MeldSecurity
Press Enter to search
CVE Database & Search →
Sign In Get Started

Revil_Ransomware

YARA-2021-0166 Critical general Active

Detects REvil Linux - Revix 1.1 and 1.2

Revil_Ransomware.yar Valid Syntax 
rule Revil_Ransomware : ransomware {
   meta:
      author = "Josh Lemon"
      description = "Detects REvil Linux - Revix 1.1 and 1.2"
      reference = "https://angle.ankura.com/post/102hcny/revix-linux-ransomware"
      date = "2021-11-04"
      version = "1.1"
      hash1 = "f864922f947a6bb7d894245b53795b54b9378c0f7633c521240488e86f60c2c5"
      hash2 = "559e9c0a2ef6898fabaf0a5fb10ac4a0f8d721edde4758351910200fe16b5fa7"
      hash3 = "ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4"
   strings:
      $s1 = "Usage example: elf.exe --path /vmfs/ --threads 5" fullword ascii 
      $s2 = "uname -a && echo \" | \" && hostname" fullword ascii
      $s3 = "esxcli --formatter=csv --format-param=fields==\"WorldID,DisplayName\" vm process list" ascii
      $s4 = "awk -F \"\\\"*,\\\"*\" '{system(\"esxcli" ascii
      $s5 = "--silent (-s) use for not stoping VMs mode" fullword ascii
      $s6 = "!!!BY DEFAULT THIS SOFTWARE USES 50 THREADS!!!" fullword ascii
      $s7 = "%d:%d: Comment not allowed here" fullword ascii
      $s8 = "Error decoding user_id %d " fullword ascii 
      $s9 = "Error read urandm line %d!" fullword ascii
      $s10 = "%d:%d: Unexpected `%c` in comment opening sequence" fullword ascii
      $s11 = "%d:%d: Unexpected EOF in block comment" fullword ascii
      $s12 = "Using silent mode, if you on esxi - stop VMs manualy" fullword ascii
      $s13 = "rand: try to read %hu but get %lu bytes" fullword ascii
      $s14 = "Revix" fullword ascii
      $s15 = "without --path encrypts current dir" fullword ascii
      
      $e1 = "[%s] already encrypted" fullword ascii
      $e2 = "File [%s] was encrypted" fullword ascii
      $e3 = "File [%s] was NOT encrypted" fullword ascii
      $e4 = "Encrypting [%s]" fullword ascii

   condition:
      uint16(0) == 0x457f and filesize < 300KB and ( 4 of ($s*) and 2 of ($e*))
}

Rule Metadata

author
Josh Lemon
description
Detects REvil Linux - Revix 1.1 and 1.2
reference
https://angle.ankura.com/post/102hcny/revix-linux-ransomware
date
2021-11-04
version
1.1
hash1
f864922f947a6bb7d894245b53795b54b9378c0f7633c521240488e86f60c2c5
hash2
559e9c0a2ef6898fabaf0a5fb10ac4a0f8d721edde4758351910200fe16b5fa7
hash3
ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4

Tags

ransomware

String Definitions

{"name":"$s1","value":"\"Usage example: elf.exe --path \/vmfs\/ --threads 5\" fullword ascii"}
{"name":"$s2","value":"\"uname -a && echo \\\" | \\\" && hostname\" fullword ascii"}
{"name":"$s3","value":"\"esxcli --formatter=csv --format-param=fields==\\\"WorldID,DisplayName\\\" vm process list\" ascii"}
{"name":"$s4","value":"\"awk -F \\\"\\\\\\\"*,\\\\\\\"*\\\" '{system(\\\"esxcli\" ascii"}
{"name":"$s5","value":"\"--silent (-s) use for not stoping VMs mode\" fullword ascii"}
{"name":"$s6","value":"\"!!!BY DEFAULT THIS SOFTWARE USES 50 THREADS!!!\" fullword ascii"}
{"name":"$s7","value":"\"%d:%d: Comment not allowed here\" fullword ascii"}
{"name":"$s8","value":"\"Error decoding user_id %d \" fullword ascii"}
{"name":"$s9","value":"\"Error read urandm line %d!\" fullword ascii"}
{"name":"$s10","value":"\"%d:%d: Unexpected `%c` in comment opening sequence\" fullword ascii"}
{"name":"$s11","value":"\"%d:%d: Unexpected EOF in block comment\" fullword ascii"}
{"name":"$s12","value":"\"Using silent mode, if you on esxi - stop VMs manualy\" fullword ascii"}
{"name":"$s13","value":"\"rand: try to read %hu but get %lu bytes\" fullword ascii"}
{"name":"$s14","value":"\"Revix\" fullword ascii"}
{"name":"$s15","value":"\"without --path encrypts current dir\" fullword ascii"}
{"name":"$e1","value":"\"[%s] already encrypted\" fullword ascii"}
{"name":"$e2","value":"\"File [%s] was encrypted\" fullword ascii"}
{"name":"$e3","value":"\"File [%s] was NOT encrypted\" fullword ascii"}
{"name":"$e4","value":"\"Encrypting [%s]\" fullword ascii"}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: Critical

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

  • File-based detection for executables and documents
  • Memory scanning for running processes
  • Network traffic analysis support

Command Line Usage

# Scan a single file
yara Revil_Ransomware.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r Revil_Ransomware.yar /path/to/directory/

# Scan with metadata output
yara -m Revil_Ransomware.yar target_file

# Scan process memory (Linux)
yara Revil_Ransomware.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='Revil_Ransomware.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=Revil_Ransomware.yar /path/to/scan

Rule Information

YARA ID
YARA-2021-0166
Created
August 19, 2025
Last Updated
August 19, 2025
Last Imported
Never

Threat Intelligence

Risk Level Critical
Category general
Detection Confidence Analysis Pending
False Positive Rate Not Available
Last Seen in Wild No Data

Related Rules

Xtreme
YARA-2025-0555
Medium
MiniDionis_readerView
YARA-2015-0004
Medium
Maldoc_APT10_MenuPass
YARA-2018-3751
Medium
Mal_Dropper_httpEXE_from_CAB
YARA-2016-0083
Medium
FlashNewfunction
YARA-2025-0556
Medium

Export Options

Similar Rules in general

YARA-2023-0001 CRI

Detect_Mimic_Ransomware

Detect_Mimic_Ransomware
YARA-2023-0002 MED

SystemBC_malware

Detect_SystemBC
YARA-2023-0003 MED

detect_catB

detect_CatB_ransomware
YARA-2022-0001 MED

detect_Typhon_Stealer

detect_Typhon_Stealer
YARA-2023-0004 MED

Nosu_stealer

Detect_Nosu_stealer
YARA-2022-0002 MED

detect_Lumma_stealer

detect_Lumma_stealer
YARA-2022-0003 MED

detect_StrelaStealer

detect_StrelaStealer
YARA-2022-0004 MED

detect_silence_Downloader

detect_silence_Downloader