Overview

overview

10

Static

static

10

Revil_1.1c

ubuntu-22.04-amd64

10

Revil_1.1d

ubuntu-18.04-amd64

10

Revil_1.2a

ubuntu-20.04-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1daf37cf37b5bf55d847618b55a6b60c098d0091c10be5f12c5b54f8595457e

  • Size

    96KB

  • Sample

    240701-ctys4awgqq

  • MD5

    d1294072b23e8c394b2c1abebc42550c

  • SHA1

    efc45422a95e29c8d4fac74dc8770847ecb48e8a

  • SHA256

    e1daf37cf37b5bf55d847618b55a6b60c098d0091c10be5f12c5b54f8595457e

  • SHA512

    4b772d03e88a14dd0f9ea601d489096e7bd0cf704d7cca87592cc1db071f08496f89070dfb5e832942b1cb41c3c5402b6fb33488db17359f4bacb3aaf9317c02

  • SSDEEP

    1536:QwH1/1IVJ+5p5FBzshdhL4ElaDTZIdbjfhMYH+qKcZxiODlu3Ymd6yCMyxw3k:nH1ysB4hbLp+TZId3fhMsiOBuH6QU

Score
10/10
sodinokibilinuxransomware

Malware Config

Extracted

Path

/tmp/.X11-unix/rhkrc-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension rhkrc. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC710450EC710450 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/EC710450EC710450 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FQZbwljq7Beb47OGRzi5h3Lba4BMbV/jW5pa/8lW36gGgFGdXoTY+jC4MS4wRR/60kpkzIYJjj9cl1yAM6bd542Jw+Ukg/KvKIL7DMlAQwPqMU3kt5UfJXrz2jSjP+I3tUhYZACYMPJnhn3e73zYlYN9NHx3uk7t4CmerNCCP+RMyI/jGrn4pepnijveOPfRldpUHkwuQ9dwCyp/W2vO5Vr9vnXvojz7Qny5idzNpnn197Igf2zoZXCXbRl7GAGrRWC38k9h5KkwN/wU6ZfP0bNxCzF+dkyOZHiy0zdVPEYkWPKb0hFtCG6RrhqyoVAmQFben47Jd7UbQCe7QRhFmzyAoEAaefZs1xrzX/FAEweefnX8PtSrWKtT2GqoCoWAlCLoVYEHqCecaDwk4sWugs1v62iINLaLgVDXIHpn/HD1q8r7UIaTZ7kSFb7nLrDCJDHcuYU6bpxa2KoZv0EnbDGSi4rEDnfbL9ijwlKf1JPqwePHq89zgLK1Sa8W ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC710450EC710450

http://decoder.re/EC710450EC710450

Extracted

Path

/tmp/ssh-u65xuxWJtjA0/rhkrc-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension rhkrc. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/701F1C86701F1C86 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/701F1C86701F1C86 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Myw5uWYUW21UKxqcMO2C+QCIOqx8CijJCpGwLKWkqJbEF/8dlr9LfVM3tqAHPrZWFf9DT6xibk2Lul9/EhEGy9vnbl6jShar0pkk6LHWZirk4ZzWUYHX7sbDei4U97Jb8smd1ENv+/QCFNJFIF+MW/kx75yot8QPEWc7AvBWQ1emzWJ6xH4NBFj80SqVtv5xljM7tWU3m7CODgG5B5Xuiwkc2A1a7uxRVcRF9DvHNTYiOWfBwQJhD3lvytqCB9BqxtbutOcLQlXi6W822wICavjYQ21n4zAqVXgu6yAR0lwnDw0Y++kyRDh6ygu57p8zyuJjZFDEdJEIRRX/+I9WvZUk01mS3ZibOf3tjU4xgxbBKfmvjh6//TBC2Eyjy0IjkjBuveLOBZdv0IJhdmoeQb7/dbKRCICYVyW2iiqARyZXprQSjU333Q/ceyHrW9pHNedBIfIxpkf1qbCQ0DMJ2K9ZtGwGHQNVfntjy8B3Ic0R1+YQZqPE9t3tZr5x ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/701F1C86701F1C86

http://decoder.re/701F1C86701F1C86

Targets

    • Target

      Revil_1.1c

    • Size

      102KB

    • MD5

      707009f5555115354ccb5a3b759e7a69

    • SHA1

      40d8a0b3970ce4ccb2ec2b165c5253708ee928ca

    • SHA256

      11fd806cd4c320bca9dc958b2dac04e43691242421db878f266a9a5b09e12240

    • SHA512

      fd1d419377dfddc15c4dbf3c493e7dee33d8b4fef5cc510694f8f4bb263953f08d8464a6bcabbeb367b048e9a8237eb6191751a9e83ecd9ea3eabb780bc60ac7

    • SSDEEP

      3072:db+XoBHfYu9gggwgggwgggwgggwgggfk+LoS:dpkvo

    Score
    10/10
    ransomware

    • Manipulates ESXi

      Manipulates ESXi.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

    • Target

      Revil_1.1d

    • Size

      102KB

    • MD5

      73041d7b9a93d3cda76e2a052ac02e82

    • SHA1

      f995852f291e2c946e15d20d020bb8e8defd317f

    • SHA256

      776ea636ee33aab6b2db5f46889b027c297280db37400efb091e0d4a9001a7d7

    • SHA512

      6f430874949362bf2d9d29153c0f9d0e5c53ea7bf69a44cf14c2627981d87ff0ad45fb12c26223dc33ceebf57b6113db37e347b2b4b2fa7ac037a63edc209371

    • SSDEEP

      3072:db+XoBHfYu9gggwgggwgggwgggwggg2k+LoS:dphvo

    Score
    10/10
    ransomware

    • Manipulates ESXi

      Manipulates ESXi.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral2

    • Target

      Revil_1.2a

    • Size

      106KB

    • MD5

      3801a926ee836b6907d2d13723693d2d

    • SHA1

      cdf39434bb78871e839312e600b6fe40dc782a1f

    • SHA256

      d42bcb0fca6d93ce4c9a78e5393f7e5949c7398ac598f7c55b76120739eac544

    • SHA512

      ec312353aa521e39be7f86fe350daf663f793b3ca43d5223cb0acf091ea45f2770125a62c73ec1dec52666c3b3048ea355522347773a894a14840a19f8b762bc

    • SSDEEP

      3072:LQ7b+XdBHttsNgggwgggwgggwgggwgggYSYVP:mZFlVP

    Score
    1/10
    behavioral3

MITRE ATT&CK Enterprise v15

Tasks