← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
AWS.DEV | Ransom REevil | MaaS -Mirai , Makop , Sodinokibi | 6.13.25 Appears ti be ongoing
WHITE Q.Vashti 2026-05-13 Modified: 2026-05-13
516
IOCs
HIGH VOLUME
filehashmd5filehashsha1showingcopyrightlevelbluepacker entropype featurespe unknownresource nameallocates rwxnetwork icmpantivm networkexe nolookupproxy wpaddead hosttoolsgenericdeletes selfransomevaderactivelearnck idname tacticssuspiciousinformativeinstallsadversarieswindowsmodulesregistrypersistenceexecutionserviceunitedpathflagdateaccess typegermany germanycreatehttp headertcp trafficet infoentropyhybridmaliciousgeneralclickstringsinjectremoteencrypt filespythonglobalwin32 exepe32intelms windowswin32 dynamiclink librarywin16 neicons libraryos2 executablepe32 compileroverlaydatape32 executableborland delphidelphi genericmd5 codeempty hashfile typesuccessregopenkeyexwregopenkeyexahkeycurrentuservirtualallocexcreatefilewgenericreadhkeyclassesrootgenericwriteregsetvalueexwdesktopwebviewmirairusssian datareevilmoney docgmt flagserverunited kingdomfrance franceukraine ukrainellc nameviet namshowcvebad trafficfalseerrortagsipv4url httpsurl httpsearchtype indicatorrole titleadded activerelated pulsesentriesmonitortargetmembersmaasattackmitre att
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Ransom:Win32/Makop.PA!MTB Trojan/Win32.BlueCrab.R331768 Trojan.Ransom.Sodinokibi Emotet Virus.Neshta Mirai RANSOM_REvil Labeled as: Ransom.Sodinokibi.Generic
Indicators of Compromise (1 / 516 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL CVE domain hostname
TYPEINDICATORDESCRIPTIONCREATED
CVE CVE-2018-8453 — 2026-05-13
References (9)
↗ RANSOM_REvil - https://www.nextron-systems.com/notes-on-virustotal-matches/ ↗ YARA: Matches rule MAL_RANSOM_REvil_Oct20_1 from ruleset crime_ransom_revil by Florian Roth (Nextron Systems) ↗ YARA: Matches rule Windows_Ransomware_Sodinokibi_83f05fbe from ruleset Windows_Ransomware_Sodinokibi by Elastic Security ↗ YARA: Matches rule win_revil_auto from ruleset win.revil_auto by Felix Bilstein - yara-signator at cocacoding dot com ↗ https://otx.alienvault.com/malware/Ransom:Win32/Makop/ ↗ https://www.hybrid-analysis.com/sample/cb33f3d60a715436ab49ab7968c5a31410d0cd6b9d141b41b2362c02b59e2913/5e68effaec3f2e3f0c5237b8 ↗ https://www.hybrid-analysis.com/sample/cb33f3d60a715436ab49ab7968c5a31410d0cd6b9d141b41b2362c02b59e2913/5e68effaec3f2e3f0c5237b8 ↗ Permissions requested: SE_DEBUG_PRIVILEGE SE_LOAD_DRIVER_PRIVILEGE ↗ Behaviour: Extract file to system directory