eCh0raix Ransomware - QNAPCrypt/Synology NAS (.encrypt) Support Topic

 

Add me to the list. Most of the important stuff (read: baby pics, like everyone else) is backed up elsewhere so really I can just wipe the drives or throw them out or whatever but I have a bunch of dvd rips that didn’t get encrypted and I’d rather not have to re-rip them all again.

What can I do to make sure I keep my files from being contaminated going forward. In particular from the ransomware I’ve already got - I know I need to disconnect the NAS from the internet going forward.

Looks like I got hit in April and only now noticed which is….embarrassing…

 

 

If you got hit in April then read this thread from the start and go get Bloody Doll decrypter. There are also a few others listed that can help but you may be an easy fix.

 

Oh I was under the impression that anything that recent was a lost cause for someone unwilling to pay. But I guess it doesn't hurt to try.

 

I'm mostly concerned with not being so foolish going forward haha

Just received decryptor files from eCh0raix, however running the windows version by command line I get "files in use by another process..." and does not work. Anyone have an idea?? The encrypted files have been untouched since infected. Something in windows?

Any way to get the key and use a different program?

 

I too have been infected with this mailware

My qnap also had an external usb drive where he had made the infected copies as well.

I urgently need to recover these files.

all my files have .encrypt extension

Also tried various recovery programs on the external drive but to no avail.

Here is my ransom note

All your data has been locked (encrypted).
How to unlock (decrypt) the instructions found in this TOR website: http://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion/order/137kVes2na8z5svwjYnafUgrzmcWmoDs
Use the TOR browser to access .onion websites.
https://duckduckgo.com/html?q=tor+browser+how+to

Edited by danielino1981, 21 December 2021 - 04:09 PM.

Ok, New update, moving the infected files to another location and using the ECh0raix Decoder v.1.0.6  program, one can use the *.macro file included in the decrypt reply (once the ransom is paid) . The info sent from ECh0raix includes .exe and macros for various OS, just use the macro for your particular OS when asked for the key file.

Turns out the program works well, however does crash often when decrypting. It appears to have difficulty deleting some files after decrypting and then crashes. One option is to select the "not" delete option when decrypting. I was able to recover most files.

 

Now to establish a better firewall and data protection.

Hi all

Have caught this malware tonight.

Trying @blooddolly decoder 1.0.6) having the original and encrypted file gave no results. 

Just have run the server in Exhaustive mode for fun, maybe i'll be lucky (it can process about 10^8 tries in hour but it is so far from 2^256 of course)

 

The last ransom note looks like that

 

Hi all

Have caught this malware tonight.

Trying @blooddolly decoder 1.0.6) having the original and encrypted file gave no results. 

Just have run the server in Exhaustive mode for fun, maybe i'll be lucky (it can process about 10^8 tries in hour but it is so far from 2^256 of course)

 

A few days ago, my QNAP TS-469 was also infected by eCh0raix.  It appears to be the newer version.

Just to be clear, for this new variant, has anyone been able to find the decryption keys without paying the ransom?

Is it a lost cause to try the exhaustive search?
 

Thank you!

 

 

I had received this awesome gift on my Qnap too. This infected all of our files including all family pics, all business pics and documents. Yes I know I am a total idiot for leaving that open to this type of hack but I didnt take any of that seriously. I always thought no-one want the little guy and I will be the first to say I was wrong!

 

I tried the exhaustive search on 3 computers for over a week solid with no luck. I believe the chances of randomly trying keys is similar to hitting the lottery, not like BINGO lottery but more like powerball.

 

I paid, I really didnt want to but I did get everything back and paid their black friday sale of .021 BTC. I got it all and used the decryptor you are using pointing the find key at the files the pirates sent. All came back and I only lost about 10 files. I took this as a learning experience and spent time setting up NAS security including paying the small fee for McAffee Realtime scanning and turning on firewalls. 

Good evening,
today i opened the Qfile app from iphone to search for a file on my nas Qnap ts-212 (i made last update a week ago). To my surprise, I found all files with the .encrypted extension. In each folder there was a "README_FOR_DECRYPT.txtt" file. Within the instructions to connect to a website to find out with decrypting the files. I clearly didn't open the site.

I ran to disconnect the nas from the network and I immediately disconnected the external hard drive connected to the nas where I make weekly backups of the nas data.
Then I checked the status of the two home computers and at the moment they seem not to have been attacked (I did a swipe with malwarebytes).

Then I wanted to check the status of the external disk of the nas, that one with the backups, to find out if the data was saved. I connected it to an old laptop (the ubunti live didn't read the disk, it's ntfs) and it seems that miraculously the files are save. Actually on the root folder of the external hard disk there is the usual "README_FOR_DECRYPT.txtt" file but all the folders and files appear intact and readable. Is it possible?

So now I ask you how to recover the nas. At the moment I keep it disconnected and I would not know how to act also because by connecting it to the network I would be afraid of infecting other devices.
Furthermore, I would also like to analyze the external hard disk with the backup but the laptop on which I did the test is too old I can't even install malwarebytes.

Could you explain to me how to proceed step by step?

I attach picture of txtt

Thank you

Please, somebody help me!

First thing I would like to know is how check my external backup to be sure that is clean from ramsonware. I should I have check it?
Also my home computer, what kind of test I have to do to ensure are those clean from this ramsonware?

 

 

A few days ago, my QNAP TS-469 was also infected by eCh0raix.  It appears to be the newer version.

Just to be clear, for this new variant, has anyone been able to find the decryption keys without paying the ransom?

Is it a lost cause to try the exhaustive search?
 

Thank you!

 

 

I had received this awesome gift on my Qnap too. This infected all of our files including all family pics, all business pics and documents. Yes I know I am a total idiot for leaving that open to this type of hack but I didnt take any of that seriously. I always thought no-one want the little guy and I will be the first to say I was wrong!

 

I tried the exhaustive search on 3 computers for over a week solid with no luck. I believe the chances of randomly trying keys is similar to hitting the lottery, not like BINGO lottery but more like powerball.

 

I paid, I really didnt want to but I did get everything back and paid their black friday sale of .021 BTC. I got it all and used the decryptor you are using pointing the find key at the files the pirates sent. All came back and I only lost about 10 files. I took this as a learning experience and spent time setting up NAS security including paying the small fee for McAffee Realtime scanning and turning on firewalls. 

 

Hi , I have same issue , as you paid could you able to tell me what I have to do ? I'm not expert of dark web or bitcoin. please explain to me well. thanks

 

 

 

A few days ago, my QNAP TS-469 was also infected by eCh0raix.  It appears to be the newer version.

Just to be clear, for this new variant, has anyone been able to find the decryption keys without paying the ransom?

Is it a lost cause to try the exhaustive search?
 

Thank you!

 

 

I had received this awesome gift on my Qnap too. This infected all of our files including all family pics, all business pics and documents. Yes I know I am a total idiot for leaving that open to this type of hack but I didnt take any of that seriously. I always thought no-one want the little guy and I will be the first to say I was wrong!

 

I tried the exhaustive search on 3 computers for over a week solid with no luck. I believe the chances of randomly trying keys is similar to hitting the lottery, not like BINGO lottery but more like powerball.

 

I paid, I really didnt want to but I did get everything back and paid their black friday sale of .021 BTC. I got it all and used the decryptor you are using pointing the find key at the files the pirates sent. All came back and I only lost about 10 files. I took this as a learning experience and spent time setting up NAS security including paying the small fee for McAffee Realtime scanning and turning on firewalls. 

 

Hi , I have same issue , as you paid could you able to tell me what I have to do ? I'm not expert of dark web or bitcoin. please explain to me well. thanks

 

 

 

 

 

Merry Xmas to you all! Sucks that this keep happening and we need to learn our lesson here so we can stop this madness. First off I dont think we should be paying at all but since some us, including me, didnt keep up security and were lazy protecting our data there may be some that have no choice. I am no expert but I got this same thing and it took everything we had for our business and all personal. I am such an idiot with my QNAP security that I had to pay!

 

This is how I did it and hope that others will chime in if there is a better way. Follow their instructions and take you time in each step this is a multi day process if you dont already have a Coinbase account. Good thing is that the ransomers are also in no hurry at all. If you send to the wrong wallet the money is gone and you will never see it again and you will have to buy more BTC. I found it super easy using Coinbase. Go open a Coinbase account if you havent already and wait for all your approvals and checks that need to be done, can take a day or two. 

 

Make a complete copy of the encrypted files. Use a removable harddrive and keep a full copy of all the encrypted files. I cannot stress enough not to skip this step. This will help you recover anything that may get damaged while decrypting and you may be able to recover them.

