Yesterday, Russia and Ukraine have been targeted by the Bad Rabbit Ransomware
, distributed via drive by.
The sample named install_flash_player.exe, sha256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
has some very strong similarities to NotPetya
, the ransomware spreading via EternalBlue SMB exploit in June.
There are many behaviors based similarities, such as started processes:
But there are also many code based similarities. Multiple companies already blogged about the differences (1
), however, what we found very interesting is also that the ransomware kept the kill switch. Not the one which was domain based and activated by @Malwaretech
for NotPetya but rather the local machine based, which once set prevents infection.
If one looks at function 807E8E
we can see that Bad Rabbit checks for the file C:\Windows\cscc.dat.
If it exists the process will exit:
So, to get protected just create the file C:\Windows\cscc.dat
and you are good!
Full analysis + sample available at Joe Sandbox Cloud Basic.