General
-
Target
revil-fixed.exe
-
Size
126KB
-
Sample
250328-16vtzasvgt
-
MD5
329b8aaea517a511908683b56446db99
-
SHA1
9abe20a9c460a3e530cb96658541c6d25700a529
-
SHA256
c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20
-
SHA512
172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa
-
SSDEEP
1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA
Behavioral task
behavioral1
Sample
revil-fixed.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\Program Files (x86)\yfq6y-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08DCD1C616F5D272
http://decoder.re/08DCD1C616F5D272
Targets
-
-
Target
revil-fixed.exe
-
Size
126KB
-
MD5
329b8aaea517a511908683b56446db99
-
SHA1
9abe20a9c460a3e530cb96658541c6d25700a529
-
SHA256
c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20
-
SHA512
172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa
-
SSDEEP
1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA
-
Modifies Windows Firewall
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1