Trusted Design

BadRabbit - Ukranian Metro, Airport hit with ransomware

概要

BadRabbit is distributed as a fake flash update, and reportedly using Mimikatz, the Eternal Romance exploit, and a list of passwords to spread via SMB in a worm-like fashion. So far the damage does not seem as wide spread as WannaCry or NotPetya. Thanks to Bulwarkz for additional Forensic Analysis: - Clears the windows event log - Clears the journal log - Drops executables to the windows directory and starts them - Shows the ability to spread by using its contained functionality to enumerate network shares of other (attached) devices - Uses shutdown.exe to shutdown or reboot the system - Contains functionality to register a low level keyboard hook - Contains functionality to infect the boot sector. Dropped files appear to be kernel level key loggers

Created: 2026-02-23

Indicators

• FileHash-SHA1 - 4f61e154230a64902ae035434690bf2b96b4e018 -
• URL - http://1dnscontrol.com/flash_install.php -
• FileHash-MD5 - b14d8faf7f0cbcfad051cefe5f39645f -
• FileHash-MD5 - 37945c44a897aa42a66adcab68f560e0 -
• FileHash-SHA1 - afeee8b4acff87bc469a6f0364a81ae5d60a2add -
• domain - 1dnscontrol.com -
• domain - caforssztxqzf2nm.onion -
• YARA - 3bd284f840112b7d85ec2fe06c6016008b5fecca -
• FileHash-SHA1 - 413eba3973a15c1a6429d9f170f3e8287f98c21c -
• FileHash-SHA256 - 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 -
• FileHash-SHA256 - 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035 -
• FileHash-SHA1 - 16605a4a29a101208457c47ebfde788487be788d -
• FileHash-SHA256 - 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648 -
• FileHash-SHA256 - 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c -
• FileHash-MD5 - 1d724f95c61f1055f0d02c2154bbccd3 -
• FileHash-SHA256 - 682adcb55fe4649f7b22505a54a9dbc454b4090fc2bb84af7db5b0908f3b7806 -
• FileHash-SHA256 - 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da -
• URL - http://185.149.120.3/scholargoogle/ -
• FileHash-MD5 - fbbdc39af1139aebba4da004475e8839 -
• FileHash-SHA256 - 0b2f863f4119dc88a22cc97c0a136c88a0127cb026751303b045f7322a8972f6 -
• YARA - 0b8dc24a804351f66a94e7a4fd268de4b0bd3c0a -
• YARA - 17073231e37ef2d92f86a38b810cac1134d621af -
• FileHash-SHA1 - 79116fe99f2b421c52ef64097f0f39b815b20907 -
• FileHash-SHA1 - de5c8d858e6e41da715dca1c019df0bfb92d32c0 -
• URL - http://1dnscontrol.com/install_flash_player.exe -

類似Pulses

• BlackEnergy by the SSHBearDoor (score: 0.65)
• Trojan:Win32/Dematali (score: 0.64)
• Ramnit – in-depth analysis (score: 0.62)
• TrojanDownloader:Win32/Cbeplay (score: 0.62)
• BEB Ukranian CERT KILL Disk (score: 0.62)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る