Ransom:Win32/Qilinloader.AL!MTB

Ransom:Win32/Qilinloader.AL!MTB functions Unlike the !rfn variant (which acts as a downloader), this variant functions as a standalone ransomware with built-in encryption routines. It does not require external payload retrieval, as all destructive logic such as file encryption and ransom note generation runs locally.  

Qilinloader targets the /api/v1/agent/checkin endpoint to retrieve operational commands back from its C2 infrastructure. It then will terminate various processes that would restrict performing encryption on files, among them are backup-related services, such as vss and sql and several antivirus software processes.  

Then Qilinloader will inspect runtime arguments, looking for commands and flags, such as --password, that changes its behavior. It runs the CPUID instruction to determine if it is in a virtualized environment. The malware will launch fsutil to check if the compromised device supports network symlink, a precondition to lateral movement across the compromised network.  

Ransom:Win32/Qilinloader.AL!MTB creates {file}.CcXB9wE4s7.{random} files in the following folders: 

• C:\Users\<USER>\AppData\Local\Temp\QLOG\ 
• C:\Users\user\AppData\Local\Temp\QLOG 

Ransom note is found as: 

• README-RECOVER-{string}.txt 

Creates following processes: 

• C:\Users\<USER>\Desktop\service_restore.exe 
• C:\Users\<USER>\Desktop\academy.exe 
• C:\Windows\System32\UI0Detect.ex 
• C:\Users\user\Desktop\hello.exe 
• C:\Users\<USER>\Desktop\cusd.exe 

Registry entries modified: 

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem (SymlinkRemoteToLocalEvaluation and SymlinkRemoteToRemoteEvaluation keys set to one).