeaf649fd569e6ec0c27295d0342fd8d371969d617b282ca02b0b202b3c
MD5 e172e2f6c23c60dafcb4bc7c23f19490
SHA1 eee73ac6002cd62ba8ffd44dee2dd398dafa0386
SHA512 d79a5bf8735ea4c47b5dade9f621c8ae085ac36f9d253c342e080742094c71c7999174d419efd6b72b230c0014b8ab910d49e3f22bfb9ba7a10f2a5bb2a61909
SSDEEP 6144:CpUhaOvfpxwz/80ZIlxqdtBPjrh1lm7jxaWQ8Lqm9meXdVeJ5PTQYbeHxHA7op9V:uUhaOvfpxwz/80ZIlxqdtBPjrh1lm7jp
TLSH
T1F04484707078617D012F2A8AF270A728D357F36AE65812E4B93FD6F457E2CD4EA93058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Ransomware
- Size 261KB
- SHA256 d6bb5aeaf649fd569e6ec0c27295d0342fd8d371969d617b282ca02b0b202b3c
- MD5 e172e2f6c23c60dafcb4bc7c23f19490
- SHA1 eee73ac6002cd62ba8ffd44dee2dd398dafa0386
- SHA512 d79a5bf8735ea4c47b5dade9f621c8ae085ac36f9d253c342e080742094c71c7999174d419efd6b72b230c0014b8ab910d49e3f22bfb9ba7a10f2a5bb2a61909
- SSDEEP 6144:CpUhaOvfpxwz/80ZIlxqdtBPjrh1lm7jxaWQ8Lqm9meXdVeJ5PTQYbeHxHA7op9V:uUhaOvfpxwz/80ZIlxqdtBPjrh1lm7jp
- TLSH
  T1F04484707078617D012F2A8AF270A728D357F36AE65812E4B93FD6F457E2CD4EA93058
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution badrabbit nabucur persistence ransomware spyware stealer trojan
- Family: BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (106) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2