The CSE Cybsec ZLab has conducted a preliminary analysis of the Bad Rabbit ransomware discovering interesting aspects of the attack. The malware remembers the notorious NotPetya basically for two characteristics: The behavior after the reboot with a particular ransom note (Figure 1) The Bad Rabbit leverages the open source library DiskCryptor in order to encrypt the user files. The ransomware propagates through drive-by download attacks, attackers infected many sites in Russia, Bulgaria, and Turkey. It launches a modified version of the imikatz tool to harvest the password stored on the victims host and reuse it to gain access to other machines.”]
Source: https://securityaffairs.co/wordpress/64741/malware/preliminary-analysis-bad-rabbit.html