Overview

overview

10

Static

static

3

revil.exe

windows7-x64

10

revil.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    revil.bin

  • Size

    119KB

  • Sample

    240203-x3yjxaagep

  • MD5

    a4331ff805b0a8f2a2892777c224b65e

  • SHA1

    2c5521077dd1a6f5f3558351370880aee9ab7c71

  • SHA256

    329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483

  • SHA512

    786a6ffdd7206b0f11dd45921826e3685fe4b64b82b4fa26702a30dcb762d4310b3b55683a8c510175ed6a9086125156e676caa3220597f8ed7298f6cdc51799

  • SSDEEP

    3072:KW5yc3Y4SMQwuOekD96R928A2fFM+/uSxo+HHz/bs/k4OS:K83Y5BAxa92c1rxTnz/Y/k4O

Score
10/10
sodinokibi$2b$13$wz1rerfdlg.aistldqg5jeqqysemspatwkhdwbpwvrc3ty7akscg658ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6

Campaign

58

Attributes
  • net

    false

  • pid

    $2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6

  • prc

    vsnapvss

    EnterpriseClient

    firefox

    infopath

    cvd

    tv_x64.exe

    VeeamTransportSvc

    steam

    encsvc

    mydesktopservice

    outlook

    synctime

    ocssd

    SAP

    cvfwd

    bengien

    vxmon

    bedbh

    ocomm

    ocautoupds

    raw_agent_svc

    oracle

    disk+work

    powerpnt

    saposcol

    sqbcoreservice

    sapstartsrv

    beserver

    saphostexec

    dbeng50

    isqlplussvc

    CVODS

    DellSystemDetect

    CVMountd

    TeamViewer.exe

    dbsnmp

    thunderbird

    mspub

    wordpad

    visio

    benetns

    QBCFMonitorService

    TeamViewer_Service.exe

    tv_w32.exe

    QBIDPService

    winword

    thebat

    VeeamDeploymentSvc

    avagent

    QBDBMgrN

    mydesktopqos

    xfssvccon

    sql

    tbirdconfig

    CagService

    pvlsvr

    avscc

    VeeamNFSSvc

    onenote

    excel

    msaccess

    agntsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-README.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have {EXT} extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: {KEY} !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!

  • sub

    58

  • svc

    QBCFMonitorService

    thebat

    dbeng50

    winword

    dbsnmp

    VeeamTransportSvc

    disk+work

    TeamViewer_Service.exe

    firefox

    QBIDPService

    steam

    onenote

    CVMountd

    cvd

    VeeamDeploymentSvc

    VeeamNFSSvc

    bedbh

    mydesktopqos

    avscc

    infopath

    cvfwd

    excel

    beserver

    powerpnt

    mspub

    synctime

    QBDBMgrN

    tv_w32.exe

    EnterpriseClient

    msaccess

    ocssd

    mydesktopservice

    sqbcoreservice

    CVODS

    DellSystemDetect

    oracle

    ocautoupds

    wordpad

    visio

    SAP

    bengien

    TeamViewer.exe

    agntsvc

    CagService

    avagent

    ocomm

    outlook

    saposcol

    xfssvccon

    isqlplussvc

    pvlsvr

    sql

    tbirdconfig

    vxmon

    benetns

    tv_x64.exe

    encsvc

    sapstartsrv

    vsnapvss

    raw_agent_svc

    thunderbird

    saphostexec

Extracted

Path

C:\Users\rf917sw-README.txt

Ransom Note
---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have rf917sw extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: 417CLRYf7m3stBbKnOVMOgSpD7RUGnmPHWXKvI6ksWZswkrEQj+qNXhUJK7X92LS O0NItUyjPj8nKOQoy6IXepa/39dyAzHT2CqZBmib1+tN7PyCe1iIy3n4Dn7YZ7JM EiqkJLX2zGTtYHwg/I6vcoEAZHACe1B2F2J2HrK2vueiQ37mGOA5qwB2M9Qs3rul QTKL32/qCO1oO/xpddeblczadS552LNR9TrjT6aD7WVmEzvBW50zWZdmqIc9NCXB rFLH9jd9XHW70ZNSRDOtmcr0W+mhhCD6FB6NYbkx9i/HghP93evTUA8/WaPlaoSZ kRhc3Itllmx01lTpaiR6p7Y75gmiQoH9wp207feGvkk/BIUzZT0kbRwa2b8TszQM 92jBIZRmqRNbRQYjwStCKnYbc7fBjnhaTKBedKtKiRE1WF5fTQrwr5zmbDnh6YXp prFREIpV8VnxuZfhwZ6DPlLvQpV9uwQuL8EetVSov32bNjinGLE76ICITbyNU9dS qYSgXb8T4shQUeGhzUIA1BOC1RSp3WJzq/YiEFd8rZYJfqaP56jrWmhe82q7jiZC g6nN7GJo7Y3g2n6tU+lu34/WIU7Z5lsJdbr3ftTJR0CRgWid9C8no9QkSZvdTWrD E0e/KJWZIxkueo79jTCmnB4vkVrPTGtxRSgy9gLU7OgeRKuyPduscTwqxWFXRe16 h9b0QP8A0MMfjeuot3iN5S/9Ot5QIDpInAsZbt0qjVqG7xtGZFe0oTq4YKCfpGn3 UODkVNlVO+V5IJp4e8QxYDp3S5GUQ6hAF8kW5CxbkFlA/R3xXZuW9CJEjG4M9eKo cvM53dLvUVqLUOtwqXCc9qW52BzoX0l2/JO3nk3Q8zE8PVZ90l2DwwgWhDVGRfW2 sOpxx1j7uuQ8dKwLFccSOaLdDSrjvxen4yAphNz1Zp2DKT7vj2KOI3gWTQdKs0YO iboLpTnmdVY+utJM6JUYXoOQeMi7qO5/dm/byAOoeHJKXVCeS7ElHGUhDYEopaSZ 5HH1tYdYvXYDtEC5eLZ/ZlA2qTJAac4fNIBG23QJQ7QSuAuHMrUcYZeLICyNNVPf uduV939E0D+lRQ732b6CyPhmjDkmNgwC5e9VHWzIxT3+khjj608yoD/PC1iFIQ2U K3YxinRrddCyjErNjOa02iRtDlkvi3R1C6iVQ/W9VRMPnSkXJlzM9JwU0nok5eoc 4a9evOi6zOATh5WPvRy5vKEdFKyVJ+OQkdP5BueuNS+2zymvKfhtQBqXa4abBmcT 0JLjVnW5uzj0nrEbbHYBPSrnMdmYMRmoipB3MhVTQh1VGyMSCRl5Aa+8vsF5f2fr 90PksQ2FaqZGOHAAJmwzHxIArhjxzbyiHdQzN8sR !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!
URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Extracted

