Bad Rabbit Ransomware

A new ransomware has seen the light. Bad Rabbit ransomware is currently roaming Eastern European countries. Bad Rabbit is mainly delivered using a fake Flash Update. This means we a looking a regular drive-by-attack and fake updates/malicious software from websites to get it started. Secure you clients now! 1. Blacklist the hashes 2. Block the files 3. Lock the registry entries. 4. Remove your local administrative privileges, if you can’t? Limit them and monitor using: Access Director Enterprise Bad Rabbit IOCs: Hashes: install_flash_player.exe: 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da infpub.dat: 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648 cscc.dat (dcrypt.sys): 0b2f863f4119dc88a22cc97c0a136c88a0127cb026751303b045f7322a8972f6 dispci.exe: 8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 Files: C:\Windows\infpub.dat C:\Windows\System32\Tasks\drogon C:\Windows\System32\Tasks\rhaegal C:\Windows\cscc.dat C:\Windows\dispci.exe Registry entries: HKLM\SYSTEM\CurrentControlSet\services\cscc … Continue reading