Bad Rabbit

Malware & Tools · Bad Rabbit

· MalwareS0606 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Bad Rabbit is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. Bad Rabbit has also targeted organizations and consumers in Russia. (Citation: Secure List Bad Rabbit)(Citation: ESET Bad Rabbit)(Citation: Dragos Apr 2019)

Tactic Coverage

execution (4)credential access (2)stealth (2)privilege escalation (2)discovery (2)impact (2)persistence (1)initial access (1)lateral movement (1)

Used By (1 groups)

G0034Sandworm TeamELECTRUM, Telebots

Techniques (15)

T1003.001LSASS Memory

credential access

T1036.005Match Legitimate Resource Name or Location

stealth

T1053.005Scheduled Task

executionpersistence

T1057Process Discovery

discovery

T1106Native API

execution

T1110.003Password Spraying

credential access

References

https://attack.mitre.org/software/S0606 https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/https://securelist.com/bad-rabbit-ransomware/82851/