Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\BQTLock.Encrypted.bqtlock\shell\open\command] '' = 'rundll32.exe shell32.dll,OpenAs_RunDLL %1'
- [HKLM\Software\Classes\BQTLock.Encrypted.bqtlock\shell\open\command] '' = 'rundll32.exe shell32.dll,OpenAs_RunDLL %1'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\wininet\cachetask
Malicious functions
Patches code
in AMSI dll
- rhfhclno.exe process, Amsi.dll module
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\windows\svc_instance.pid
- %ALLUSERSPROFILE%\microsoft\windows\themes\.__bqt_probe
- %ALLUSERSPROFILE%\microsoft\windows\themes\svc_wallpaper.bmp
- %ALLUSERSPROFILE%\microsoft\windows\.__bqt_probe
- %ALLUSERSPROFILE%\microsoft\windows\svc_enc_icon_1fcbfbff406f1-2fm54culvfj-system serial number-diskaad802mjf3uxg-diskzz410a69k7jx-diskbbol33qznfg0ns.ico
- %ALLUSERSPROFILE%\microsoft\windows\c2_coord_69704431.dat
- C:\users\public\readme_decrypt.txt
- %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.tmp
- %HOMEPATH%\documents\anketa.doc.tmp
- %HOMEPATH%\documents\balans.xlsx.tmp
- %HOMEPATH%\documents\balans.xls.tmp
- %HOMEPATH%\documents\balans2.xls.tmp
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx.tmp
- %HOMEPATH%\documents\budget3.xlsx.tmp
- %HOMEPATH%\desktop\ovp25012015.doc.tmp
- %HOMEPATH%\documents\readme_decrypt.txt
- %HOMEPATH%\.oracle_jre_usage\readme_decrypt.txt
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab30e02-664.pma
- %HOMEPATH%\desktop\readme_decrypt.txt
- %WINDIR%\temp\opera stable_login data_temp
- %WINDIR%\temp\opera stable_history_temp
- %WINDIR%\temp\opera stable_web_data_temp_af
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab30e0f-eac.pma
- %LOCALAPPDATA%\microsoft\windows\caches\readme_decrypt.txt
- %LOCALAPPDATA%\microsoft\windows\explorer\readme_decrypt.txt
- %LOCALAPPDATA%\readme_decrypt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\databases\readme_decrypt.txt
- %LOCALAPPDATA%\microsoft\edge\user data\default\readme_decrypt.txt
- %LOCALAPPDATA%\connecteddevicesplatform\l.user\readme_decrypt.txt
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\readme_decrypt.txt
- %APPDATA%\opera software\opera stable\themes_backup\readme_decrypt.txt
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %WINDIR%\temp\svc_master_data_1fcbfbff406f1-2fm54culvfj-system serial number-diskaad802mjf3uxg-diskzz410a69k7jx-diskbbol33qznfg0ns.txt
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\readme_decrypt.txt
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7ed9d7e2c7e19cea_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
Deletes following files that it created itself
- %ALLUSERSPROFILE%\microsoft\windows\themes\.__bqt_probe
- %ALLUSERSPROFILE%\microsoft\windows\.__bqt_probe
- %WINDIR%\temp\opera stable_login data_temp
- %WINDIR%\temp\opera stable_history_temp
- %WINDIR%\temp\opera stable_web_data_temp_af
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\cert9.db.tmp
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db.tmp
- %LOCALAPPDATA%\microsoft\windows\notifications\wpndatabase.db.tmp
- %LOCALAPPDATA%\microsoft\windows\caches\cversions.3.db.tmp
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_48.db.tmp
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_256.db.tmp
- %LOCALAPPDATA%\microsoft\windows\explorer\iconcache_idx.db.tmp
- %LOCALAPPDATA%\microsoft\windows\explorer\iconcache_32.db.tmp
- %LOCALAPPDATA%\microsoft\windows\explorer\iconcache_16.db.tmp
- %LOCALAPPDATA%\microsoft\windows\caches\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000023.db.tmp
- %LOCALAPPDATA%\microsoft\windows\explorer\iconcache_48.db.tmp
- %LOCALAPPDATA%\microsoft\windows\caches\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000004.db.tmp
