Threat Thursday: Dr. REvil Ransomware Strikes Again, Employs Double Extortion Tactics

Summary

The FBI has named the Russia-affiliated Ransomware-as-a-Service (RaaS) group REvil (also known as Sodin or Sodinokibi) as the culprits behind attacks on the world’s largest meat supplier, JBS. These attacks threatened the global food supply chain and serve as a reminder of the vulnerable state of critical infrastructure worldwide.

Given the success of the REvil attacks and other similar malware, it is crucial for organizations to learn how to prevent ransomware threats. This blog offers a brief overview of how REvil operates and offers effective solutions for stopping these kinds of attacks in the future.

The malware acts as a Ransomware-as-a-Service (RaaS) and became prolific after another RaaS group, GandCrab, shut down their operations. Security researchers have identified many similarities and code reuse between REvil and GandCrab. REvil was first advertised on Russian language cybercrime forums and is associated with the threat actor “Unknown” or “UNKN”.

REvil is most famously associated with recent attacks on Travelex, Acer, and Apple supplier Quanta Computer. Acting as a RaaS, REvil relies on affiliates or partners to perform its attacks. The REvil developers receive a percentage of all proceeds from ransom payments. Because the ransomware is distributed by different entities, the initial infection vector can vary; typically, this is either via phishing campaigns, brute force attacks to compromise RDP, or through software vulnerabilities. REvil is also known to be distributed by other malware such as IcedID.

Read our previous deep dive on Sodinokibi.

Operating System

Risk and Impact

Technical Analysis

REvil stores its configuration as an encoded resource. The first 32 bytes are the key used to decode the configuration, which is contained in the remaining bytes:

Figure 1: REvil’s key is contained in the first 32 bytes.

Initially, REvil will fingerprint the target machine and gather system information. Before beginning the encryption routine, REvil will kill certain processes such as email clients, SQL or other database servers, browsers and Microsoft® Office applications to ensure it can encrypt important files belonging to the victim. It will also remove shadow copies to prevent easy recovery.

For persistence, the ransomware creates a registry key to execute with Windows startup under:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aDTFUAIa7j :

Figure 2: Registry key created.

The sample analyzed also creates registry entries under HKLM\BlackLivesMatter\ containing hex values:

Figure 3: Hex values.

The malware creates a mutex: "Global\8C39F091-3A8D-46F4-DBC5-DDA17B3C63C2", to ensure it is the only running instance. If another instance is executed, it will prompt an error message:

Figure 4: REvil error message.

REvil will enumerate files on the system and during the encryption process appends a random alpha numeric extension between 5 and 10 characters in length, E.G.: “.oh24o8”.

A ransom note, with the same alpha-numeric name as that used for the file extensions, followed by “readme.txt”, is dropped in all affected directories, E.G.: “oh24o8-readme.txt”:

Figure 5: REVil ransom note text file.

Screenshot of the ransom note belonging to REvil:

Figure 6: REvil ransom note.

For file encryption, REvil uses curve25519/Salsa20; key encryption utilizes curve25519/AES-256-CTR. The developers of REvil pride themselves as having created the best data encryption and decryption system currently available.

A custom .bmp image is dropped to the %Temp% directory and this is set as the desktop wallpaper via a registry setting. The wallpaper image informs the user that their files have been encrypted:

Figure 7: REvil wallpaper ransom note.

To pay the ransom, two URLs are provided, one accessible with the TOR browser and a secondary site which can be used if TOR is blocked in the user’s location:

Figure 8: REvil URL for key input.

The ransom note provides the key to enter after navigating to either website. The ransom can be paid in either Monero or Bitcoin, although if the user chooses to pay in Bitcoin, this increases the cost by 10%:

Figure 9: REvil warning re. price increase.

REvil also benefits from employing the effective tactic of double extortion. To encourage the victim to pay the ransom in a timely manner, the attacker threatens to publicly disclose or sell confidential stolen information on the dark web:

Figure 10: REvil double extortion tactics.

The following Yara rule was authored by the BlackBerry Threat Research Team to catch the threat described in this document:

Yara Rule:

Indicators of Compromise (IoCs):