Path

C:\Recovery\6j217dy0-README.txt

Ransom Note
---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have 6j217dy0 extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: Mw2HsVWl4X2q+sfyrFDRcmMWcyIRBpjHaeAYnM2yX4KxXVrabxwT3eaKIG2Su4+n NJAYVooJAZN6aBUomEgI0tsLIFJD9OOLqHl48NbPxAAYZweJa846TCROaTeOhVaG cdBhwsY217CuUWlv1zSzdZPk1H+BB8yNXP8RliL9tIClTyaZIwjCb8cc2Xrfgx2D drGV1enSkAPUgX9l4ONvtq+R/qRWR7GA3H2mISqZNgHf2NvdlIuxz/AOg+6eh3+h RkkiKIZ3Ip0s8suCX+uBCpLoTrlln4u3eX06fgKq0hf6qkFW+fcxCtoKW6RsdPtu mHdtF353bQ2iBk44E4tpumFwT3PGkY6gmjyinv/LwxOWYlo7f+7HNoIjQdnWbign 5gpXVXzjHYylHKe8svlsMOUNa7k9BDXEL4yTAiY+vl5VscaM2vbIgeLQrvtGmF1l gnJo+LZaWZk7Q/0NA1+lvyYnah4zt672yv0UyRu4z5IUAUngw43enh+hOJb2mWWy 1fDnrEFi3t68c5Xw2x+/nGnfzJy5Tu/HJfM0ElJmtM8WjpjoTwEWtwHWBS7aCpXw SjNdLGEXufX6r+yXh0jZStBA9n1OvWOwFXcZoAR0SQy8wHeVJNOJNwS1ClMKI1bM e2UgcET2vR0gwrTGbn+TX5VDeiDirzhc05ofRa5QkzGjSpo0oPVitFx2/8BRodUP l1skPUB3gctnMLIbpapBV9NRlUX/2KjAkdIP0/loPAf0z2Op4pV4OoRftq7SI5cZ Yc756OoBaWB4pc9jwQAZQsp3DRLEBdujOuHWNKBfvI7cXbU9IEGGP4U5u8wxv29v oF8P46BfxAVfdsckNRo+wSccLu5bALBxzE4eI05xkTE4SfY05GMFRNYfUTsz3Q3w ZwGr2Omr3AEtfIE4i88KGja5715jaaqXOVEQbYTaSL/RMLBi+JssJwa6PxBhdxZm YCBJi2ZCwVMdyDY3LE2LfwIsUj5G1cnIG+oRdOsHSzZcfJ+Qy5e7xIbhsWROhMO0 8h+1LtrGqKnKusy+PgRIGSgRhILEPgm82g4tgD0a5iXWcML9ByPSxdR1DoQ3zKIL Y2O7VW7pT1W6PQSflldJVrdQYo970Yz4slKKh921uyDzTBu32OaRdOIAfsXq9732 85pHdix1cbmsXL/OFYDW9i3MsgEI81AWwQAYa4LL0gO5uBXXfEAL0aFu1OgaP4U9 g61FnxCyTHvrFSLcfTN3nB7acGa4ON+2zHT0SzZ+luhRNWEz8uJzQlmQhAVYHYtp TAhcL2lsWq4ghFew9+9jVuF1fzBqrcciTzLs4k/K9oIZ7vF+DDMDp8kgt4oz2bYe sPzQzi7oAauOETVplDvVsIJY9fj6oX5vq09pCm1hLV47Y2yFyvs= !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!
URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Targets

    • Target

      revil.bin

    • Size

      119KB

    • MD5

      a4331ff805b0a8f2a2892777c224b65e

    • SHA1

      2c5521077dd1a6f5f3558351370880aee9ab7c71

    • SHA256

      329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483

    • SHA512

      786a6ffdd7206b0f11dd45921826e3685fe4b64b82b4fa26702a30dcb762d4310b3b55683a8c510175ed6a9086125156e676caa3220597f8ed7298f6cdc51799

    • SSDEEP

      3072:KW5yc3Y4SMQwuOekD96R928A2fFM+/uSxo+HHz/bs/k4OS:K83Y5BAxa92c1rxTnz/Y/k4O

    Score
    10/10
    sodinokibi$2b$13$wz1rerfdlg.aistldqg5jeqqysemspatwkhdwbpwvrc3ty7akscg658ransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks