Revil

How Revil typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via REvil.

1. T1189 Drive-by Compromise Initial Access

   What they do: REvil has infected victim machines through compromised websites and exploit kits.

   What that means: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

2. T1566.001 Spearphishing Attachment Initial Access

   What they do: REvil has been distributed via malicious e-mail attachments including MS Word Documents.

   What that means: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

3. T1047 Windows Management Instrumentation Execution

   What they do: REvil can use WMI to monitor for and kill specific processes listed in its configuration file.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

4. T1059.001 PowerShell Execution

   What they do: REvil has used PowerShell to delete volume shadow copies and download files.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

5. T1059.003 Windows Command Shell Execution

   What they do: REvil can use the Windows command line to delete volume shadow copies and disable recovery.

   What that means: Adversaries may abuse the Windows command shell for execution.

6. T1059.005 Visual Basic Execution

   What they do: REvil has used obfuscated VBA macros for execution.

   What that means: Adversaries may abuse Visual Basic (VB) for execution.

7. T1106 Native API Execution

   What they do: REvil can use Native API for execution and to retrieve active services.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

8. T1204.002 Malicious File Execution

   What they do: REvil has been executed via malicious MS Word e-mail attachments.

   What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.

9. T1112 Modify Registry PersistenceDefense Impairment

   What they do: REvil can modify the Registry to save encryption parameters and system information.

   What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

10. T1055 Process Injection Privilege EscalationStealth

    What they do: REvil can inject itself into running processes on a compromised host.

    What that means: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

11. T1134.001 Token Impersonation/Theft Privilege EscalationStealth

    What they do: REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

    What that means: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.

12. T1134.002 Create Process with Token Privilege EscalationStealth

    What they do: REvil can launch an instance of itself with administrative rights using runas.

    What that means: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls.

13. T1027.011 Fileless Storage Stealth

    What they do: REvil can save encryption parameters and system information in the Registry.

    What that means: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses.

14. T1027.013 Encrypted/Encoded File Stealth

    What they do: REvil has used encrypted strings and configuration files.

    What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

15. T1036.005 Match Legitimate Resource Name or Location Stealth

    What they do: REvil can mimic the names of known executables.

    What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

16. T1070.004 File Deletion Stealth

    What they do: REvil can mark its binary code for deletion after reboot.

    What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

17. T1140 Deobfuscate/Decode Files or Information Stealth

    What they do: REvil can decode encrypted strings to enable execution of commands and payloads.

    What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

18. T1480.002 Mutual Exclusion Stealth

    What they do: REvil attempts to create a mutex using a hard-coded value to ensure that no other instances of itself are running on the host.

    What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

19. T1685 Disable or Modify Tools Defense Impairment

    What they do: REvil can connect to and disable the Symantec server on the victim's network.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

20. T1688 Safe Mode Boot Defense Impairment

    What they do: REvil can force a reboot in safe mode with networking.

    What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.

21. T1007 System Service Discovery Discovery

    What they do: REvil can enumerate active services.

    What that means: Adversaries may try to gather information about registered local system services.

22. T1012 Query Registry Discovery

    What they do: REvil can query the Registry to get random file extensions to append to encrypted files.

    What that means: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

23. T1069.002 Domain Groups Discovery

    What they do: REvil can identify the domain membership of a compromised host.

    What that means: Adversaries may attempt to find domain-level groups and permission settings.

24. T1082 System Information Discovery Discovery

    What they do: REvil can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

25. T1083 File and Directory Discovery Discovery

    What they do: REvil has the ability to identify specific files and directories that are not to be encrypted.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

26. T1614.001 System Language Discovery Discovery

    What they do: REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage.

    What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

27. T1680 Local Storage Discovery Discovery

    What they do: REvil can identify system drive information on a compromised host.

    What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

28. T1071.001 Web Protocols Command and Control

    What they do: REvil has used HTTP and HTTPS in communication with C2.

    What that means: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

29. T1105 Ingress Tool Transfer Command and Control

    What they do: REvil can download a copy of itself from an attacker controlled IP address to the victim machine.

    What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.

30. T1573.002 Asymmetric Cryptography Command and Control

    What they do: REvil has encrypted C2 communications with the ECIES algorithm.

