REvil - Deep Static Analysis (93ce973d)

Hash	Deger
SHA256	93ce973daa9687f185966b3133f7003006655ec9d5bf3edb881efaf0e4fbafc7
MD5	be059dd5f3442f498bde97f69265ccbd
Boyut	4684288 bytes

REvil C2

C2: www.mendeley.com, service.elsevier.com, support.mendeley.com, p.yusukekamiyamane.com

Port: 443

Tehdit Degerlendirmesi

REvil: C2: www.mendeley.com, service.elsevier.com, support.mendeley.com, p.yusukekamiyamane.com, citationstyles.org, plasma.kde.org, www.zotero.org, rrchnm.org, www.gmu.edu, www.elsevier.com, www.elsevier.com, citationstyles.org, csl.mendeley.com, creativecommons.org, www.mendeley.com, www.mendeley.com, www.elsevier.com, www.elsevier.com, service.elsevier.com, service.elsevier.com, mendeley.com, www.mendeley.com, www.mendeley.com, www.sysinternals.com, rna-pdf-resource.acrobat.com, www.sysinternals.com, cutter.re, cutter.re, www.sysinternals.com, service.elsevier.com, service.elsevier.com, www.sysinternals.com, www.virustotal.com, www.virustotal.com, www.virustotal.com, www.virustotal.com, www.virustotal.com, www.sysinternals.com, www.sysinternals.com, msmip.reader.com, www.googleapis.com, www.googleapis.com, www.googleapis.com, www.googleapis.com, ims-na1-stg1.adobelogin.com, ims-na1.adobelogin.com, ims-na1.adobelogin.com, login.live.com, login.live.com, app.box.com, www.sysinternals.com, www.sysinternals.com, msmip.reader.com, www.googleapis.com, www.googleapis.com, www.googleapis.com, www.googleapis.com, ims-na1-stg1.adobelogin.com, ims-na1.adobelogin.com, ims-na1.adobelogin.com, login.live.com, login.live.com, app.box.com, ims-na1.adobelogin.com, java.com. KEYDAL kSentinel.

REvil — Malware Profile

REvil/Sodinokibi ransomware. nboehret developer. SP-API project. siliconplains.net C2. Downloader v1.4.

Malware Type

Ransomware

Programming Language

C2 Protocol

HTTP

Target Systems

Windows

Also Known As (AKA)

Sodinokibi

Technical Details

REvil (Sodinokibi) is a ransomware-as-a-service operated by GOLD SOUTHFIELD. First detected April 2019, believed successor to GandCrab. Uses elliptic curve Diffie-Hellman (ECDH) + Salsa20 for file encryption, RSA-2048 for key exchange. Highly customizable through embedded JSON configuration: target paths, excluded countries/extensions. Notable attacks: Kaseya VSA supply chain attack (July 2021, 1500+ MSPs affected), JBS Foods ($11M ransom), Travelex ($6M ransom). Double extortion via "Happy Blog" leak site. Source code leaked 2021. FSB arrested key members January 2022. Operations resumed briefly with "REvil is back" announcements.

Attribution / Threat Actor

GOLD SOUTHFIELD, GandCrab successor

Capabilities & Behavior

Dosya Şifreleme (AES/RSA)

Gölge Kopya Silme

Yedek Kaldırma

Fidye Notu Oluşturma

Kalıcılık Sağlama

Ağ Paylaşımı Şifreleme

Anti-Analiz Teknikleri

Çift Gasp (Data Leak)

IOC List (3 indicators)

IOC — REvil

# SHA256
93ce973daa9687f185966b3133f7003006655ec9d5bf3edb881efaf0e4fbafc7 

# MD5
be059dd5f3442f498bde97f69265ccbd 

# DOMAIN
p.yusukekamiyamane.com

Type	Value	Note
sha256	93ce973daa9687f185966b3133f7003006655ec9d5bf3edb881efaf0e4fbafc7	REvil
md5	be059dd5f3442f498bde97f69265ccbd	REvil
domain	p.yusukekamiyamane.com	REvil

REvil — Go to Full Profile →