GRIDINSOFT HELP CENTER

Wabbit Malware: Local self-replication and resource exhaustion

What it is

A wabbit, sometimes called a rabbit, is self-replicating malware that rapidly creates copies or processes on one system until it consumes storage, memory, processor time, or process limits. Unlike a classic network worm, a wabbit is defined by uncontrolled local replication and does not need to spread to other computers.

How it works

A simple wabbit may repeatedly copy its executable, fork new processes, or generate files in a loop. Resource exhaustion makes the computer slow or unresponsive and can prevent normal applications from starting. Similar symptoms can also come from a software bug or deliberate stress test, so the initiating program and intent must be identified.

Key points

  • Wabbit is a behavioral category and an older informal term, not one specific malware family.

  • Deleting copies while the original process is running may not stop new copies from appearing.

  • Rapid disk growth or process creation can disrupt a system even without data theft or network propagation.

What to do

  • Disconnect the affected system if the source is unknown and stop the parent process from a trusted recovery environment.

  • Preserve a sample and process tree before deleting generated copies.

  • Run a full scan and check startup locations to prevent the replicator from returning.

  • Restore damaged data or system files from a clean backup if resource exhaustion caused corruption.

Helpful?

Glossary (0-9, A-Z)

Still can’t find an answer?

Send us a ticket and we will get back to you.

Submit a ticket