 

While waiting go download the Tor Browser as the note suggests. https://www.torproject.org/download/

 

When you install do not se the highest security because it will block popups and you will not be able to chat with them if you have issues. Actually it is kinda funny because they are very helpful in chat if you have any issues.

 

Once its all set open the tor browser and copy and paste the address they gave you to get to the ransom page. There it will tell you how much Bitcoin is needed and where to send it. 

 

Go to Coinbase and buy the exact amount of bitcoin that is required. Do not worry about dollar amount buy the fraction of the coin, do not try to figure the price. Once you buy and everything on Coinbase is all approved you can go to the Send/Receive button in the top right of Coinbase. Make sure you choose Bitcoin (BTC) and use the up/down arrows to send bitcoin by fraction instead of dollar amount. Make sure you entire exact amount they are asking for. Then on the ransom page that give a long string of letters and numbers and tell you to send the money there, thats their wallet. Send the BTC to that address, copy from ransom page and paste in address to send BTC. 

 

Next step is to wait a couple days continuing to check to see if they received your funds. Once they do the ransom page will change to the decryptor. I would not use their decryptor but you still need to download it and save it. Go get the decryptor listed in this chat - https://www.bleepingcomputer.com/ransomware/decryptor/ech0raix-ransomware-decryptor-restores-qnap-files-for-free/

 

You will use that to decode instead of the hackers. Open the decryptor and click on get key from file and point to the file for the system you are using. If your on a windows 10 click on the win64 file in the decryptor the hackers sent you and test out a couple folders. If all is good you can run it on everything and delete the encrypted files.

 

Once everything is decrypted move all the files to a removable harddrive, throw out your NAS and get one that is supported. Move your data back to a new NAS with proper security, software updates, firewall and settings. Take the removable harddrive with all the unencrypted copy of all your data, unplug it and set it aside for a future backup. Every month or shorter if you change alot of files, plug in your removable harddrive and update your backup and unplug it again for storage.

 

I think with everyones help here we may be able to make a easy to follow guide to help step by step for paying if needed, getting to the onion site, decrypting and finally helping to set us all up for proper security going forward. The only way to beat these guys is to up our security so it cant happen again.

 

All please feel free to modify/correct anything I stated. As I said I am no expert but thats how I got all my files back.

Edited by jpman13, 25 December 2021 - 03:19 PM.

I removed the hard drive from the nas and quickly formatted it. Later I put the nas disk back and initialized it.
First I installed qnap's "Malware remover" which detected and removed two malwares: MR1702, MR 1902.
Can I feel safe now or I need to do some other operation?

https://i.postimg.cc/BnRP7Wth/image.png

Thank you

Edited by mtguido, 26 December 2021 - 11:29 AM.

I removed the hard drive from the nas and quickly formatted it. Later I put the nas disk back and initialized it.
First I installed qnap's "Malware remover" which detected and removed two malwares: MR1702, MR 1902.
Can I feel safe now or I need to do some other operation?

https://i.postimg.cc/BnRP7Wth/image.png

Thank you

The virus creates a user in the Admin group, if I remember right it was named 'wasthere'. You can either disable that account, delete it, or reinitialize the NAS entirely. I chose to disable the account so it couldn't be re-created.

Quite a few people seem to blame themselves for allowing the virus to happen, this is noone's fault but Qnap's. The vulnerability appears to be in PhotoStation. I would recommend uninstalling it.
The only thing any of us are to blame for being lazy is not ensuring we have reliable backups.

I removed the hard drive from the nas and quickly formatted it. Later I put the nas disk back and initialized it.
First I installed qnap's "Malware remover" which detected and removed two malwares: MR1702, MR 1902.
Can I feel safe now or I need to do some other operation?

https://i.postimg.cc/BnRP7Wth/image.png

Thank you

The virus creates a user in the Admin group, if I remember right it was named 'wasthere'. You can either disable that account, delete it, or reinitialize the NAS entirely. I chose to disable the account so it couldn't be re-created.

Quite a few people seem to blame themselves for allowing the virus to happen, this is noone's fault but Qnap's. The vulnerability appears to be in PhotoStation. I would recommend uninstalling it.
The only thing any of us are to blame for being lazy is not ensuring we have reliable backups.

Wait, I have already removed the disk from the nas and formatted it. then I reinserted the disk and initialized. after these steps i have installed malware remover and it found and removed the malware. I have no other account besides admin because I have initialized the disk. can I deem it totally clean now?