This crypto-ransomware first came to public notice on 24 October 2017 following reports that it had infected organizations in Ukraine and Russia.
Proactive protection was provided by F-Secure's DeepGuard behavioral analysis engine before this threat was publicly disclosed. Multiple signature detections were also subsequently released to provide additional, specific coverage.
F-Secure detects this ransomware with multiple behavioral and signature detections. Once detected, the F-Secure security product will automatically disinfect the file by either deleting or renaming it.
Once ransomware has successfully encrypted files on a machine, the encryption may be sufficient to make it very difficult to decrypt the files without the decryption key. In such circumstances, the recommended course of action is to report the crime to the relevant authorities and restore the affected data from a backup.
We recommend that organizations take additional steps to mitigate against vulnerability exploitation and prevent an attack from spreading in your environment:
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Bad Rabbit first came to public notice on 24 October 2017, as multiple security firms reported their discovery of a new ransomware family affecting a number of organizations, mainly in Russia and Ukraine.
According to reports, at least three media companies have been affected by the ransomware, as well as as transportation services.
For more information about the incident:
From our analysis, the initial infection vector for the Bad Rabbit ransomware is via compromised websites that host an injected malicious script. The script redirects users to a secondary site where the actual ransomware file is downloaded. The actual file itself may be disguised as an Adobe Flash Player update.
Bad Rabbit also includes functionality to spread through a network, as it is able to check for accessible SMB shares using hardcoded usernames and passwords:
If any SMB shares are found with these usernames or passwords, Bad Rabbit then checks for open RPC pipes. If any are found, it then uses the Eternal Romance exploit to spread within the network.
The use of the NSA-linked Eternal Romance exploit to spread marks a similarity between this ransomware and the Petya.F ransomware, though Bad Rabbit uses a different implementation of it. In contrast however, Bad Rabbit does not use the EternalBlue exploit, which is also used by Petya.
When the Bad Rabbit file is executed on a machine, it drops a file named 'C:\Windows\infpub.dat', a DLL that in turn drops the following files:
The infpub.dat file will also create the following Windows tasks:
And registry keys:
The task names and registry keys reference the popular television series, Game of Thrones.
Once Bad Rabbit is installed, it will encrypt files stored on the machine. The ransomware targets the following types of files:
Bad Rabbit uses a driver from the open-source DisCryptor disk encryption software to perform the encryption. After rebooting the machine, the driver runs AES string encryption using a randomly generated key, which is then encrypted with the ransomware's hard-coded public key and then encoded to the machine's Master Boot Record (MBR) This code is intended for later use during the ransom payment process.
Bad Rabbit's encryption behavior shows similarities to the known Petya ransomware.
Unlike other ransomware, Bad Rabbit does not change the extensions of the encrypted files, making it less obvious that they have been tampered with. It does however add the string 'encrypted' to the end of the encrypted file.
Once the files are encrypted, Bad Rabbit will display the following ransom demand:
Ransom demand displayed by Bad Rabbit ransomware
Users are directed to pay the ransom at a specified payment site, which also provides the amount of the ransom to be paid.
Bad Rabbit payment site
Date Created: 25 Oct 2017
Date Last Modified: 27 Oct 2017: Updated information on use of Eternal Romance exploit.