Ransomwarehigh
New eCh0raix Ransomware Variant Targets QNAP and Synology Network
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-28799 | Improper Authorization in QNAP HBS 3 Allows Remote Login to NAS Devices | 9.8 | 78% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion | linux_386 2[.]37.149.230/1/crp_linux_arm C2 Request hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id[.]onion/api/GetAvailKeysByApiKey/chuADfBHD8hpgVs7wH8eS3S0Vv-rusj6 |
| ipv4 | 161.35.151.35 | ApiKey/-xS-0UcHPaAJgaQCkyE29icDiJeAakj7 Socks5 Proxies used 161[.]35.151.35:9100 185[.]10.68.89:9100 185[.]181.229.175:9100 176[.]122 |
| ipv4 | 176.122.23.54 | .]35.151.35:9100 185[.]10.68.89:9100 185[.]181.229.175:9100 176[.]122.23.54:9100 Appendix 530 file extensions targeted by the new var |
| ipv4 | 183.76.46.30 | 61638d06f3fed7389e1b163da7a1cc62a666d0a88baf47 Payload URLs 183[.]76.46.30/1/crp_linux_arm 183[.]76.46.30/1/crp_linux_386 98[.]144.5 |
| ipv4 | 185.10.68.89 | QCkyE29icDiJeAakj7 Socks5 Proxies used 161[.]35.151.35:9100 185[.]10.68.89:9100 185[.]181.229.175:9100 176[.]122.23.54:9100 Appendix |
| ipv4 | 185.181.229.175 | ocks5 Proxies used 161[.]35.151.35:9100 185[.]10.68.89:9100 185[.]181.229.175:9100 176[.]122.23.54:9100 Appendix 530 file extensions ta |
| ipv4 | 2.37.149.230 | [.]42.152.46/h/crp_linux_386 64[.]42.152.46/h/crp_linux_arm 2[.]37.149.230/1/crp_linux_386 2[.]37.149.230/1/crp_linux_arm C2 Request |
| ipv4 | 64.42.152.46 | the device, aiming to fetch malware from the remote server 64[.]42[.]152[.]46 and run it on the victim device. The payload is still |
| ipv4 | 98.144.56.47 | 3[.]76.46.30/1/crp_linux_arm 183[.]76.46.30/1/crp_linux_386 98[.]144.56.47/1/crp_linux_arm 98[.]144.56.47/1/crp_linux_386 64[.]42.15 |
| sha256 | 039a997681655004aed1cc4c6ee24bf112d79e4f3b823ccae96b4a32c5ed1b4c | 07a5066a70087e83bbc7fd468ef46199d76f97f9e7f72f36 2021-07-28 039a997681655004aed1cc4c6ee24bf112d79e4f3b823ccae96b4a32c5ed1b4c 2021-07-28 551e03e17d1df9bd5b712bec7763578c01e7bffe9b93db24 |
| sha256 | 0b851832f9383df7739cd28ccdfd59925e9af7203b035711a7d96bba34a9eb04 | 99abd60dc26e9b068b63e5fcc498e700b8cc6640ca39261b 2021-06-21 0b851832f9383df7739cd28ccdfd59925e9af7203b035711a7d96bba34a9eb04 2021-06-21 19448f9aa1fe6c07d52abc59d1657a7381cfdb4a4fa54127 |
| sha256 | 0e4534d015c4e6691ff3920b19c93d63c61a0f36497cb0861a149999b61b98e1 | 0664ce08c2bf68249f33419d7decd866f3ade78626c95422 2020-09-04 0e4534d015c4e6691ff3920b19c93d63c61a0f36497cb0861a149999b61b98e1 Initial samples using the same project name as the new vari |
| sha256 | 0fa72e1644ed30436844eafc53c3003f0de056d68953673e0b5600099d0b5b8f | 50897e7d02346b843e38358a0c51b834d1971824c0a30b97 2020-06-03 0fa72e1644ed30436844eafc53c3003f0de056d68953673e0b5600099d0b5b8f 2020-06-03 88a73f1c1e5a7c921f61638d06f3fed7389e1b163da7a1cc |
| sha256 | 19448f9aa1fe6c07d52abc59d1657a7381cfdb4a4fa541279097cc9e9412964b | 739cd28ccdfd59925e9af7203b035711a7d96bba34a9eb04 2021-06-21 19448f9aa1fe6c07d52abc59d1657a7381cfdb4a4fa541279097cc9e9412964b 2021-05-28 7fa8ebcccde118986c4fd4a0f61ca7e513d1c2e28a6efdf1 |
