Comparing EternalPetya and BadRabbit

I've created a table comparing the EternalPetya (ExPetr, NotPetya, etc.) outbreak from June, and the BadRabbit ransomware outbreak from yesterday (2017-10-24).

I have decided to not include WannaCry (WanaCrypt0r), as they are not related, while EternalPetya and BadRabbit do seem very closely related, or even developed by (a part of) the same people.

Use freely, as long as you include a link to the original source, which is this blog post.

Comparison table (click to enlarge)

Download the table / comparison sheet

Additionally, you may find this image as a handy spreadsheet (which you can also download in several formats) on Google Docs here:
EternalPetya_BadRabbit_Comparison

Note: this table or sheet will be updated continuously.


Purpose of BadRabbit?

Again, this makes you wonder about the actual purpose of ransomware, which you can read more about here: The purpose of ransomware

For BadRabbit in particular, it may be deployed as a cover-up or smokescreen, or for both disruption and extortion.


Prevention 

As for any prevention advise, have a look at the following page I've set up:
Ransomware prevention


Disinfection and decryption

Unfortunately, decryption is likely not possible without the cybercriminal's private key.

You may be able to restore the MBR, or your files, if you catch the ransomware in the act, and shutdown the machine at that point. Reboot in safe mode and copy over or back-up your files.

Then, Restore the MBR, and reinstall Windows.

You may also try to restore the MBR first, and consequently attempt to restore files using Shadow Volume Copies. For example, a tool such as Shadow Explorer can be of assistance, or read the tutorial here.

If that doesn't work either, you may try using a data recovery program such as PhotoRec or Recuva


Any questions, comments or feedback, please do let me know in the comments section below, or send me a message on Twitter. See also my About me page for other contact details.