How to remove REvil ransomware

REvil ransomware is a sophisticated malware family that uses RaaS scheme to proliferate the threat worldwide

REvil ransomware is a data locking virus that was first spotted back in April 2019 by security researchers from Cisco Talos.^[1] Otherwise known as Sodinokibi/Sodin, the threat started off by exploiting zero-day vulnerability CVE-2019-2725.^[2] It allows attackers to remotely connect to the host machine with the HTTP access to the Oracle's WebLogic server and inject the malware manually. Initially, the payload was delivered with the notorious GandCrab 5.2 ransomware, which is now believed to be its successor.

Once inside, REvil virus uses Salsa20 encryption algorithm (based on ECDH^[3] key exchange method) to encrypt all data on the hard drive and the connected networks. It appends a randomly-generated extension to databases, documents, pictures, and other files.Additionally, it drops a [random]-readme.txt or HOW-TO-DECRYPT.txt ransom note and changes the desktop wallpaper. The text files explains that victims need to install TOR web browser and visit a provided link. Hackers then ask for $2,500 ransom in Bitcoin, and the demand is doubled if it not paid within five days.

REvil ransomware is believed to be the next GandCrab, as security researchers managed to find many similarities between the two. Besides, the developers of malware might be the same as well, even if they claimed to be retired by now. The malware uses more sophisticated techniques for its distribution, obfuscation, and operation, so it seems like hackers upped their game, and are going for more profits.

The ransom note [random]-readme.txt states the following:

Hello dear friend!

Your files are encrypted, and, as a result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got a 6d4q6r3o extension.

Instructions into the TOR network
———————————-
Install TOR browser from https://torproject.org

Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C2D97495C4BA3647 

Instructions into WWW (The following link can not be in work state, if true, use TOR above):
———————————-
Visit the following link: http://decryptor.top/C2D97495C4BA3647

Victims of REvil are lead to a TOR page that presents a ransom amount of $2,500 and the timer which expires after five days. This creates an urgency situation for users, prompting them to pay as soon as possible.

While there is no decryption tool available for this sophisticated threat, there are alternative data recovery methods that you can use. Nevertheless, you need to remove REvil ransomware before you proceed with the file recovery process. For that use anti-malware software such as FortectIntego or SpyHunterCombo Cleaner, although other reputable tools can help you as well.

The advanced operation of  REvil ransomware is set to retain a maximum amount of profits

While initially the malware was spotted being spread via the WebLogic flaw, REvil ransomware authors later adapted broader techniques, such as:

• Spam email attachments
• Rig exploit kit
• Hacked sites
• Unprotected RDP configurations
• Managed Service Provider hacks, etc.

In one of the campaigns, hackers behind REvil ransomware used a former Windows zero-day CVE-2018-8453,^[4] which was also previously used by a state-sponsored hacking group FruityArmor since August 2018.

Upon infiltration, REvil ransomware performs a variety of changes to the infected computer before it starts the file encryption. It removes shadow volume copies, modifies Windows registry database, disables Windows repair function, connects to a remote server by using more than 100 domains and elevates its privileges, which is quite uncommon ransomware-type viruses.

In some cases, the virus might also uninstall security applications, complicating REvil ransomware removal. Additionally, the sophisticated threat uses a relatively old Heaven's Gate technique,^[5] which allows a 64-based code to be executed in a 32-bit environment, consequently preventing its detection entirely.

Security researchers believe that this is not the end, and REvil, otherwise known as Sodinokibi, will continue to adopt new techniques to evade the detection, infect more victims and acquire maximum profits from the illegal business run by organized cybercrime groups.

CIS countries excluded from REvil ransomware campaigns, just as GandCrab was

REvil ransomware uses a predetermined list of countries that are excluded from the infection targets. That means that users whose keyboards are set to Armenian, Belarusian, Kazakh, Moldovian, Russian, Kyrgyz, Tajik, Turkmen, Ukrainian and Uzbek, are immune to the infection – as soon as REvil detects these languages, it exits the system without causing any harm.

