What is QNAP ?
QNAP is a type of network attached storage nas, that consist of one or
more hard drives, that are constantly connected to the internet.
The QNAP works as your backup hub or storage unit that stores all your
important files and media.Such as photos, videos, and music.
You don't need external hard drive, NAS can be placed at home and
accessible for you and your family to use at any time, and anywhere.
DeadBolt ransomware targeting QNAP devices?
DeadBolt ransomware is targeting QNAP devices and appending the .deadbolt
extension to encrypted file's names.
|
|
DeadBolt ransomware locks QNAP
|
The ransomware is also hijacking the QNAP login screen to display a ransom
note demanding 0.03 cryptos, worth approximately $1100. last time QNAP
found solution for free when
.7z encrypt their devices.
Each victim receives a unique crypto address and there is no
confirmation that paying a ransom will provide a decryption key.
When a QNAP device is compromised a random named file will be created at
HDA ROOT.
This random named file is the Linux ransomware executable used to encrypt
and decrypt your device.
When executed, it will take a command line argument.
How to Decrypt DeadBolt ransomware ?
DeadBolt will also replace the index.html file so that when you access
the device you will see a ransom screen instead.
this will prompt you to enter a decryption key that can be obtained by
sending 0.03 bit-coins to a listed bit-coin address.
After payment, the threat actors will create another bit coin transaction
to the same address that has the decryption key,for your device.
The decryption key is located under the OP RETURN output, as shown
below.
When you enter this key into the ransom note screen, the web page will
convert the key into a SHA 256 hash.
If that SHA 256 hash matches the SHA 256 hash of your device's decryption
key, it will decrypt the device with that key.
If that SHA 256 hash matches the SHA256 hash of the master decryption
key, it will decrypt the device with that key.
Users can bypass the ransom screen and gain access to their admin page by
using some URLs shown in
deadbolt ransomware video.
Emsisoft released the deadblot decryptor, you can
download it Now from Emsisoft Decrypt Tools.
