{"Event": {"info": "OSINT - Bad Rabbit Yara rules", "Tag": [{"colour": "#004646", "exportable": true, "name": "type:OSINT"}, {"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#2c4f00", "exportable": true, "name": "malware_classification:malware-category=\"Ransomware\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:ransomware=\"Bad Rabbit\""}], "publish_timestamp": "0", "timestamp": "1509010744", "analysis": "2", "Attribute": [{"comment": "", "category": "Artifacts dropped", "uuid": "59f18036-3758-45d3-ae6c-42b6950d210f", "timestamp": "1508999222", "to_ids": false, "value": "/*\r\n   Yara Rule Set\r\n   Author: Florian Roth\r\n   Date: 2017-10-25\r\n   Identifier: BadRabbit\r\n   Reference: https://pastebin.com/Y7pJv3tK\r\n*/\r\n\r\n/* Rule Set ----------------------------------------------------------------- */\r\n\r\nrule BadRabbit_Gen {\r\n   meta:\r\n      description = \"Detects BadRabbit Ransomware\"\r\n      author = \"Florian Roth\"\r\n      reference = \"https://pastebin.com/Y7pJv3tK\"\r\n      date = \"2017-10-25\"\r\n      hash1 = \"8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93\"\r\n      hash2 = \"579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648\"\r\n      hash3 = \"630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da\"\r\n   strings:\r\n      $x1 = \"schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \\\"%ws\\\" /ST\" fullword wide\r\n      $x2 = \"schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \\\"%ws /C Start \\\\\\\"\\\\\\\" \\\\\\\"%wsdispci.exe\\\\\\\"\" fullword wide\r\n      $x3 = \"C:\\\\Windows\\\\infpub.dat\" fullword wide\r\n      $x4 = \"C:\\\\Windows\\\\cscc.dat\" fullword wide\r\n\r\n      $s1 = \"need to do is submit the payment and get the decryption password.\" fullword ascii\r\n      $s2 = \"\\\\\\\\.\\\\GLOBALROOT\\\\ArcName\\\\multi(0)disk(0)rdisk(0)partition(1)\" fullword wide\r\n      $s3 = \"\\\\\\\\.\\\\pipe\\\\%ws\" fullword wide\r\n      $s4 = \"fsutil usn deletejournal /D %c:\" fullword wide\r\n      $s5 = \"Run DECRYPT app at your desktop after system boot\" fullword ascii\r\n      $s6 = \"Files decryption completed\" fullword wide\r\n      $s7 = \"Disable your anti-virus and anti-malware programs\" fullword wide\r\n      $s8 = \"SYSTEM\\\\CurrentControlSet\\\\services\\\\%ws\" fullword wide\r\n      $s9 = \"process call create \\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\" fullword wide\r\n      $s10 = \"%ws C:\\\\Windows\\\\%ws,#1 %ws\" fullword wide\r\n   condition:\r\n      uint16(0) == 0x5a4d and filesize < 700KB and ( 1 of ($x*) or 2 of them )\r\n}\r\n\r\nrule BadRabbit_Mimikatz_Comp {\r\n   meta:\r\n      description = \"Auto-generated rule - file 2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035\"\r\n      author = \"Florian Roth\"\r\n      reference = \"https://pastebin.com/Y7pJv3tK\"\r\n      date = \"2017-10-25\"\r\n      hash1 = \"2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035\"\r\n   strings:\r\n      $s1 = \"%lS%lS%lS:%lS\" fullword wide\r\n      $s2 = \"lsasrv\" fullword wide\r\n      $s3 = \"CredentialKeys\" ascii\r\n      /* Primary\\x00m\\x00s\\x00v */\r\n      $s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }\r\n   condition:\r\n      ( uint16(0) == 0x5a4d and filesize < 200KB and 3 of them )\r\n}", "disable_correlation": false, "object_relation": null, "type": "yara"}, {"comment": "", "category": "External analysis", "uuid": "59f18068-b310-4af4-b948-c888950d210f", "timestamp": "1508999272", "to_ids": false, "value": "https://twitter.com/cyb3rops/status/923081818013945856", "disable_correlation": false, "object_relation": null, "type": "link"}], "extends_uuid": "", "published": false, "date": "2017-10-26", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "59f18020-36dc-4973-8c98-4156950d210f"}}