On October 24th, media outlets reported on an outbreak of ransomware affecting various organizations in Eastern Europe, mainly in Russia and Ukraine. Identified as “Bad Rabbit”, initial reports about the ransomware drew comparisons with the WannaCry and NotPetya (EternalPetya) attacks from earlier this year. Though F-Secure hasn’t yet received any reports of infections from our own customers, we’re actively investigating. And while the investigation is still ongoing, initial results from our analysis did find similarities between Bad Rabbit and the NotPetya ransomware that hit companies late last June.
We think there’s good evidence that suggests the same person or group is responsible for both last June’s NotPetya attacks and what we’re seeing now with Bad Rabbit. Malware authors often learn from what works, so finding the same characteristics in different families is not uncommon. But the similarities we’re seeing here are too much to be just one attacker copying another.
Without getting too technical, here’s a handful of the similarities between NotPetya and Bad Rabbit:
- Overall code structure is similar
- File encryption code is VERY similar
- Similar method of checking existing processes and encrypting files
- Similar method used to reboot computers
- Same trick used to launch the malware’s main component as a DLL
- Identical code used to parse the command line
- Similar propagation methods, including an identical “library” of other computers found in the network, and use of Mimikatz to gather credentials
- Out of 113 file extensions used by BadRabbit, 65 are shared with NotPetya (Bad Rabbit has an additional 48)
There are also some notable differences between the two, including:
- Bad Rabbit doesn’t use EternalBlue/EternalRomance exploit
- Bad Rabbit doesn’t use PsExec to spread
- Bad Rabbit also encrypts “home user” files, such as .jpgs
- Bad Rabbit adds “.encrypted” to the contents of affected files (NotPetya didn’t do this, making it harder to distinguish between encrypted and non-encrypted files)
- Bad Rabbit’s infection vector is via compromised websites. While NotPetya was reported to be via MeDoc
- Bad Rabbit brute-forces using a set of predefined credentials to available SMB shares
- The list of process hashes to be compared to are different from NotPetya. NotPetya compares against Symantec and Kaspersky processes, while Bad Rabbit compares against McAfee and DrWeb
Like NotPetya, Bad Rabbit will display the two ransom note – one for MBR encryption.
And a text note for file encryption.
Oops! Your files have been encrypted.If you see this text, your files are no longer accessible.
You might have been looking for a way to recover your files.
Don’t waste your time. No one will be able to recover them without our
decryption service.We guarantee that you can recover all your files safely. All you
need to do is submit the payment and get the decryption password.Visit our web service at caforssztxqzf2nm.onion
Your personal installation key#2: [REDACTED]
Users are directed to pay the ransom at a specified payment site, which also provides the amount of the ransom to be paid.
A threat description of the Bad Rabbit ransomware is available at Trojan:W32/Rabbad and will be updated as and when more details are confirmed.
In the meantime… our endpoint protection products have a variety of measures baked in that prevent Bad Rabbit infections.
Tagged: Bad Rabbit, Petya, Ransomware, Th3 Cyb3r
Article Link: https://labsblog.f-secure.com/2017/10/26/following-the-bad-rabbit/