DeadBolt ransomware locks QNAP devices
What is QNAP ?
QNAP is a type of network attached storage nas, that consist of one or more hard drives, that are constantly connected to the internet.
The QNAP works as your backup hub or storage unit that stores all your important files and media.Such as photos, videos, and music.
You don't need external hard drive, NAS can be placed at home and accessible for you and your family to use at any time, and anywhere.
DeadBolt ransomware targeting QNAP devices?
DeadBolt ransomware is targeting QNAP devices and appending the .deadbolt extension to encrypted file's names.
|
| DeadBolt ransomware locks QNAP |
The ransomware is also hijacking the QNAP login screen to display a ransom note demanding 0.03 cryptos, worth approximately $1100. last time QNAP found solution for free when .7z encrypt their devices.
Each victim receives a unique crypto address and there is no confirmation that paying a ransom will provide a decryption key.
When a QNAP device is compromised a random named file will be created at HDA ROOT.
This random named file is the Linux ransomware executable used to encrypt and decrypt your device.
When executed, it will take a command line argument.
How to Decrypt DeadBolt ransomware ?
DeadBolt will also replace the index.html file so that when you access the device you will see a ransom screen instead.
this will prompt you to enter a decryption key that can be obtained by sending 0.03 bit-coins to a listed bit-coin address.
After payment, the threat actors will create another bit coin transaction to the same address that has the decryption key,for your device.
The decryption key is located under the OP RETURN output, as shown below.
When you enter this key into the ransom note screen, the web page will convert the key into a SHA 256 hash.
If that SHA 256 hash matches the SHA 256 hash of your device's decryption key, it will decrypt the device with that key.
If that SHA 256 hash matches the SHA256 hash of the master decryption key, it will decrypt the device with that key.
Users can bypass the ransom screen and gain access to their admin page by using some URLs shown in deadbolt ransomware video.
Emsisoft released the deadblot decryptor, you can download it Now from Emsisoft Decrypt Tools.
