Summary

The REvil ransomware (a.k.a Sodinokibi) is a threat group that operates in the RaaS (Ransomware-as-a-Service) model, where the infrastructure and the malware are supplied to affiliates, who use the malware to infect target organizations. On July 2, the REvil threat group launched a supply chain ransomware attack using an exploit in Kaseya’s VSA remote management software. REvil claims to have infected more than one million individual devices around the world. The attackers demanded $45,000 USD to restore the files from a single infected device, or $70 million USD paid in BTC for a universal decrypter that will allegedly work for all of the victims of the Kaseya attack. This threat is targeting anyone with Kaseya’s VSA Remote Management Platform agent installed on Microsoft Windows systems (any version).

Threat 

The REvil group has likely used a zero-day exploit against Kaseya’s management server, allowing the attackers to deploy the malware remotely on Windows devices running the VSA agent application. The first step executed by the group was to deploy a base64-encoded file to Kaseya’s working directory, which was probably ignored by anti-virus engines as recommended by Kaseya.

Once the encoded file (agent.crt) was deployed, the attacker executed a set of shell commands remotely to decode and execute the payload, as well as to disable the Windows Defender protections. The decoded file (agent.exe) is a malware dropper that writes to disk two different files:

  1. MsMpEng.exe: This is an outdated version of Microsoft’s Antimalware Service that is vulnerable to a technique known as DLL Hijacking.
  2. mpsvc.dll: This is the packed REvil payload, which is loaded by MsMpEng.exe through the DLL Hijacking technique.
umair-akbar-threat coverage revil  - REvil Ransomware: Mechanism of Action
revil ransomware: mechanism of action

Once executed, the REvil packed sample loads and executes a small shellcode, which is responsible for unpacking and executing the final payload, which contains an encrypted configuration within the binary.

umair-akbar-threat coverage revil 1 1 - REvil Ransomware: Mechanism of Action
revil ransomware: mechanism of action

The data is encrypted with RC4, so we can use a small Python script to decrypt it:

umair-akbar-threat coverage revil 1 2 - REvil Ransomware: Mechanism of Action
revil ransomware: mechanism of action

After decrypting the configuration, we can obtain more detailed information about the sample, such as the “affiliate” ID, ignored folders, C2 domains, etc.

umair-akbar-threat coverage revil 1 3 - REvil Ransomware: Mechanism of Action
revil ransomware: mechanism of action

In this case, the “net” option is set to “false” in the configuration, which tells the ransomware to ignore the C2 addresses. However, in case this option is set to “true,” the malware sends a POST request to available addresses with information about the infected machine, such as the encryption key and the machine name.

umair-akbar-threat coverage revil 1 4 - REvil Ransomware: Mechanism of Action
revil ransomware: mechanism of action

Within this REvil configuration, we have found 1,221 unique domains that could be used for network communication.

After encrypting the files, REvil changes the user’s background:

umair-akbar-threat coverage revil 1 5 - REvil Ransomware: Mechanism of Action
revil ransomware: mechanism of action

Also, the ransom note is created in the directories where there are encrypted files:

umair-akbar-Threat Coverage REvil 7 - REvil Ransomware: Mechanism of Action
Part of REvil ransom note

About the Author

USA

Umair Akbar | Cloud Engineer

Umair Akbar is a Senior Information Security Engineer with over 5 years of experience leading the development and daily management of InfoSec systems.

View All Articles