REvil

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.^[7][3]

REvil can modify the Registry to save encryption parameters and system information.^{[6][7][9][2][1]}

REvil can decode encrypted strings to enable execution of commands and payloads.^{[5][4][6][9][2][1]}

REvil can encrypt files on victim systems and demands a ransom to decrypt the files.^{[4][6][8][10][2][11][1][12]}

REvil has the capability to destroy files and folders.^{[4][7][9][9][2][11][1]}

REvil has the ability to identify specific files and directories that are not to be encrypted.^{[4][6][7][9][2][1]}

REvil has the capability to stop services and kill processes.^[2][1]

REvil can use Native API for execution and to retrieve active services.^[1][2]

REvil can query the Registry to get random file extensions to append to encrypted files.^[1]

REvil has infected victim machines through compromised websites and exploit kits.^{[1][9][11][7]}

REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.^{[4][6][7][9][9][2][3][1]}

REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.^{[4][6][7][8][9][2][11][1][12]}

REvil can enumerate active services.^[2]

REvil can download a copy of itself from an attacker controlled IP address to the victim machine.^[8][9][11]

REvil can inject itself into running processes on a compromised host.^[10]

REvil can exfiltrate host and malware information to C2 servers.^[1]