Trojan:W32/Rabbad

Bad Rabbit first came to public notice on 24 October 2017, as multiple security firms reported their discovery of a new ransomware family affecting a number of organizations, mainly in Russia and Ukraine.

According to reports, at least three media companies have been affected by the ransomware, as well as as transportation services.

For more information about the incident:

• BBC: 'Bad Rabbit' ransomware strikes Ukraine and Russia
• ESET: Kiev metro hit with a new variant of the infamous Diskcoder ransomware
• Motherboard: New Ransomware 'Bad Rabbit' Spreading Quickly Through Russia and Ukraine

Infection

From our analysis, the initial infection vector for the Bad Rabbit ransomware is via compromised websites that host an injected malicious script. The script redirects users to a secondary site where the actual ransomware file is downloaded. The actual file itself may be disguised as an Adobe Flash Player update.

Bad Rabbit also includes functionality to spread through a network, as it is able to check for accessible SMB shares using hardcoded usernames and passwords:

If any SMB shares are found with these usernames or passwords, Bad Rabbit then checks for open RPC pipes. If any are found, it then uses the Eternal Romance exploit to spread within the network.

The use of the NSA-linked Eternal Romance exploit to spread marks a similarity between this ransomware and the Petya.F ransomware, though Bad Rabbit uses a different implementation of it. In contrast however, Bad Rabbit does not use the EternalBlue exploit, which is also used by Petya.

When the Bad Rabbit file is executed on a machine, it drops a file named 'C:\Windows\infpub.dat', a DLL that in turn drops the following files:

• C:\Windows\cscc.dat - installed as a service and renamed DCRYPT.SYS (a legitimate file name from the ReactOS)
• C:\Windows\dispci.exe - A file decrypter. A shortcut link (DECRYPT.lnk) is also added to the file on the Desktop

The infpub.dat file will also create the following Windows tasks:

• %System32%\Tasks\rhaegal
• %System32%\Tasks\drogon
• %System32%\Tasks\viserion

And registry keys:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\drogon
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\rhaegal
• HKLM\SYSTEM\ControlSet001\services\cscc
• HKLM\SYSTEM\CurrentControlSet\services\cscc
• HKLM\SYSTEM\ControlSet001\services\cscc\ImagePath: "cscc.dat"
• HKLM\SYSTEM\CurrentControlSet\services\cscc\ImagePath: "cscc.dat"

The task names and registry keys reference the popular television series, Game of Thrones.

Encryption

Once Bad Rabbit is installed, it will encrypt files stored on the machine. The ransomware targets the following types of files:

Bad Rabbit uses a driver from the open-source DisCryptor disk encryption software to perform the encryption. After rebooting the machine, the driver runs AES string encryption using a randomly generated key, which is then encrypted with the ransomware's hard-coded public key and then encoded to the machine's Master Boot Record (MBR) This code is intended for later use during the ransom payment process.

Bad Rabbit's encryption behavior shows similarities to the known Petya ransomware.

Unlike other ransomware, Bad Rabbit does not change the extensions of the encrypted files, making it less obvious that they have been tampered with. It does however add the string 'encrypted' to the end of the encrypted file.

Ransom demand

Once the files are encrypted, Bad Rabbit will display the following ransom demand:

Ransom demand displayed by Bad Rabbit ransomware

Users are directed to pay the ransom at a specified payment site, which also provides the amount of the ransom to be paid.