General
- Target ae57e4be3ebcf78d4f569a3b7875c287d70f7d45876fcaaaebe3f5ca58cce600.exe
- Size 8.5MB
- Sample260118-l1vjpadz2d
- SHA256 ae57e4be3ebcf78d4f569a3b7875c287d70f7d45876fcaaaebe3f5ca58cce600
Malware Config
Targets
-
- Target ae57e4be3ebcf78d4f569a3b7875c287d70f7d45876fcaaaebe3f5ca58cce600.exe
- Size 8.5MB
- SHA256 ae57e4be3ebcf78d4f569a3b7875c287d70f7d45876fcaaaebe3f5ca58cce600
Score10/10BQTLock
BQTLock is a ransomware that operates under a Ransomware-as-a-Service model.
Bqtlock family
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (11614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Deletes itself
Drops startup file
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Sets desktop wallpaper using registry
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1