bqtlock | 4bcb6d3ce7c749071ea2d3a59066cf49f85417b75918b14e907fde98e32808b8

General

Target
0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd.zip
Size 3.3MB
Sample260716-tcb2facv8y
SHA256 4bcb6d3ce7c749071ea2d3a59066cf49f85417b75918b14e907fde98e32808b8
MD5 04d215277feaf45a96d7d13b8c274145
SHA1 00bd022a0928d34ea48f1abc590f54776be90a00
SHA512 bc8492470f7ca325a6176dbdd9097041f9bbcce522ecf44a4cbf926538a769f1bed5e046f744a26e7de8e191a87110bb1d8a5e9364f50553a89229ffe24042c7
SSDEEP 49152:ST1sGbFgEMLuJFmgEqVdaEGgaCO3IPOwbFNg6zWAYVGQTZbmNby4jKhJb41AymmD:qjeEDQgPasaCjbFilAYZyN/jXptD
TLSH
T123F533A85E07BF83E60CD59FEFBC4B7A4F2CE411032A545A65F7F5E420708A5E60960E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Adobe\Color\README_TO_DECRYPT_240700921.txt

bqtlock

Ransom Note

ALL YOUR FILES HAVE BEEN ENCRYPTED BY BQTLOCK! Your entire network has been penetrated, and all data is now encrypted using military-grade AES-256 and RSA-4096 algorithms. Decryption is impossible without our unique private key. ⚠️ Do NOT attempt to recover your files using third-party tools or backups. Any such action will result in the irreversible loss of your data. To begin the recovery process contact ,: [email protected] http://yywhylvqeqynzik6ibocb53o2nat7lmzn5ynjpar3stndzcgmy6dkgid.onion/ https://t.me/BQTlock https://t.me/Fuch0u your unique ID is: LULZ ⏳ You have 48 hours to make contact. After that, the decryption price will double. After 7 days, your key will be destroyed permanently. We are watching 计算机已被BQTLOCK加密我们的要求很简单，我们只要钱请联系: [email protected] http://yywhylvqeqynzik6ibocb53o2nat7lmzn5ynjpar3stndzcgmy6dkgid.onion/ https://t.me/BQTlock https://t.me/Fuch0u

Emails

[email protected]

URLs

http://yywhylvqeqynzik6ibocb53o2nat7lmzn5ynjpar3stndzcgmy6dkgid.onion/
https://t.me/BQTlock
https://t.me/Fuch0u

Targets

- Target
  0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd
- Size 8.1MB
- SHA256 0e7ab1904953aca8e89ce357f5bce8e3758aaa5faa546e876a5551ec28dfd2bd
- MD5 310c0c5d30caae2228b8c8eb212b7e0a
- SHA1 898e30528da6ff06cbe7f8e4be626674628b36dc
- SHA512 5199d07024e98f2f128d11520ebe1c39f5b1514b0eb1a4bd604b553619c8398c681bbf152ae70b2a87372ed6784b918146c6641a738d491d99ff9366619c2a8e
- SSDEEP 98304:+csOrZtxwBhbdMoDpZ3Qhv8qjiuaS5rx9saZBrZyt+TwlUAu2L:+c1taBfZLGBtiQoUUL
- TLSH
  T1B6865B7BE16710D8C5ABC174C25BB371BD30B46500347E6E2E60DBB6AF61E601E6EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution bqtlock impact persistence ransomware spyware stealer
- Detects BQTLock Ransomware
- Family: BQTLock
  BQTLock is a cross-platform ransomware that operates under a Ransomware-as-a-Service model.
  ransomware bqtlock
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (3089) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Detect suspicious telegram bot
  Detect suspicious telegram bot.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2