Bad Rabbit
- ID
- S0606
- Type
- Malware
- Associated names
- Win32/Diskcoder.D
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 3 Jan 2025
Bad Rabbit is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. Bad Rabbit has also targeted organizations and consumers in Russia. [1][2][3]
Techniques used (15)
- T1003.001 LSASS Memory
- T1036.005 Match Legitimate Resource Name or Location
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1106 Native API
- T1110.003 Password Spraying
- T1135 Network Share Discovery
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1218.011 Rundll32
- T1486 Data Encrypted for Impact
- T1495 Firmware Corruption
- T1548.002 Bypass User Account Control
- T1569.002 Service Execution