Aside from featuring Chacha 20 encryption retained from older variants of the ransomware, Qilin.B has been strengthened with AES-256-CTR encryption, which could be leveraged to compromise AESNI-capable systems, as well as RSA-4096 with OAEP padding, which ensures that files are not decrypted without the attackers’ private key, a report from the Halcyon Research Team revealed. Qilin.B was also discovered by researchers to enable the termination of security tool services and backup and virtualization service process, as well as remove Windows Event Logs, volume shadow copies, and itself.

Source: SC Magazine