    What that means: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

31. T1041 Exfiltration Over C2 Channel Exfiltration

    What they do: REvil can exfiltrate host and malware information to C2 servers.

    What that means: Adversaries may steal data by exfiltrating it over an existing command and control channel.

32. T1485 Data Destruction Impact

    What they do: REvil has the capability to destroy files and folders.

    What that means: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

33. T1486 Data Encrypted for Impact Impact

    What they do: REvil can encrypt files on victim systems and demands a ransom to decrypt the files.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

34. T1489 Service Stop Impact

    What they do: REvil has the capability to stop services and kill processes.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

35. T1490 Inhibit System Recovery Impact

    What they do: REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Software Revil has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

The note this group leaves on a compromised machine. Click a filename to read it.

---=== Welcome. Again. ===---

We strongly encourage You to pay your attention to this message and read it to the end.

All Your files are encrypted, and currently unavailable, now all files on your system has extension {EXT} 
Before that, all of your most important personal and business
 files were backed up to our secure offline storage. 
We took them for temporary storage - but we don't need your 
files and we are not personally interested in your business.

Our encryption algorithm is the most technically difficult and max resistant to burglary. 
Only OUR specialists can decrypted your files without loss(!) 
Any attempts to decrypt files on your own lead to damage them beyond repair(!)

Best way to you will be consent to negotiations and mutual agreement between us. 
To connect us you need to download TOR browser and follow the link to begin 
negotiations.(You can find full instructions below.) 
We are waiting You and ready to listen all 
your offers and discuss them.

If You will ignore this letter - we will have to sell 
closed auction all yours private files, photoes, business correspondence, 
documents and business files + with our analysis of your work 
activity (weakness of your business, financial violations and the opportunity 
to profit from this information). It will offset our financial losses.

Or we'll just put all your files in the public domain, where everyone can download 
and use them as they wish. 
* For TOR Browser 
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

We are known as "Sodinokibi (REvil) Ransomware". For example, this article:
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
You have a guarantee that your files will be returned 100 %.
And remember, this is only business, nothing personal..
We have a concept of business honor, and we can promise something if we come to a mutual agreement:
1. We guarantee to decrypt all your files in the shortest possible time
2. We will delete all your files and forget about your company.
3. We will show your weaknesses in your networks.


.-= INSTRUCTIONS TO CONNECT =-.

How to get access on website?

You have two ways:

1) [Recommended] Using a TOR browser!
  a) Download and install TOR browser from this site: https://torproject.org/
  b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}

2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
  a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
  b) Open our secondary website: http://decoder.re/{UID}

Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:


[snip]


----------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, 
DONT use any third party software for restoring your data or antivirus solutions - 
its may entail damge of the private key and, as result, The Loss all your data!

---=== Welcome. Again. ===---
>> Whats Happen
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension lgzcfcr.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
>> What guarantees
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.
>> Sensitive Data
Sensitive data on your network was DOWNLOADED.
If you DON'T WANT your sensitive data to be PUBLISHED in our blog - you have to act quickly.
You should check our blog, using Tor Browser, your data could already be published
http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion
Data includes:
- Employees personal data.
- Complete network map including credentials for local and remote services.
- Private financial information including: clients data, bills, budgets, annual reports, bank statements.
- Manufacturing documents including: datagrams, schemas, drawings in solidworks format
- And more...
>> How to get access to the website
Using a TOR browser
1) Download and install TOR browser from this site: https://torproject.org/
2) Open our website: http://landxxeaf2hoyl2jvcwuazypt6imcsbmhb7kx3x33yhparvtmkatpaad.onion
3) When you open our website, put the following data in the input form:
[snip]
-----------------------------------------------------------------------------------------
DANGER
DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data.
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.

---=== Welcome. Again. ===---

[+] Whats Happen? [+]

Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).

[+] What guarantees? [+]

Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.

[+] How to get access on website? [+]

You have two ways:

1) [Recommended] Using a TOR browser!
  a) Download and install TOR browser from this site: https://torproject.org/
  b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}

2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
  a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
  b) Open our secondary website: http://decryptor.cc/{UID}

Warning: secondary website can be blocked, thats why first variant much better and more available.

When you open our website, put the following data in the input form:
Key:


[snip]


-----------------------------------------------------------------------------------------

!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!

Ransom-note text from RansomLook, licensed CC BY 4.0.