All the mentioned countries are a part of CIS – Commonwealth of Independent States and are often excluded from various ransomware campaigns. This is because REvil ransomware authors most likely reside in those countries and do not want to attract too much attention from local authorities, making the operation of the threat so much easier and safer.

An interesting fact is that Syria is also excluded, even though it is not a part of CIS. This unusual step was also taken on by GandCrab developers when they released the keys for victims from a war-ridden country back in October 2018. This cost the makers of malware quite a sum, as Bitdefender released a free decryptor shorty after. Nevertheless, the newer version was launched soon after, and victims were unable to decrypt the data again.

Brian Krebs, one of the well-known malware analysts, believes that REvil is just a rebranded GandCrab, following up with this statement:^[6]

My guess is the GandCrab team has not retired, and has simply regrouped and re-branded due to the significant amount of attention from security researchers and law enforcement investigators. It seems highly unlikely that such a successful group of cybercriminals would just walk away from such an insanely profitable enterprise.

Protect yourself against ransomware – use comprehensive malware prevention methods

Most of the regular users are convinced that they are safe as long as they have anti-malware software installed on their machines, and, while it one of the most important malware prevention methods, it is by far not enough. As described above, Sodinokibi developers use Ransomware-as-a-service scheme, which allows multiple different hacking groups or individuals to participate in the campaign, making it so much more prevalent and widespread.

The malware is sophisticated enough to use code injections that bypass anti-malware tools. For that reason, using security software only and believing that you are safe is merely silly. For the future, experts from viruset.no^[7] advise using the following malware prevention techniques:

• Make sure you update the installed software along with the operating system as soon as new patches are released. Software vulnerabilities are common between sophisticated malware families, so viruses that are proliferated in such method are usually advanced and con result in severe consequences (i.e., data loss, money loss, sensitive information disclosure to cybercriminals, etc.);
• Use ad-blockers. While these tools can prevent monetization for a variety of websites, such tools would guarantee that an ad will not insert a drive-by download that would consequently install the malicious payload automatically. However, we recommend making exclusions for sites you want to support;
• Equip your accounts with two-factor authentication. No matter what techniques hackers would come up with, tho-factor authentication would almost always prevent the unauthorized access to all your accounts;
• Be careful when using Remote Desktop – never use a default port, and protect it with adequate and a complicated password;
• NEVER re-use passwords;
• Be more careful overall: do not click on phishing links on social media like Facebook Messenger, avoid suspicious sites, do not download software from unknown sources, do not pirate, etc.;
• Backup your data on a regular basis – this would negate the most damaging consequence of a ransomware infection.

You must terminate REvil ransomware from your computer before you attempt to recover your files

To many users, getting their files encrypted might one of the most terrible things that can happen, whether it is the days spent on working documents or precious family photos that cannot be recreated. Unfortunately, REvil decryption tool does not exist yet, as the threat is relatively new, and researchers require time to break a sophisticated code.

If you were thinking about whether you should pay the ransom, we advise you not to. Of course, REvil virus authors setting the 5-day timer is just a trick used to make users to pay the money as soon as possible. However, please rethink the consequences: the transferred Bitcoins would confirm that the illegal business works, so it will prompt hackers to continue. More importantly, you might not even get a working tool in return or receive one that does not work. Remember, they do not owe you anything, as criminals do not care about the well-being of their victims.

Therefore, you should rather remove REvil ransomware virus from your computer and then use alternative file recovery methods. Be aware that the malware strain is sophisticated and might disable anti-malware tools, or bypass their detection.

For that reason, you should enter Safe Mode with Networking – this environment is ideal for tackling problems related to the Windows OS, as well as eliminating even the most dangerous malware. From there, you should use anti-malware software such as FortectIntego, SpyHunterCombo Cleaner or another tool to terminate REvil ransomware and repair the virus damage. We explain how to do that below, so please follow the instructions carefully.

Once you perform a full REvil ransomware removal, you can attempt file recovery. If you had backups on an external drive such a Flash stick or backups on a virtual server, you could copy your files. If you did not have backups prepared, you should check our alternative solutions below. If that does not work, you will have to wait till the official REvil ransomware decryptor is released.