Ransom:Win32/Qilinloader!rfn

Ransom:Win32/Qilinloader!rfn functions by establishing a connection to hard-coded command and control (C2) servers using HTTPS on port 443. It will view several C2 servers such as 194[.]36.191[.]113. The malware initiates an encrypted communication channel to avoid detection. Qilinloader targets the /api/v1/agent/checkin endpoint to retrieve operational commands back from its C2 infrastructure. The actual download of the Qilin ransomware payload is delayed allowing to run preliminary steps. It then will terminate various processes that would restrict performing encryption on files, among them are backup-related services, such as vss and sql.  

Then Qilinloader will inspect runtime arguments, looking for commands and flags, such as --password, that changes its behavior. It runs the CPUID instruction to determine if it is in a virtualized environment. The malware will launch fsutil to check if the compromised device supports network symlink, a precondition to lateral movement across the compromised network. Qilinloader only retrieves the Qilin payload after the outlined conditions have been satisfied, and will come with filenames recently observed in directories like /downloads/{system_id}/ql_main.bin. 

Ransom:Win32/Qilinloader!rfn creates ThreadId({Number}).LOG files in the following folders: 

• C:\Users\<USER>\AppData\Local\Temp\QLOG\ 
• C:\Users\user\AppData\Local\Temp\QLOG 

Ransom note is found as: 

• README-RECOVER-{random_string}.txt 

Creates following processes: 

• C:\Users\<USER>\Desktop\service_restore.exe 
• C:\Users\<USER>\Desktop\academy.exe 
• C:\Windows\System32\UI0Detect.ex 
• C:\Users\user\Desktop\hello.exe 
• C:\Users\<USER>\Desktop\cusd.exe 

Registry entries modified: 

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem (SymlinkRemoteToLocalEvaluation and SymlinkRemoteToRemoteEvaluation keys set to one) 

Communicates to following hosts: 

• A83f[:]8110:0:0:2000[]:0:0:0 
• 184[.]27.218[.]92 : 80 
• A83f[:]8110:81b7[:f]fff:3003:257:81b7:ffff 
• 184[.]27.218[.]92 : 80 
• 194[.]36.191[.]113