Return of Not Petya as Bad Rabbit Diskcoder

After Wannacry and Petya/Not Petya/GoldenEye, it's clear that Ukraine is a testing ground for threat actors to try out their malware, program different variants, and perfect them before launching at their final targets. Today, we have BadRabbit and DiskCoder. When we first read about them, we thought they were two separate malwares. On deeper analysis, they are both the same.

Background

ESET reported that several transportation organizations in Ukraine, as well as some governmental organizations, had suffered a cyberattack resulting in encrypted computers. Public sources confirmed that computer systems in the Kiev Metro, Odessa airport, and a number of organizations in Russia were affected.

They discovered that in the case of the Kiev Metro, the malware used was Diskcoder.D — a new variant of ransomware also known as Petya. The previous variant of Diskcoder was used in a devastating global cyberattack in June 2017.

Distribution Method

One of the distribution methods of Bad Rabbit is via drive-by download. Popular websites are compromised and have JavaScript injected into their HTML body or in one of their .js files. T1189

The injected script reports information to 185.149.120[.]3, including:

• Browser User-Agent
• Referrer
• Cookie from the visited site
• Domain name of the visited site

Server-side logic determines if the visitor is of interest. If so, a popup asking to download an update for Flash Player appears. Clicking "Install" initiates a download from 1dnscontrol[.]com. The executable install_flash_player.exe is the dropper for Win32/Filecoder.D.

Propagation via SMB

As opposed to some public claims, Bad Rabbit does not use the EternalBlue vulnerability like Win32/Diskcoder.C (Not-Petya). Instead, it scans the internal network for open SMB shares, looking for: T1021.002

Mimikatz is launched on the compromised computer to harvest credentials. T1003.001 A hardcoded list of common usernames and passwords is also embedded in the malware, including default credentials like Administrator, Admin, root, and weak passwords like qwerty, password, and 123456. T1110

Encryption

Win32/Diskcoder.D is a modified version of Win32/Diskcoder.C with bugs in file encryption fixed. The encryption now uses DiskCryptor, an open-source legitimate software for full drive encryption. T1486

Keys are generated using CryptGenRandom and then protected by a hardcoded RSA 2048 public key. Encrypted files have the extension .encrypted. Like before, AES-128-CBC is used for file-level encryption.

Geographic Distribution

ESET telemetry shows that Ukraine accounts for only 12.2% of the total infections. The dropper distribution closely matches compromised websites hosting the malicious JavaScript:

It's interesting to note that all the major companies were hit at the same time. It is possible that the group already had a foothold inside their networks and launched the watering hole attack simultaneously as a decoy.

AV Coverage

As of the morning of the attack, only 9 out of 66 AV companies had signatures for the malware. By end of day, only 27 out of 66 had detection — a concerning gap in coverage that left many organizations exposed.

Indicators of Compromise