qilin

Tácticas y técnicas observadas del actor, mapeadas a MITRE ATT&CK (clic para ver la ficha oficial). Útil para priorizar detecciones.

Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
Qilin ransomware
*/

import "pe"


rule Qilin_Loader
{
    meta:
        author = "rivitna"
        family = "ransomware.qilin.windows"
        description = "Qilin ransomware Windows loader"
        severity = 10
        score = 100

    strings:
        $h0 = { 85 C0 75 12 E8 [4] 85 C0 0F 84 ?? 0? 00 00 A3 [4]
                68 00 ?? ( 2? | 3? | 4? ) 00 6A 00 50 E8 [4] 85 C0
                0F 84 ?? 0? 00 00 31 D2 BF 00 [2] FF ( BB | 8D ) [0-8]
                ( 89 44 24 ?? C7 44 24 ?? ?0 ?? ?? 00
                  C7 44 24 ?? 00 00 00 00 |
                  ( 89 45 ?? C7 45 ?? ?0 ?? ?? 00 |
                    C7 45 ?? ?0 ?? ?? 00 89 45 ?? )
                  C7 45 ?? 00 00 00 00 )
                EB }

    condition:
        ((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
        for any i in (0..pe.number_of_sections-1):
        (
            (pe.sections[i].raw_data_size >= 0x2A0000) and
            (pe.sections[i].raw_data_size <= 0x500000) and
            (pe.sections[i].name == ".rdata")
        ) and
        (1 of ($h*))
}

rule QilinRansomwareESXi {
	meta:
		description = "rule to detect Qilin Ransomware"
		author = "ShadowStackRe.com"
		date = "2023-12-06"
		Rule_Version = "v1"
		malware_type = "ransomware"
		malware_family = "Qilin"
		License = "MIT License, https://opensource.org/license/mit/"
	strings:
		$strMotd = "/etc/motd"
		$strEncryptQuestion = "Are you sure to start encryption"
		$strConfigStart = "--- Configuration start ---"
		$strEsxiUsage = "esxcli"
		$strEncryptRenameFail = "Failed to rename encrypted file to"
		$strStartJob = "Started job..."
		$strBug = "\x1B[%uG 100%%"
	condition:
		all of them
}

Conversaciones de rescate divulgadas, con fines de estudio defensivo. Contactos, enlaces y wallets redactados.

• #202404293 mensajesno pagado
• #2025020336 mensajesno pagado

-- Agenda
Your network/system was encrypted.
Encrypted files have new extension.
-- Compromising and sensitive data
We have downloaded compromising and sensitive data from you system/network
If you refuse to communicate with us and we do not come to an agreementyour data will be published.
Data includes:
    - Employees personal dataCVsDLSSN.
    - Complete network map including credentials for local and remote services.
    - Financial information including clients databillsbudgetsannual reportsbank statements.
    - Complete datagrams/schemas/drawings for manufacturing in solidworks format
    - And more...
-- Warning
1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-- Recovery
1) Download tor browser: [redactado]
2) Go to domain
3) Enter credentials
-- Credentials
Extension: DtMXQFOCos
Domain: [redactado]
login: [snip]
password: [snip]

• https://www.ransomware.live/group/qilin

• Not Found
  21
• Agriculture and Food Production
  16
• Manufacturing
  15
• Healthcare
  14