Overview

overview

10

Static

static

10

revil.bin

linux_amd64

6

Analysis

  • max time kernel
    0s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    17-06-2022 14:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    revil.bin

  • Size

    102KB

  • MD5

    395249d3e6dae1caff6b5b2e1f75bacd

  • SHA1

    29f16c046a344e0d0adfea80d5d7958d6b6b8cfa

  • SHA256

    ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4

  • SHA512

    54bf867c030f708eb0975825d7c8e4c1b3bca49451bc08ebc3bb9fbd10e9ffdce82332ca200ee960b8ce7dfee1247e52c4ca11041cd976aa7cee6d4957144714

Score
6/10

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • ./revil.bin
    ./revil.bin
    1⤵
      PID:581
      • /bin/sh
        sh -c "uname -a && echo \" | \" && hostname"
        2⤵
          PID:582
          • /bin/uname
            uname -a
            3⤵
              PID:583
            • /bin/hostname
              hostname
              3⤵
                PID:584
            • /bin/sh
              sh -c "uname -a && echo \" | \" && hostname"
              2⤵
                PID:585
                • /bin/uname
                  uname -a
                  3⤵
                    PID:586
                  • /bin/hostname
                    hostname
                    3⤵
                      PID:587
                  • /bin/sh
                    sh -c "pkill -9 vmx-*"
                    2⤵
                      PID:588
                      • /usr/bin/pkill
                        pkill -9 "vmx-*"
                        3⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:589
                    • /bin/sh
                      sh -c "esxcli --formatter=csv --format-param=fields==\"WorldID,DisplayName\" vm process list | awk -F \"\\\"*,\\\"*\" '{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}'"
                      2⤵
                        PID:590
                        • /usr/bin/awk
                          awk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"
                          3⤵
                            PID:592

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Initial Access

                      Execution

                      Persistence

                      Privilege Escalation

                      Defense Evasion

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      Lateral Movement

                      Collection

                      Exfiltration

                      Command and Control

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads