Full Report
There is a connection between BadRabbit and Not Petya
Analysis Summary
# Tool/Technique: BadRabbit
## Overview
BadRabbit is a sophisticated ransomware strain that emerged in late 2017. It is characterized as a modified version of the **NotPetya** (or Diskcoder.C) malware. The attack primarily targeted organizations in Russia and Ukraine, masquerading as a fake Adobe Flash Player update to gain initial entry. Once executed, it encrypts files and the Master Boot Record (MBR), demanding a ransom for recovery.
## Technical Details
- **Type:** Ransomware / Worm
- **Platform:** Windows
- **Capabilities:** MBR encryption, file encryption, lateral movement (SMB), credential harvesting.
- **First Seen:** October 2017
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise (via compromised websites hosting fake updates)
- **TA0006 - Credential Access**
- T1003 - OS Credential Dumping (Mimikatz integration)
- **TA0008 - Lateral Movement**
- T1021.002 - Remote Services: SMB/Windows Admin Shares
- **TA0009 - Collection**
- T1005 - Data from Local System
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
- T1491 - Endpoint Denial of Service (Disk Content Corruption/MBR Overwrite)
## Functionality
### Core Capabilities
- **Disk Encryption:** Overwrites the Master Boot Record (MBR) and encrypts the disk, displaying a ransom note upon reboot.
- **Initial Vector:** Distributed via drive-by downloads from compromised news and media sites, prompting users to install a fake `install_flash_player.exe`.
- **Modified Encryption Logic:** Uses a hashing algorithm nearly identical to NotPetya but changes the initialization vector from `0x12345678` to `0x87654321`.
### Advanced Features
- **Worm-like Propagation:** Scans the local network for open SMB shares (e.g., `admin`, `lsarpc`, `samr`, `svcctl`).
- **Credential Harvesting:** Integrates a module similar to **Mimikatz** to extract plain-text passwords and NTLM hashes from memory.
- **Brute Forcing:** Contains a hardcoded list of credentials to attempt lateral movement across the network.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `630325cac09ac3fabcc9f7e29583c4bd05b7455a9998670c475c28d372589505` (Dropper)
- `8d7a5bc237475b8391daecf275215687a493977f2a1538160023fcae40b49488` (infpub.dat)
- **File Names:**
- `install_flash_player.exe`
- `C:\windows\infpub.dat`
- `C:\windows\dispci.exe`
- **Network Indicators (Defanged):**
- `1dnscontrol[.]com`
- `webcheck01[.]net`
- `webdefense1[.]net`
- `secure-check[.]host`
- `firewebmail[.]com`
- `secureinbox[.]email`
- `secure-dns1[.]net`
- **Behavioral Indicators:**
- Creation of Scheduled Tasks named: `viserion`, `rhaegal`, `drogon`.
- Scans for SMB pipes: `srvsvc`, `browser`, `wkssvc`.
## Associated Threat Actors
- **BlackEnergy / Sandworm / TeleBots:** The code similarities and infrastructure links strongly suggest a connection to the actors behind the NotPetya and BlackEnergy campaigns.
## Detection Methods
- **Signature-based:** Detect the specific `infpub.dat` file and known hashes of the Mimikatz-like module.
- **Behavioral:** Monitor for unexpected MBR modification attempts and large-scale SMB scanning within the internal network.
- **YARA:** Scan for the specific process hashing function and the initialization vector `0x87654321`.
## Mitigation Strategies
- **Kill Switch:** Create a read-only file at `C:\windows\infpub.dat`. If this file exists and is restricted, the encryption routine may fail.
- **Task Restrictions:** Block or monitor the creation of scheduled tasks named after Game of Thrones dragons (`viserion`, `rhaegal`, `drogon`).
- **Network Hardening:** Disable SMBv1 and restrict administrative shares where not strictly necessary.
- **User Education:** Train users to avoid manual "Flash Update" prompts from non-official sources.
## Related Tools/Techniques
- **NotPetya (Diskcoder.C):** The primary codebase from which BadRabbit was derived.
- **Mimikatz:** Used for the credential harvesting component.
- **EternalBlue (Implicit):** While BadRabbit relies more on credential harvesting/SMB shares than the exploit, it shares the lateral movement philosophy of NotPetya.