Experts Analyzed a New Sample of Malware and Confirmed the REvil Return

Against the background of growing tensions between Russia and the United States, experts analysed samples of the new malware and confirmed the return of REvil cybercriminals with a new ransomware.

After the start of Russia’s invasion of Ukraine, REvil’s TOR sites began to revive, but they did not have the old information, they redirected visitors to the URLs of a new, unnamed ransomware hacker group.

While these sites were not like previous REvil sites, the fact that the old infrastructure was redirecting to new URLs points to the return of grouping. எனினும், in November, messages “REvil is bad” began to appear on the group’s websites. Such access to hacker sites spoke of the actions of law enforcement agencies or cybercriminals, so the revived pages of REvil cannot serve as a strong evidence of the return of the gang.

Jakub Krustek
Jakub Krustek

The only way to know for sure if REvil was back was to find a sample ransomware and analyse it to determine if it was patched or developed from the source code. The right sample of the new ransomware was discovered this week by AVAST researcher Jakub Krustek. Analysis of the sample confirmed the connection of the unnamed group with REvil.

According to analysts, the discovered sample of the virus was compiled from the REvil source code, and also contains fresh changes. Security researcher R3MRUM tweeted that the sample’s version number has been changed to 1.0, but it is a continuation of the latest version, 2.08, released by REvil before it was destroyed.

A few hours ago, we blocked a #ransomware sample in-the-wild that looks like a new #Sodinokibi / #REvil variant. Timestamp 2022-04-27, new config, new mutex, campaign ID, முதலியன. Funny thingit does not encrypt files; only adds a random extension.Jakub Kroustek reported

The specialist could not explain why the virus does not encrypt files, but believes that it was compiled from source code.

Experts confirm the return of REvil
Version change in the new REvil encoder

Advanced Intel CEO Vitaly Kremez also examined the sample and confirmed that it was compiled from source on April 26th. According to him, the new REvil sample includes a new ‘accsconfiguration field containing the credentials of the attacked victim.

Kremez believes the ‘accsconfiguration option is used to prevent encryption on other devices that don’t contain the right Windows accounts and domains, allowing targeted attacks.

In addition to theaccsparameter, the SUB and PID parameters used as Campaign and Branch IDs have been changed in the configuration of the new REvil sample to use longer GUID type values such as “3c852cc8-b7f1-436e-ba3b-c53b7fc6c0e4”.

BleepingComputer also tested a ransomware sample and it created a ransom note that is identical to the old REvil ransom warnings.

Experts confirm the return of REvil
REvil ransom note

The new group calls themselvesSodinokibi“, however the new site is almost identical to the old Revil site.

Experts confirm the return of REvil

Not surprisingly, REvil has changed its name as part of the new operation, especially due to the worsening relations between the US and Russia.

When ransomware operations are rebranded, they are usually renamed to bypass law enforcement or sanctions that prevent payment of a ransom. Therefore, it is unusual for REvil to publicly announce its return rather than try to avoid detection, as we have seen in many other ransomware rebrands.

ஹெல்கா ஸ்மித்

நான் எப்போதும் கணினி அறிவியலில் ஆர்வமாக இருந்தேன், குறிப்பாக தரவு பாதுகாப்பு மற்றும் தீம், இது இன்று அழைக்கப்படுகிறது "தரவு அறிவியல்", என் இளமை பருவத்தில் இருந்து. வைரஸ் அகற்றும் குழுவில் தலைமை ஆசிரியராக வருவதற்கு முன், நான் பல நிறுவனங்களில் சைபர் பாதுகாப்பு நிபுணராக பணிபுரிந்தேன், அமேசான் ஒப்பந்ததாரர்களில் ஒருவர் உட்பட. இன்னொரு அனுபவம்: எனக்கு Arden மற்றும் Reading பல்கலைக்கழகங்களில் கற்பித்தல் உள்ளது.

ஒரு பதிலை விடுங்கள்

ஸ்பேமைக் குறைக்க இந்தத் தளம் Akismet ஐப் பயன்படுத்துகிறது. உங்கள் கருத்துத் தரவு எவ்வாறு செயலாக்கப்படுகிறது என்பதை அறிக.

மேலே பொத்தானுக்குத் திரும்பு