Bad Rabbit: A new ransomware attack

Yesterday, 24 October 2017, a massive ransomware attack, named Bad Rabbit, has been identified world wide.

First data revealed that threat has been spread in particular in Russia, Ukraine, Turkey and Germany, infecting more than 200 victim users.

The speed with which Bad Rabbit spread is similar to the WannaCry and NotPetya outbreaks that have hit in May and June 2017, respectively.

Bad Rabbit is part of Malware Ransomware macro-family, threats able to crypt users’ and organizations’ victim data and ask a ransom in BTC (Bitcoin) for decrypting them.

Thanks to actual information, it’s possible to think that the target of Bad Rabbit is to infect company networks, like PetrWrap Ransomware (with about 13% source code similarities).

Attack Vector

Attack vector used to distribute Bad Rabbit Ransomware is Drive-by channel: visiting legitimate website news, you’ll be redirect to hxxp://1dnscontrol[.]com/flash_install.php so Bad Rabbit could be automatically downloaded.

Once downloaded, ransomware has to be lauched manually from the user to activate it because it looks like Flash Player setup file, named install_flash_player.exe.

Activation

In order to run, malware requires administrative privileges on host, in facts, it tries to run command prompt. If command prompt is started, malware can run using runddll32.exe process with the following command:

C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat, #1 15.

Once malware is installed, it forces PC reboot and acts like a tipical Ransomware able to crypt file on PC, using RSA-2048 key.

Bad Rabbit uses an open source utility – DiskCryptor (https://diskcryptor.net/wiki/Main_Page), to encrypt Hard Disk of victim users in a secure way.

Following file extensions targeted for encryption:

.3ds, .7z, .accdb, .ai, .asm, .asp, .aspx, .avhd, .back, .bak, .bmp, .brw, .c, .cab, .cc, .cer, .cfg, .conf, .cpp, .crt, .cs, .ctl, .cxx, .dbf, .der, .dib, .disk, .djvu, .doc, .docx, .dwg, .eml, .fdb, .gz, .h, .hdd, .hpp, .hxx, .iso, .java, .jfif, .jpe, .jpeg, .jpg, .js, .kdbx, .key, .mail, .mdb, .msg, .nrg, .odc, .odf, .odg, .odi, .odm, .odp, .ods, .odt, .ora, .ost, .ova, .ovf, .p12, .p7b, .p7c, .pdf, .pem, .pfx, .php, .pmf, .png, .ppt, .pptx, .ps1, .pst, .pvi, .py, .pyc, .pyw, .qcow, .qcow2, .rar, .rb, .rtf, .scm, .sln, .sql, .tar, .tib, .tif, .tiff, .vb, .vbox, .vbs, .vcb, .vdi, .vfd, .vhd, .vhdx, .vmc, .vmdk, .vmsd, .vmtm, .vmx, .vsdx, .vsv, .work, .xls, .xlsx, .xml, .xvd, .zip

Analzing source code, an interesting detail is that there are a lot of references to TV Series Game of Thrones: it looks like the criminals behind this malware are fans

Lateral Movement

Bad Rabbit tries to spred and move on network company through dictionary attacks, using SMB protocol; following username/password tried by malware: 

Request for Ransom

Like every Ransomware, also Bad Rabbit requires a ransom equal to 0.05 BTC (about $ 280,00) in the following 40 hours, in alternative the BTC amount required will increase.

How to defend yourself

You can defend your infrastructure following suggestions above:

• Limit administrative privileges only to administrative users, in order to avoid ransomware start and execution which tries to start asking highest privileges.
• Update antivirus signature on the EndPoint

Furter preventions suggestion could be:

• Create following files C:\Windows\infpub.dat and C:\Windows\cscc.dat  and remove for them all privileges

IoC – Indicators Of Compromised