{"id":4326,"date":"2017-10-25T11:03:36","date_gmt":"2017-10-25T08:03:36","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=4326"},"modified":"2019-11-15T14:47:26","modified_gmt":"2019-11-15T11:47:26","slug":"bad-rabbit-ransomware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/bad-rabbit-ransomware\/4326\/","title":{"rendered":"Bad Rabbit: Yeni bir fidye yaz\u0131l\u0131m\u0131 salg\u0131n\u0131 y\u00fckseli\u015fe ge\u00e7iyor"},"content":{"rendered":"<p><strong>Bu yaz\u0131, uzmanlar\u0131m\u0131z k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mla ilgili yeni ayr\u0131nt\u0131lar elde ettik\u00e7e g\u00fcncellenmektedir.<\/strong><\/p>\n<p>Bu y\u0131l iki b\u00fcy\u00fck \u00f6l\u00e7ekli fidye yaz\u0131l\u0131m\u0131 salg\u0131n\u0131yla kar\u015f\u0131la\u015fm\u0131\u015ft\u0131k: <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/wannacry-ransomware\/3181\/\" target=\"_blank\" rel=\"noopener\">WannaCry<\/a> ve <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/new-ransomware-epidemics\/3319\/\" target=\"_blank\" rel=\"noopener\">ExPetr<\/a> (Petya ve NotPetya olarak da bilinir) salg\u0131nlar\u0131ndan bahsediyoruz. G\u00f6r\u00fcn\u00fc\u015fe g\u00f6re \u00fc\u00e7\u00fcnc\u00fc bir salg\u0131n kap\u0131da: Yeni k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131ma Bad Rabbit (Yaramaz Tav\u015fan) ad\u0131 veriliyor. Daha do\u011frusu, fidye yaz\u0131l\u0131m\u0131 notuyla ba\u011flant\u0131l\u0131 darknet web sitesinin belirtti\u011fi isim bu.<\/p>\n<p>\u015eu anda Bad Rabbit fidye yaz\u0131l\u0131m\u0131n\u0131n baz\u0131 b\u00fcy\u00fck Rus medya kurulu\u015flar\u0131n\u0131 etkiledi\u011fi biliniyor. Interfax haber ajans\u0131 ve Fontanka.ru onaylanan kurbanlar aras\u0131nda yer al\u0131yor. Odessa Uluslararas\u0131 Havaliman\u0131 bilgi sistemine bir siber sald\u0131r\u0131 yap\u0131ld\u0131\u011f\u0131n\u0131 bildirdi ancak bunun ayn\u0131 sald\u0131r\u0131 olup olmad\u0131\u011f\u0131 hen\u00fcz netlik kazanm\u0131\u015f de\u011fil.<\/p>\n<p>Bad Rabbit sald\u0131r\u0131lar\u0131n\u0131n ard\u0131ndaki su\u00e7lular, fidye olarak 0,05 bitcoin istiyor, ki bu rakam mevcut kur oran\u0131nda yakla\u015f\u0131k 280 ABD dolar\u0131na tekab\u00fcl ediyor. Hi\u00e7 T\u00fcrk Liras\u0131na \u00e7evirmekle u\u011fra\u015fmay\u0131n, biz s\u00f6yleyelim, 1044\u20ba ediyor.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4328\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2017\/10\/25104259\/badrabbit_1.gif\" alt=\"\" width=\"720\" height=\"405\"><\/p>\n<p>Bulgular\u0131m\u0131za g\u00f6re sald\u0131r\u0131, a\u00e7\u0131klardan yararlanma yaz\u0131l\u0131m\u0131 kullanm\u0131yor. Bu bir indirme sald\u0131r\u0131s\u0131: Kurbanlar, etkilenmi\u015f web sitelerinden sahte bir Adobe Flash y\u00fckleyicisi indiriyor ve .exe dosyas\u0131n\u0131 manuel olarak \u00e7al\u0131\u015ft\u0131rd\u0131klar\u0131nda kendileri de sald\u0131r\u0131dan etkilenmi\u015f oluyor. Ara\u015ft\u0131rmac\u0131lar\u0131m\u0131z tamam\u0131 haber veya medya siteleri olmak \u00fczere g\u00fcvenli\u011fi tehlikede olan bir\u00e7ok web sitesi tespit etti.<\/p>\n<p>Bad Rabbit\u2019in \u015fifreledi\u011fi dosyalar\u0131 geri alman\u0131n (fidyeyi \u00f6deyerek veya fidye yaz\u0131l\u0131m\u0131 kodundaki baz\u0131 kusurlar\u0131 kullanarak) m\u00fcmk\u00fcn olup olmad\u0131\u011f\u0131 hen\u00fcz bilinmiyor. Kaspersky Lab antivir\u00fcs uzmanlar\u0131 sald\u0131r\u0131y\u0131 ara\u015ft\u0131r\u0131yor. Biz de ara\u015ft\u0131rmac\u0131lar\u0131n bulgular\u0131 do\u011frultusunda bu yaz\u0131y\u0131 g\u00fcncelleyece\u011fiz.