Full Report
Research revealed that the BadRabbit code was compiled from NotPetya sources.
Analysis Summary
# Tool/Technique: BadRabbit
## Overview
BadRabbit is a sophisticated ransomware variant that emerged in late 2017. Research into its codebase reveals that it was compiled from the same source code as the **NotPetya** (Diskcoder.C) malware. While it functions as ransomware, its underlying architecture suggests a highly targeted distribution mechanism using strategic web compromises (watering holes) rather than indiscriminate spreading.
## Technical Details
- **Type:** Ransomware / Disk Coder
- **Platform:** Windows
- **Capabilities:** Disk encryption, Master Boot Record (MBR) modification, lateral movement, log clearing, and credential harvesting.
- **First Seen:** October 24, 2017
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- **[TA0005 - Defense Evasion]**
- [T1070.001 - Indicator Removal on Host: Event Log Clearing]
- [T1027 - Obfuscated Files or Information] (XOR encoding)
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1561.002 - Disk Structure Wipe: Disk Content Wipe] (MBR Overwrite)
## Functionality
### Core Capabilities
- **Disk Encryption:** Similar to NotPetya, it targets user files and the MBR to prevent system booting without a key.
- **Log Cleaning:** The malware includes specific functions to clear system logs to hide traces of its activity before initiating a PC shutdown.
- **Resource Packing:** Modules are packed using zlib 1.2.8 and stored within resources.
### Advanced Features
- **Code Evolution from NotPetya:** Analysis shows the source code was repurposed. Key differences include the switch to multibyte (widechar) strings by default and the modification of the initialization vector from `0x12345678` (NotPetya) to `0x87654321` (BadRabbit).
- **Additional Obfuscation:** Unlike its predecessor, BadRabbit applies an additional XOR operation with the constant `0xE9` to its compressed resources.
- **Strategic Distribution:** Utilized a network of compromised sites to filter victims based on User-agent, referrer, and domain name before delivering the payload.
## Indicators of Compromise
- **File Hashes (SHA256):** (Refer to specific report for full list; common dropper: `630325b1e614cf103402ddfdde321d28`)
- **File Names:** `infpub.dat`, `dispci.exe`
- **Network Indicators (Defanged):**
- `caforssztxqzf2nm[.]onion` (Tor payment site)
- `1dnscontrol[.]com` (Distribution/C2)
- `185[.]149[.]120[.]3` (Data exfiltration)
- `webcheck01[.]net`
- `secure-check[.]host`
- `firewebmail[.]com`
- **Behavioral Indicators:** Automated clearing of Windows Event Logs followed by an immediate forced system shutdown.
## Associated Threat Actors
- **TeleBots / Sandworm:** (Historically linked to the NotPetya codebase and similar TTPs).
- **Lazarus Group:** (Linked via the use of similar vulnerable Apache JSP web server infrastructure found in the delivery chain).
## Detection Methods
- **Signature-based:** Antivirus signatures targeting the `infpub.dat` and `dispci.exe` components.
- **Behavioral:** Monitoring for mass file encryption activities, unauthorized MBR modifications, and the execution of commands aimed at clearing event logs (e.g., `wevtutil.exe cl`).
- **YARA Rules:** Detection rules focusing on the specific XOR constant `0xE9` and the unique initialization vector `0x87654321`.
## Mitigation Strategies
- **Web Filtering:** Block access to known malicious domains and implement rigorous script blocking on untrusted sites.
- **Endpoint Protection:** Use EDR solutions to monitor for unusual disk writes and MBR access.
- **Backups:** Maintain offline backups to mitigate the impact of ransomware encryption.
- **Hardening:** Disable SMBv1 and enforce strong password policies to prevent lateral movement.
## Related Tools/Techniques
- **NotPetya:** The primary predecessor from which BadRabbit was derived.
- **EternalBlue / EternalRomance:** Exploits often associated with the propagation of these malware families.
- **Mimikatz:** Often bundled within these variants for credential harvesting.