McAfee Sodinokibi October 2019

REvil can save encryption parameters and system information in the Registry.

REvil has used encrypted strings and configuration files.

REvil can identify the domain membership of a compromised host.

REvil has used HTTP and HTTPS in communication with C2.

REvil can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.

REvil has the ability to identify specific files and directories that are not to be encrypted.

REvil can download a copy of itself from an attacker controlled IP address to the victim machine.

REvil can modify the Registry to save encryption parameters and system information.

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

REvil can decode encrypted strings to enable execution of commands and payloads.

REvil has infected victim machines through compromised websites and exploit kits.

REvil has the capability to destroy files and folders.

REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.

REvil has been distributed via malicious e-mail attachments including MS Word Documents.

REvil can identify system drive information on a compromised host.