Procedure examples

Qilin can employ an embedded Mimikatz module to dump LSASS memory.

Qilin can identify specific services for termination or to be left running at execution.

Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.

Qilin can accept a command line argument identifying specific IPs.

Qilin can enumerate domain-connected hosts during its discovery phase.

Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.

Qilin can enable SSH access on ESXi hosts.

Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.

Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.

Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.

Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.

Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution. Qilin has also created a scheduled task named TVInstallRestore, configured to run at logon using the `/SC ONLOGON` argument.

Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.

Qilin can define specific processes to be terminated or left alone at execution.

Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script. Qilin has also used PowerShell for discovery in vCenter and Active Directory environments.

Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i
C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.

Qilin can run PowerShell cmdlets to discover domain groups.

Qilin can delete itself from infected hosts after execution.

Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.

Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.

Qilin can exclude specific directories and files from encryption.

Qilin can list all local users found on a targeted system.

Qilin can use PowerShell cmdlets to enumerate domain users.

Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.

Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client. Qilin can also modify `HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper` to enable posting of ransom messages.

Qilin can use an embedded Mimikatz module for token manipulation.

Qilin has the ability to list network drives.

Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.

Qilin has been executed by luring victims into clicking links in spearphishing emails.

Qilin has been delivered to victims through spearphishing emails with malicious attachments.

Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.

Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.

Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.

Qilin can create a mutex to ensure only one instance is running.

Qilin has pushed a scheduled task via a Group Policy Object for payload execution.

Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.

Qilin can terminate specific services on compromised hosts.

Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.

Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.

Qilin can initiate a reboot of the backup server to hinder recovery.

Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.

Qilin can configure a Winlogon registry entry.

Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.

Qilin has been delivered to victims through malicious email attachments.

Qilin has been delivered via malicious links in spearphishing emails.

Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.

Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.

Qilin has the ability to delay execution.

Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.

Qilin can terminate antivirus-related processes and services.