Bad Rabbit Ransomware: What It Is, What to Do

[Paul Wagenseil]

A ransomware worm called Bad Rabbit spread across eastern Europe Tuesday, with reports that night of outbreaks in other parts of the world.

Bad Rabbit Ransomware: What It Is, What to Do : Read more

 

[darrenskirvin]

@Echo off
Echo **************************************
Echo * Create files and revoke permissions*
Echo **************************************
@echo "created-this-to-stop-bad-rabit" >c:\windows\infpub.dat
@echo "created-this-to-stop-bad-rabit" >c:\windows\cscc.dat
icacls c:\windows\infpub.dat /inheritance:r
icacls C:\windows\cscc.dat /inheritance:r

Create this in a .bat or .cmd

 

[Paul Wagenseil]

@Echo off
Echo **************************************
Echo * Create files and revoke permissions*
Echo **************************************
@echo "created-this-to-stop-bad-rabit" >c:\windows\infpub.dat
@echo "created-this-to-stop-bad-rabit" >c:\windows\cscc.dat
icacls c:\windows\infpub.dat /inheritance:r
icacls C:\windows\cscc.dat /inheritance:r

Create this in a .bat or .cmd

Thanks! For our non-technical readers, you would take the above steps in a command-line window, which you can get by typing "cmd" into the search field you get when clicking on the Windows logo in the bottom left of your screen. Make sure your account has administrator privileges.

 

[eli.lingard]

MERGED QUESTION
Question from eli.lingard : "What to do about Bad Rabbit?"

I'm sorry if I've already posted this before - I wasn't sure if it had been sent through or not!! I have AVG free installed on my Windows 8 PC, but I'm worried that it won't be enough to stop Bad Rabbit if it ever infects my PC. I can't seem to run windows defender and I'm confused as to why it might be better than AVG if it doesn't have the best ratings.

I can't really afford anything too heavy, but I really don't want to be under attack!

What would you recommend?

 

[eli.lingard]

@Echo off
Echo **************************************
Echo * Create files and revoke permissions*
Echo **************************************
@echo "created-this-to-stop-bad-rabit" >c:\windows\infpub.dat
@echo "created-this-to-stop-bad-rabit" >c:\windows\cscc.dat
icacls c:\windows\infpub.dat /inheritance:r
icacls C:\windows\cscc.dat /inheritance:r

Create this in a .bat or .cmd

Thanks! For our non-technical readers, you would take the above steps in a command-line window, which you can get by typing "cmd" into the search field you get when clicking on the Windows logo in the bottom left of your screen. Make sure your account has administrator privileges.

I'm afraid I'm really not technically minded; what will this command do, and how exactly do I type it in cmd? Do I need to type all of the commands listed above after the first line of text that comes up in my cmd box?

 

[Paul Wagenseil]

MERGED QUESTION
Question from eli.lingard : "What to do about Bad Rabbit?"

I'm sorry if I've already posted this before - I wasn't sure if it had been sent through or not!! I have AVG free installed on my Windows 8 PC, but I'm worried that it won't be enough to stop Bad Rabbit if it ever infects my PC. I can't seem to run windows defender and I'm confused as to why it might be better than AVG if it doesn't have the best ratings.

I can't really afford anything too heavy, but I really don't want to be under attack!

What would you recommend?

AVG Free should be enough to stop Bad Rabbit. Make sure the AVG software automatically updates every day, however. You're not able to run Windows Defender because you have AVG installed, and that's fine: AVG is better than Windows Defender anyway.

 

[Paul Wagenseil]

@Echo off
Echo **************************************
Echo * Create files and revoke permissions*
Echo **************************************
@echo "created-this-to-stop-bad-rabit" >c:\windows\infpub.dat
@echo "created-this-to-stop-bad-rabit" >c:\windows\cscc.dat
icacls c:\windows\infpub.dat /inheritance:r
icacls C:\windows\cscc.dat /inheritance:r

Create this in a .bat or .cmd

Thanks! For our non-technical readers, you would take the above steps in a command-line window, which you can get by typing "cmd" into the search field you get when clicking on the Windows logo in the bottom left of your screen. Make sure your account has administrator privileges.

I'm afraid I'm really not technically minded; what will this command do, and how exactly do I type it in cmd? Do I need to type all of the commands listed above after the first line of text that comes up in my cmd box?

These steps apparently will prevent the Bad Rabbit malware from running on your machine in case of infection. We've linked to this in our article, but Cybereason has a fairly plain-English explanation here: https://www.cybereason.com/blog/cybereason-researcher-discovers-vaccine-for-badrabbit-ransomware

 

[darrenskirvin]

@Echo off
Echo **************************************
Echo * Create files and revoke permissions*
Echo **************************************
@echo "created-this-to-stop-bad-rabit" >c:\windows\infpub.dat
@echo "created-this-to-stop-bad-rabit" >c:\windows\cscc.dat
icacls c:\windows\infpub.dat /inheritance:r
icacls C:\windows\cscc.dat /inheritance:r

Create this in a .bat or .cmd

Thanks! For our non-technical readers, you would take the above steps in a command-line window, which you can get by typing "cmd" into the search field you get when clicking on the Windows logo in the bottom left of your screen. Make sure your account has administrator privileges.

 

[darrenskirvin]

My pleasure. You can put this in a logon script for your active directory connected windows clients.

 

[eli.lingard]

MERGED QUESTION
Question from eli.lingard : "What to do about Bad Rabbit?"

I'm sorry if I've already posted this before - I wasn't sure if it had been sent through or not!! I have AVG free installed on my Windows 8 PC, but I'm worried that it won't be enough to stop Bad Rabbit if it ever infects my PC. I can't seem to run windows defender and I'm confused as to why it might be better than AVG if it doesn't have the best ratings.

I can't really afford anything too heavy, but I really don't want to be under attack!

What would you recommend?

AVG Free should be enough to stop Bad Rabbit. Make sure the AVG software automatically updates every day, however. You're not able to run Windows Defender because you have AVG installed, and that's fine: AVG is better than Windows Defender anyway.

Brilliant, thank you!

 

[Avast-Team]

Our threat intelligence team put together a detailed synopsis of BadRabbit, including where it spread to and some of its tricks to avoid detection, if anyone is curious to learn more: https://blog.avast.com/its-rabbit-season-badrabbit-ransomware-infects-airports-and-subways

EDIT: Can confirm also that Avast and AVG both are detecting BadRabbit (this is also mentioned in the blog)