bqtlock

General

Target
start.exe
Size 12.5MB
Sample251010-q2qpcawrs7
SHA256 4525387f28bee6bb48d07e6989319f382447a8a6e48ae11f332dee9916feb8cc
MD5 de96beb0baa7243dd7f39b2c400bbc44
SHA1 22fc83d0eb4cfac43772694a6878960d4ce47d13
SHA512 2de1ad328c28300285866c2d2a966970991266fd574e7d91503ee0eeb2183daab3b75d63769fc06c386421d9ad57c6d24be4961fca5cea875306f5fecab8181f
SSDEEP 393216:12qu9CfeGL01+l+uq+VvBW+tHjdEgwylDLG90wyp45w6:m9C2a01+l+uqgvBW+NjGly99wW45w6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\README_TO_DECRYPT.txt

Ransom Note

YOUR FILES ARE ENCRYPTED! your files are not deleted but they are hidden to see them use cmd.exe and dir /a To recover your files, send 10 xmr to the following address:89RQN2EUmiX6vL7nTv3viqUAgbDpN4ab329zPCEgbceQJuS233uye4eXtYk3MXAtVoKNMmzgVrxXphLZbJPtearY7QVuApr After payment, send your HWID and transaction ID to: [email protected] we send you a decryptor and key DO NOT try to decrypt files yourself or use third-party tools, this will lead to permanent data loss.

Emails

[email protected]

Targets

- Target
  start.exe
- Size 12.5MB
- SHA256 4525387f28bee6bb48d07e6989319f382447a8a6e48ae11f332dee9916feb8cc
- MD5 de96beb0baa7243dd7f39b2c400bbc44
- SHA1 22fc83d0eb4cfac43772694a6878960d4ce47d13
- SHA512 2de1ad328c28300285866c2d2a966970991266fd574e7d91503ee0eeb2183daab3b75d63769fc06c386421d9ad57c6d24be4961fca5cea875306f5fecab8181f
- SSDEEP 393216:12qu9CfeGL01+l+uq+VvBW+tHjdEgwylDLG90wyp45w6:m9C2a01+l+uqgvBW+NjGly99wW45w6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion execution bqtlock impact persistence ransomware spyware stealer
- BQTLock
  BQTLock is a ransomware that operates under a Ransomware-as-a-Service model.
  ransomware bqtlock
- Bqtlock family
  bqtlock
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (1361) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2