BadRabbit launched on the morning of Tuesday, October 24, 2017 was delivered through drive-by downloads of the fake Adobe Flash Player installer from the hacked websites. The installer came undetected with a Symantec digital certificate and 1 out of 65 detection rate on VirusTotal. The Bad Rabbit ransomware having the similar set of features and code snippets to the NotPetya wiper can be considered like its new version supposedly created by the same author. In the new version, the legitimate DiskCryptor driver used to install the bootloader and encrypt the hard disk volumes in a hidden way.
Main outcomes:
- The BadRabbit is a new version of NotPetya, supposedly written by the same author;
- It's a cryptolocker - you can unlock the computer and decrypt the data only by paying 0.05 BTC;
- This is not a targeted attack, unlike NotPetya
- The BadRabbit is distributed over the local network using the EternalRomance vulnerability in SMB1, WMI, WebDAV, brute-force with simple passwords through NTLMSSP
- The BadRabbit uses the legitimate DiskCryptor driver