<\/p>\n<p>Verilerimize g\u00f6re bu sald\u0131r\u0131lar\u0131n kurbanlar\u0131n\u0131n \u00e7o\u011fu Rusya\u2019da bulunuyor. Ukrayna, T\u00fcrkiye ve Almanya\u2019da benzer fakat daha az say\u0131da sald\u0131r\u0131 oldu\u011funu g\u00f6rd\u00fck. Bu fidye yaz\u0131l\u0131m\u0131, hacklenmi\u015f birka\u00e7 Rus medya web sitesi \u00fczerinden cihazlar\u0131 etkiledi. Ara\u015ft\u0131rmam\u0131za g\u00f6re bu, ExPetr sald\u0131r\u0131s\u0131nda kullan\u0131lan y\u00f6ntemlere benzer y\u00f6ntemler kullan\u0131larak \u015firket a\u011flar\u0131na kar\u015f\u0131 yap\u0131lan hedefli bir sald\u0131r\u0131. Ancak ExPetr ile ili\u015fkili olup olmad\u0131\u011f\u0131n\u0131 do\u011frulayam\u0131yoruz. Ara\u015ft\u0131rmalar\u0131m\u0131z s\u00fcr\u00fcyor. Ara\u015ft\u0131rmalar\u0131m\u0131z s\u00fcrerken <a href=\"https:\/\/securelist.com\/bad-rabbit-ransomware\/82851\/\" target=\"_blank\" rel=\"noopener\">Securelist<\/a> \u00fczerindeki bu yaz\u0131da teknik ayr\u0131nt\u0131lar\u0131 inceleyebilirsiniz.<\/p>\n<p>Ara\u015ft\u0131rmac\u0131lar\u0131m\u0131z Bad Rabbit sald\u0131r\u0131lar\u0131n\u0131, bu y\u0131l Haziran ay\u0131nda yap\u0131lan ExPetr sald\u0131r\u0131lar\u0131na ba\u011flayabilecek yeterli kan\u0131t buldu. Analizlere g\u00f6re, Bad Rabbit\u2019te kullan\u0131lan baz\u0131 kodlar daha \u00f6nce ExPetr\u2019da g\u00f6r\u00fcld\u00fc.<\/p>\n<p>Di\u011fer benzerlikler aras\u0131nda, sald\u0131r\u0131 s\u0131ras\u0131nda ayn\u0131 domain kullan\u0131lmas\u0131 bulunuyor. Baz\u0131 domainler Haziran\u2019da hacklenmi\u015f ancak kullan\u0131lmam\u0131\u015ft\u0131. Ayr\u0131ca bu zararl\u0131 yaz\u0131l\u0131m\u0131 kurumsal a\u011flarda da\u011f\u0131tmak i\u00e7in kullan\u0131lan teknik de ayn\u0131 \u2013 iki sald\u0131r\u0131 da Windows Management Instrementation Command-line (WMIC) kulland\u0131. Ancak farkl\u0131l\u0131klar\u0131 da var: ExPetr\u2019\u0131n aksine, Bad Rabbit, EternalBlue a\u00e7\u0131\u011f\u0131n\u0131 veya ba\u015fka bir a\u00e7\u0131\u011f\u0131 kullanm\u0131yor.<\/p>\n<p>Uzmanlar\u0131m\u0131z iki sald\u0131r\u0131n\u0131n arkas\u0131nda da ayn\u0131 sald\u0131rganlar\u0131n oldu\u011funu ve Bad Rabbit sald\u0131r\u0131s\u0131n\u0131 2017 Temmuz\u2019dan veya daha \u00f6nceden beri planlad\u0131klar\u0131n\u0131 d\u00fc\u015f\u00fcn\u00fcyorlar. Ara\u015ft\u0131rmam\u0131za devam ediyoruz. Bu s\u0131rada daha fazla teknik detay i\u00e7in <a href=\"https:\/\/securelist.com\/bad-rabbit-ransomware\/82851\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Securelist<\/a> g\u00f6nderimize g\u00f6z atabilirsiniz. <\/p>\n<p>Kaspersky Lab \u00fcr\u00fcnleri sald\u0131r\u0131y\u0131 a\u015fa\u011f\u0131daki kararla tespit ediyor: UDS:DangerousObject.Multi.Generic (Kaspersky Security Network taraf\u0131ndan tespit edilir), PDM:Trojan.Win32.Generic (System Watcher taraf\u0131ndan tespit edilir) ve Trojan-Ransom.Win32.Gen.ftl.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kis-trial-ransomware\">\n<p>Bad Rabbit kurban\u0131 olmaktan ka\u00e7\u0131nmak i\u00e7in:<\/p>\n<p>Kaspersky Lab \u00fcr\u00fcnleri kullan\u0131c\u0131lar\u0131:<\/p>\n<ul>\n<li>System Watcher ve Kaspersky Security Network uygulamalar\u0131n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun. \u00c7al\u0131\u015fm\u0131yorsa bu \u00f6zelliklerin a\u00e7\u0131lmas\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r.<\/li>\n<\/ul>\n<p>Di\u011fer kullan\u0131c\u0131lar:<\/p>\n<ul>\n<li>c:windowsinfpub.dat ve c:Windowscscc.dat dosyalar\u0131n\u0131n y\u00fcr\u00fct\u00fclmesini engelleyin.