Bad RabbitMalware
- bad-rabbit
- win32/diskcoder.d
On October 24, 2017, Cisco Talos was alerted to a widescale ransomware campaign affecting organizations across eastern Europe and Russia. As was the case in previous situations, we quickly mobilized to assess the situation and ensure that customers remain protected from this and other threats as they emerge across the threat landscape.From MISP Galaxy
Last reported 8 years ago, by Group-IB2 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1053.005Scheduled Task
“Restrict Scheduled Tasks: viserion_, rhaegal, drogon”
What the reports say
2 reports, newest first · the exact sentence from each-
NotPetya pulls BadRabbit out of the hat“However, in Bad Rabbit a unique key is generated for each infected computer, and for each key, its own Bitcoin wallet.”
-
BadRabbit: spread of new cryptolocker“Group-IB identified that Bad Rabbit was spread via web traffic from compromised media sites, amongst them were:”
Indicators in its reports
named in the reports above- 185.149.120[.]3in 2 reports
- 1dnscontrol[.]comin 2 reports
- www.fontanka[.]ruin 2 reports
- hxxp://argumenti[.]ruin 2 reports
- argumenti[.]ruin 2 reports
- hxxp://argumentiru[.]comin 2 reports
- argumentiru[.]comin 2 reports
- fbbdc39af1139aebba4da004475e8839in 2 reports
- webcheck01[.]netin 2 reports
- webdefense1[.]netin 2 reports
- secure-check[.]hostin 2 reports
- firewebmail[.]comin 2 reports
- secureinbox[.]emailin 2 reports
- secure-dns1[.]netin 2 reports
- hxxp://www.fontanka[.]ruin 1 report
- hxxp://spbvoditel[.]ruin 1 report
- spbvoditel[.]ruin 1 report
- hxxp://www.sinematurk[.]comin 1 report
- www.sinematurk[.]comin 1 report
- hxxp://www.online812[.]ruin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.