Overview

overview

10

Static

static

10

Revil_1.1c

ubuntu-22.04-amd64

10

Revil_1.1d

ubuntu-18.04-amd64

10

Revil_1.2a

ubuntu-20.04-amd64

1

Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240522.1-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    01-07-2024 02:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Revil_1.1c

  • Size

    102KB

  • MD5

    707009f5555115354ccb5a3b759e7a69

  • SHA1

    40d8a0b3970ce4ccb2ec2b165c5253708ee928ca

  • SHA256

    11fd806cd4c320bca9dc958b2dac04e43691242421db878f266a9a5b09e12240

  • SHA512

    fd1d419377dfddc15c4dbf3c493e7dee33d8b4fef5cc510694f8f4bb263953f08d8464a6bcabbeb367b048e9a8237eb6191751a9e83ecd9ea3eabb780bc60ac7

  • SSDEEP

    3072:db+XoBHfYu9gggwgggwgggwgggwgggfk+LoS:dpkvo

Score
10/10
ransomware

Malware Config

Extracted

Path

/tmp/.X11-unix/rhkrc-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension rhkrc. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC710450EC710450 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/EC710450EC710450 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FQZbwljq7Beb47OGRzi5h3Lba4BMbV/jW5pa/8lW36gGgFGdXoTY+jC4MS4wRR/60kpkzIYJjj9cl1yAM6bd542Jw+Ukg/KvKIL7DMlAQwPqMU3kt5UfJXrz2jSjP+I3tUhYZACYMPJnhn3e73zYlYN9NHx3uk7t4CmerNCCP+RMyI/jGrn4pepnijveOPfRldpUHkwuQ9dwCyp/W2vO5Vr9vnXvojz7Qny5idzNpnn197Igf2zoZXCXbRl7GAGrRWC38k9h5KkwN/wU6ZfP0bNxCzF+dkyOZHiy0zdVPEYkWPKb0hFtCG6RrhqyoVAmQFben47Jd7UbQCe7QRhFmzyAoEAaefZs1xrzX/FAEweefnX8PtSrWKtT2GqoCoWAlCLoVYEHqCecaDwk4sWugs1v62iINLaLgVDXIHpn/HD1q8r7UIaTZ7kSFb7nLrDCJDHcuYU6bpxa2KoZv0EnbDGSi4rEDnfbL9ijwlKf1JPqwePHq89zgLK1Sa8W ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC710450EC710450

http://decoder.re/EC710450EC710450

Signatures

  • Manipulates ESXi 2 IoCs

    Manipulates ESXi.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 29 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/Revil_1.1c
    /tmp/Revil_1.1c
    1⤵
    • Writes file to tmp directory
    PID:1563
    • /bin/sh
      sh -c "uname -a && echo \" | \" && hostname"
      2⤵
        PID:1564
        • /usr/bin/uname
          uname -a
          3⤵
            PID:1565
          • /usr/bin/hostname
            hostname
            3⤵
              PID:1566
          • /bin/sh
            sh -c "uname -a && echo \" | \" && hostname"
            2⤵
              PID:1567
              • /usr/bin/uname
                uname -a
                3⤵
                  PID:1568
                • /usr/bin/hostname
                  hostname
                  3⤵
                    PID:1569
                • /bin/sh
                  sh -c "pkill -9 vmx-*"
                  2⤵
                    PID:1570
                    • /usr/bin/pkill
                      pkill -9 "vmx-*"
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:1571
                  • /bin/sh
                    sh -c "esxcli --formatter=csv --format-param=fields==\"WorldID,DisplayName\" vm process list | awk -F \"\\\"*,\\\"*\" '{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}'"
                    2⤵
                    • Manipulates ESXi
                    PID:1572
                    • /usr/bin/awk
                      awk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"
                      3⤵
                      • Manipulates ESXi
                      • Reads runtime system information
                      PID:1574

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /tmp/.X11-unix/rhkrc-readme.txt
                  Filesize

                  2KB

                  MD5

                  87e8fa8d7c790ba7503710a52265a889

                  SHA1

                  0a79b884e65d6a48e3dac92d2c14884a416fce42

                  SHA256

                  9d2b629577ef6017a5be74e6696356a73f4e47ff98a6fec4d1df8473abb16a1c

                  SHA512

                  0f8d7c3ea93cfd1f5b976b44fc692bc49fbca7e14d8653fb05e6acf03a7207a642e6b673aaf0838496f90ebc19853180785b1c828eb683e3011f976d753f69b7

                  Download Submit