<br>\nK\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n a\u011f\u0131n\u0131z \u00fczerinden yay\u0131lmas\u0131n\u0131 \u00f6nlemek i\u00e7in WMI hizmetini (ortam\u0131n\u0131zda m\u00fcmk\u00fcnse) devre d\u0131\u015f\u0131 b\u0131rak\u0131n.<\/li>\n<\/ul>\n<p>Herkes i\u00e7in ipu\u00e7lar\u0131:<\/p>\n<ul>\n<li>Verilerinizi yedekleyin.<\/li>\n<li>Fidyeyi \u00f6demeyin.<\/li>\n<\/ul>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kartb2b\">\n","protected":false},"excerpt":{"rendered":"<p>Bu y\u0131l iki b\u00fcy\u00fck \u00f6l\u00e7ekli fidye yaz\u0131l\u0131m\u0131 salg\u0131n\u0131yla kar\u015f\u0131la\u015fm\u0131\u015ft\u0131k: WannaCry ve ExPetr (Petya ve NotPetya olarak da bilinir) salg\u0131nlar\u0131ndan bahsediyoruz. G\u00f6r\u00fcn\u00fc\u015fe g\u00f6re \u00fc\u00e7\u00fcnc\u00fc bir salg\u0131n kap\u0131da: Yeni k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131ma Bad Rabbit (Yaramaz Tav\u015fan) ad\u0131 veriliyor. Daha do\u011frusu, fidye yaz\u0131l\u0131m\u0131 notuyla ba\u011flant\u0131l\u0131 darknet web sitesinin belirtti\u011fi isim bu.<\/p>\n","protected":false},"author":675,"featured_media":4327,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1351],"tags":[1408,591,1409,843,1256,241,1410],"class_list":{"0":"post-4326","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-bad-rabbit","9":"tag-fidye-yazilimi","10":"tag-kotu-tavsan","11":"tag-petya","12":"tag-salgin","13":"tag-trojan","14":"tag-wiper"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/bad-rabbit-ransomware\/4326\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/bad-rabbit-ransomware\/11663\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/bad-rabbit-ransomware\/9747\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/bad-rabbit-ransomware\/5456\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/bad-rabbit-ransomware\/13106\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/bad-rabbit-ransomware\/11993\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/bad-rabbit-ransomware\/11628\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/bad-rabbit-ransomware\/14652\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/bad-rabbit-ransomware\/14391\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/bad-rabbit-ransomware\/19072\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/bad-rabbit-ransomware\/19887\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/bad-rabbit-ransomware\/9696\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/bad-rabbit-ransomware\/8396\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/bad-rabbit-ransomware\/15081\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/bad-rabbit-ransomware\/18518\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/bad-rabbit-ransomware\/18986\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/bad-rabbit-ransomware\/18974\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/fidye-yazilimi\/","name":"Fidye Yaz\u0131l\u0131m\u0131"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/4326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/675"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=4326"}],"version-history":[{"count":4,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/4326\/revisions"}],"predecessor-version":[{"id":7016,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/4326\/revisions\/7016"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/4327"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=4326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=4326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=4326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}