Halcyon Qilin.B OCT 2024

Qilin can define specific processes to be terminated or left alone at execution.

Qilin can delete itself from infected hosts after execution.

Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.

Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client. Qilin can also modify `HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper` to enable posting of ransom messages.

Qilin has the ability to list network drives.

Qilin can create a mutex to ensure only one instance is running.

Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.

Qilin can terminate specific services on compromised hosts.

Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.

Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.

Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.

Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.

Qilin can terminate antivirus-related processes and services.

Qilin has the ability to clear Windows Event Logs.