Bad Rabbit Ransomware

Bad Rabbit’s campaigns use distinct distribution tactics.

1. A watering hole drive-by download prompts visitors of infected websites to install a fake Adobe Flash Player update

2. The installer, typically named install_flash_player.exe, uses a fake signed certificate with the name “Symantec Corporation” 

3. When executed, the malicious dropper executes the first stage of Bad Rabbit, which imports and installs several additional files and then executes the main payload

Once installed, Bad Rabbit does the following: 

• Searches for running processes using the hash of the process name and kills a predefined list of IT security products
• Installs a copy of the legitimate DiskCryptor executable into a file named cscc.dat which later encrypts the target’s files
• Imports its main payload named infpub.dat
• Creates a file named dispci.exe, schedules a task to execute the main payload at the next reboot, and then reboots 
• Upon reboot, the main payload proceeds to encrypt files
• Attempts to identify SMB credentials stored on the target’s system and self-propagate laterally using Mimikatz with both the stolen and hardcoded commonly used SMB credentials, as well as exploit the EternalRomance SMBv1 vulnerability
• Overwrites the infected system’s Master Boot Record (MBR) and installs its own bootloader (similar to Petya malware), and copies a malicious kernel to boot at the end of the target’s hard-drive
• Reboots the infected system, causing the modified MBR to boot the Bad Rabbit kernel, displaying a ransom note on-screen

Bad Rabbit targets files by common file extensions for documents, compressed and backup files, virtual machine and virtual hard disks, images, and other scripting language files. Bad Rabbit uses the AES-128 cipher to encrypt files and then further encrypts the AES symmetric key with a hardcoded RSA-2048-bit public key. 

Bad Rabbit has not received continuous updates, and its payload is relatively static, allowing even traditional antivirus products to detect it. Also, the vulnerability BadRabbit exploits has been patched in Windows OS, meaning the ransomware can only infect unpatched Windows 7 systems. Although not a broad mitigation for other forms of malware, several workarounds capable of preventing a Bad Rabbit attack have been found for legacy systems that cannot get updates or antivirus installed.

• Disable Windows Management Instrument (WMI) to prevent its abuse by Bad Rabbit 
• Forbid the execution of files named C:\Windows\infpub.dat and C:\Windows\cscc.dat, or create those files in the same location, stopping Bad Rabbit from execution