Bad Rabbit

ATP Sandbox Adv. HeuristicsAV

Description

Bad Rabbit is a self propagating ransomware that hit the Ukrainian transportation sector in 2017 and also targeted organizations and consumers in Russia.

Stats

First seen: March 2022
Last seen: October 2026

MITRE ATT&CK techniques

15 techniques across 8 tactics.

TA0001 Initial Access

T1189Drive-by Compromise

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1106Native API
T1204User Execution
- T1204.002Malicious File
T1569System Services
- T1569.002Service Execution

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1218System Binary Proxy Execution
- T1218.011Rundll32

TA0006 Credential Access

T1003OS Credential Dumping
- T1003.001LSASS Memory
T1110Brute Force
- T1110.003Password Spraying

TA0007 Discovery

T1057Process Discovery
T1135Network Share Discovery

TA0008 Lateral Movement

T1210Exploitation of Remote Services

TA0040 Impact

T1486Data Encrypted for Impact
T1495Firmware Corruption

Associated groups

G0034Sandworm Team

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Ransomware.BadRabbit	ATP Sandbox Adv. Heuristics
Gen:Heur.Ransom.BadRabbit.1	AV
Script-JS.Ransomware.BadRabbit	ATP Sandbox Adv. Heuristics
Trojan.Ransom.BadRabbit.A	AV
Win32.Ransomware.BadRabbit	ATP Sandbox Adv. Heuristics
Win64.Ransomware.BadRabbit	ATP Sandbox Adv. Heuristics

Related blogs

Stepping Stone Attack launches EternalBlue Internally

Stepping Stone Attack launches EternalBlue Internally

November 2, 20175 min read

Related families

InvisiMole Qilin Empire Bumblebee Latrodectus

References