General
- Target 6a09fbe1e2adf9ebd54ebfd30a5cd9e480442958b32a60cc13d615858ba05b11
- Size 8.5MB
- Sample260118-m1jmvsey8a
- SHA256 6a09fbe1e2adf9ebd54ebfd30a5cd9e480442958b32a60cc13d615858ba05b11
Score
10/10
Malware Config
Targets
-
- Target 6a09fbe1e2adf9ebd54ebfd30a5cd9e480442958b32a60cc13d615858ba05b11
- Size 8.5MB
- SHA256 6a09fbe1e2adf9ebd54ebfd30a5cd9e480442958b32a60cc13d615858ba05b11
Score10/10BQTLock
BQTLock is a ransomware that operates under a Ransomware-as-a-Service model.
Bqtlock family
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (3515) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Sets desktop wallpaper using registry
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1