Securify

The Bad Rabbit ransomware attack that hit Russia and Ukraine on Tuesday has been linked to, and is considered a new variant of, Petya. It bears similarities to the WannaCry and Petya outbreaks earlier this year.

Organizations reportedly hit by Bad Rabbit include Russian media outlets Interfax and Fontanka, the airport in Odessa, the Kiev subway, the State Aviation Service of Ukraine, and the Transport Ministry of Ukraine.

Infected computers display a screen stating that their files have been encrypted, and instruct victims to access a website over the Tor anonymity network. The site directs victims to pay 0.05 bitcoin — roughly $283 at the time — to obtain the decryption key. If the ransom isn’t paid within two days, the price increases.

Distribution

The malware was still being analyzed at the time, but initial analysis pointed to distribution through fake Flash Player update prompts. The malicious file was delivered from compromised websites in Denmark, Ireland, Bulgaria, Turkey, and Russia.

Researchers noted that the victim has to manually launch the fake Flash installer to be affected, and the file needs admin privileges — triggering a Windows User Account Control (UAC) prompt. Once executed, the dropper copies its main module (infpub.dat) to the Windows folder and runs it via rundll32.exe, the Windows component used to execute code in DLL files.

Notably, the malware’s author appears to be a Game of Thrones fan — the scheduled tasks used to execute other components and reboot the system were given dragon names from the show. The ransom note is displayed both in text files dropped onto the system and via a boot locker screen.

Encryption

Once it infects a system, Bad Rabbit encrypts over 100 file types, including archives, backups, databases, images, documents, source code, and virtual disk images, appending a “.encrypted” extension. It also clears security logs and deletes the update sequence number (USN) to hinder file recovery.

The attackers used the AES-128-CBC cipher paired with an RSA-2048 public key. At the time, it remained unclear whether files could be recovered without paying — though researchers confirmed the encrypted data is technically recoverable with the correct key.

Prevention

Security researcher Amit Serper released an early “vaccine” against the malware, intended to inoculate systems before infection. Step-by-step instructions were published by Cybereason (see reference below).

References

• Cybereason — Researcher Discovers Vaccine for Bad Rabbit Ransomware