Procedure examples

REvil can enumerate active services.

REvil can query the Registry to get random file extensions to append to encrypted files.

REvil can save encryption parameters and system information in the Registry.

REvil has used encrypted strings and configuration files.

REvil can mimic the names of known executables.

REvil can exfiltrate host and malware information to C2 servers.

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.

REvil can inject itself into running processes on a compromised host.

REvil has used PowerShell to delete volume shadow copies and download files.

REvil can use the Windows command line to delete volume shadow copies and disable recovery.

REvil has used obfuscated VBA macros for execution.

REvil can identify the domain membership of a compromised host.

REvil can mark its binary code for deletion after reboot.

REvil has used HTTP and HTTPS in communication with C2.

REvil can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.

REvil has the ability to identify specific files and directories that are not to be encrypted.

REvil can download a copy of itself from an attacker controlled IP address to the victim machine.

REvil can use Native API for execution and to retrieve active services.

REvil can modify the Registry to save encryption parameters and system information.

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

REvil can launch an instance of itself with administrative rights using runas.

REvil can decode encrypted strings to enable execution of commands and payloads.

REvil has infected victim machines through compromised websites and exploit kits.

REvil has been executed via malicious MS Word e-mail attachments.

REvil attempts to create a mutex using a hard-coded value to ensure that no other instances of itself are running on the host.

REvil has the capability to destroy files and folders.

REvil can encrypt files on victim systems and demands a ransom to decrypt the files.

REvil has the capability to stop services and kill processes.

REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.

REvil has been distributed via malicious e-mail attachments including MS Word Documents.

REvil has encrypted C2 communications with the ECIES algorithm.

REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage. If the language is found in the list, the process terminates.

REvil can identify system drive information on a compromised host.

REvil can connect to and disable the Symantec server on the victim's network.

REvil can force a reboot in safe mode with networking.