bqtlock | 13a9a2f1c74810132280b26194615b19c786aa4c6f0e19f91ce575426c86578c

General

Target
0a841a35192eb9e68c96bcd0ade27737fde48cfab44f5b7a16dfa91640638a62.zip
Size 3.7MB
Sample260826-vmv3qsgp2w
SHA256 13a9a2f1c74810132280b26194615b19c786aa4c6f0e19f91ce575426c86578c
MD5 0997d14b5e1fea48451139fe2a9dd12d
SHA1 fbcf9c38f2ab2ada18f4d845a818bbdddec101ea
SHA512 0a9b14c91003c5bb658b549d5370c58ca9515edcfa49c3c83c53431ee1e858e99090bf40491af8e12178e7cc9d661445ad4f158262e73ed8e2abb978d66f2359
SSDEEP 98304:m2NAvGOepntPaf3hseODNNnrUyKrcQV1uXb9Vu:m2N09eJ8K9DNNQyuJ18b9w
TLSH
T1420633737DF0EE2B3205BE6922A14763FDAAD6584469AA390EBF7D21CF19C3149F4005
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\README_TO_DECRYPT.txt

bqtlock

Ransom Note

ALL YOUR FILES HAVE BEEN ENCRYPTED BY BQTLOCK! Your entire network has been penetrated, and all data is now encrypted using military-grade AES-256 and RSA-4096 algorithms. Decryption is impossible without our unique private key. ⚠️ Do NOT attempt to recover your files using third-party tools or backups. Any such action will result in the irreversible loss of your data. To begin the recovery process contact ,: $

Targets

- Target
  0a841a35192eb9e68c96bcd0ade27737fde48cfab44f5b7a16dfa91640638a62
- Size 8.9MB
- SHA256 0a841a35192eb9e68c96bcd0ade27737fde48cfab44f5b7a16dfa91640638a62
- MD5 1f0a3bcbf7a0f36352d813147e4f00ed
- SHA1 f15d83fce8c42d428cea357016f70de31011e72a
- SHA512 557b7f17a5ee3cbef2322fd9f2afc851ed9d462ef4d72fe1044f651ae29a9e323dfbd73e3fcfb397c4ccabdfd0b3c7b30541e0a6e3084167a96bbd050b6924ff
- SSDEEP 98304:9sJ1973CPeKP8pKkTsyw0IYvKjdSYo9Rumxc4FlmXWvX9oIZkq4+2GhItZ1c3wx:9w197HKEpKGaRQ91ZiWOtbc3wx
- TLSH
  T15B963977E16610D8C96BD174C25AB3B2BD30B8640834BE6EDE50DBB12E21E505E7EF60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution bqtlock persistence ransomware
- Family: BQTLock
  BQTLock is a cross-platform ransomware that operates under a Ransomware-as-a-Service model.
  ransomware bqtlock
- Renames multiple (505) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Detect suspicious telegram bot
  Detect suspicious telegram bot.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2