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\key4.db.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab30e02-664.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab30e0f-eac.pma
Moves the following files
- from %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.tmp to %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.bqtlock
- from %HOMEPATH%\documents\balans.xls.tmp to %HOMEPATH%\documents\balans.xls.bqtlock
- from %HOMEPATH%\documents\balans.xlsx.tmp to %HOMEPATH%\documents\balans.xlsx.bqtlock
- from %HOMEPATH%\documents\anketa.doc.tmp to %HOMEPATH%\documents\anketa.doc.bqtlock
- from %HOMEPATH%\documents\balans2.xls.tmp to %HOMEPATH%\documents\balans2.xls.bqtlock
- from %HOMEPATH%\desktop\holycrosschurchinstructions.docx.tmp to %HOMEPATH%\desktop\holycrosschurchinstructions.docx.bqtlock
- from %HOMEPATH%\documents\budget3.xlsx.tmp to %HOMEPATH%\documents\budget3.xlsx.bqtlock
- from %HOMEPATH%\desktop\ovp25012015.doc.tmp to %HOMEPATH%\desktop\ovp25012015.doc.bqtlock
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\internet explorer\ie4uinit-cleariconcache.log
- %LOCALAPPDATA%\microsoft\vault\userprofileroaming\latest.dat
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1920_1080_pos2.jpg
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
Substitutes the following files
- %ALLUSERSPROFILE%\microsoft\windows\.__bqt_probe
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\previews_opt_out.db
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '19#.#80.215.87':80
- 'di##ord.com':443
- 'ic###azip.com':80
- 'ap#.##legram.org':443
- 'co####.edge.skype.com':443
- 'bq##ock.com':443
- 'x1.#.lencr.org':80
- '23.##5.2.164':80
- 'fo###.gstatic.com':443
- 'fo###.#oogleapis.com':443
- 'cd###.#loudflare.com':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
HTTP POST requests
- http://19#.#80.215.87/api.php?ac######################################################################################
Other
- 'di##ord.com':443
- 'co####.edge.skype.com':443
- 'bq##ock.com':443
- 'fo###.gstatic.com':443
- 'fo###.#oogleapis.com':443
- 'cd###.#loudflare.com':443
UDP
- DNS ASK di##ord.com
- DNS ASK ic###azip.com
- DNS ASK ap#.##legram.org
- DNS ASK co####.edge.skype.com
- DNS ASK bq##ock.com
- DNS ASK x1.#.lencr.org
- DNS ASK fo###.#oogleapis.com
- DNS ASK fo###.gstatic.com
- DNS ASK cd###.#loudflare.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '<SYSTEM32>\cmd.exe' /c cmd /c ie4uinit.exe -ClearIconCache
- '<SYSTEM32>\cmd.exe' /c ie4uinit.exe -ClearIconCache
- '<SYSTEM32>\ie4uinit.exe' -ClearIconCache
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
- '<SYSTEM32>\notepad.exe' C:\Users\Public\README_DECRYPT.txt
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://bqtlock.com/
- '<SYSTEM32>\cmd.exe' /c netsh wlan show profiles 2>&1
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://bqtlock.com/
- '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s 2>&1
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s
- '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>&1
- '<SYSTEM32>\reg.exe' query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
- '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\SimonTatham\PuTTY\SshHostKeys" /s 2>&1
- '<SYSTEM32>\reg.exe' query "HKCU\Software\SimonTatham\PuTTY\SshHostKeys" /s
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,2581575062546239206,4881486010261435318,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
- '<SYSTEM32>\cmd.exe' /c cmd /c ie4uinit.exe -ClearIconCache' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh wlan show profiles 2>&1' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://bqtlock.com/' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\SimonTatham\PuTTY\SshHostKeys" /s 2>&1' (with hidden window)