| sha256 | 21d5021d00e95dba6e23cee3e83b126b068ad936128894a1750bbcd4f1eb9391 | 6facd9eae829d486dfc5b4f55b2814e28471c6d0e7c9bf49 2021-04-15 21d5021d00e95dba6e23cee3e83b126b068ad936128894a1750bbcd4f1eb9391 2021-03-31 283b2fa0fcddff18278d924c89c68bbcd980728761bd26c5 |
| sha256 | 230d4522c2ffe31d6facd9eae829d486dfc5b4f55b2814e28471c6d0e7c9bf49 | 58da1b1a7617d55d3fa4dc9679fff39993853e018fc28f8e 2021-04-16 230d4522c2ffe31d6facd9eae829d486dfc5b4f55b2814e28471c6d0e7c9bf49 2021-04-15 21d5021d00e95dba6e23cee3e83b126b068ad936128894a1 |
| sha256 | 283b2fa0fcddff18278d924c89c68bbcd980728761bd26c5dea4ec4de69b841e | 6e23cee3e83b126b068ad936128894a1750bbcd4f1eb9391 2021-03-31 283b2fa0fcddff18278d924c89c68bbcd980728761bd26c5dea4ec4de69b841e 2021-03-26 d2ebe2a961d07501f0614b3ba511cf44cb0be2e8e342e464 |
| sha256 | 2e3a6bd6d2e03c347d8c717465fec6347037b7f25adae49e9e089bc744706545 | 408904d8f6a2eb977113b3ac355c53dfd366e2903b428c62 2021-03-06 2e3a6bd6d2e03c347d8c717465fec6347037b7f25adae49e9e089bc744706545 2021-02-25 3c533054390bc2d04ba96089302170a806c5cdb624536037 |
| sha256 | 2fe577fd9c77d3bebdcf9bfc6416c3f9a12755964a8098744519709daf2b09ce | 0abcdf320bf7e5398d7bebf015643f8469f63d943b42f284 2021-07-28 2fe577fd9c77d3bebdcf9bfc6416c3f9a12755964a8098744519709daf2b09ce 2021-07-28 fedcce505a5e307c1d116d52b3122f6484b3d25fb3c4d666 |
| sha256 | 36cfb1a7c971041c9483e4f4e092372c9c1ab792cd9de7b821718ccd0dbb09c1 | 5b712bec7763578c01e7bffe9b93db246e36ec0a174f7467 2021-07-28 36cfb1a7c971041c9483e4f4e092372c9c1ab792cd9de7b821718ccd0dbb09c1 2021-07-28 bb3b0e981e52a8250abcdf320bf7e5398d7bebf015643f84 |
| sha256 | 3b93b18ae4f3aad450897e7d02346b843e38358a0c51b834d1971824c0a30b97 | 1807819bd0a3e18fe91bd390ec6c67fadc970d01c25f517b 2020-06-04 3b93b18ae4f3aad450897e7d02346b843e38358a0c51b834d1971824c0a30b97 2020-06-03 0fa72e1644ed30436844eafc53c3003f0de056d68953673e |
| sha256 | 3c533054390bc2d04ba96089302170a806c5cdb624536037a38c9ecb5aeea75d | 7d8c717465fec6347037b7f25adae49e9e089bc744706545 2021-02-25 3c533054390bc2d04ba96089302170a806c5cdb624536037a38c9ecb5aeea75d 2021-01-25 a8accaab01a8ad16029ea0e8035a79083140026e33f8580a |
| sha256 | 4691946e508348f458da1b1a7617d55d3fa4dc9679fff39993853e018fc28f8e | 6c4fd4a0f61ca7e513d1c2e28a6efdf183c10204550d87ce 2021-05-28 4691946e508348f458da1b1a7617d55d3fa4dc9679fff39993853e018fc28f8e 2021-04-16 230d4522c2ffe31d6facd9eae829d486dfc5b4f55b2814e2 |
| sha256 | 551e03e17d1df9bd5b712bec7763578c01e7bffe9b93db246e36ec0a174f7467 | aed1cc4c6ee24bf112d79e4f3b823ccae96b4a32c5ed1b4c 2021-07-28 551e03e17d1df9bd5b712bec7763578c01e7bffe9b93db246e36ec0a174f7467 2021-07-28 36cfb1a7c971041c9483e4f4e092372c9c1ab792cd9de7b8 |
| sha256 | 670250a169ba548c07a5066a70087e83bbc7fd468ef46199d76f97f9e7f72f36 | 9ce20487d98a3751dceb3efbee7bf70929a35b66416ae248 2021-08-06 670250a169ba548c07a5066a70087e83bbc7fd468ef46199d76f97f9e7f72f36 2021-07-28 039a997681655004aed1cc4c6ee24bf112d79e4f3b823cca |
| sha256 | 6df0897d4eb0826c47850968708143ecb9b58a0f3453caa615c0f62396ef816b | 1d116d52b3122f6484b3d25fb3c4d666fe7af087cfe85349 2021-07-13 6df0897d4eb0826c47850968708143ecb9b58a0f3453caa615c0f62396ef816b 2021-07-13 9f9bbbc80a2035df99abd60dc26e9b068b63e5fcc498e700 |
| sha256 | 74169aebae6412e5408904d8f6a2eb977113b3ac355c53dfd366e2903b428c62 | f0614b3ba511cf44cb0be2e8e342e464a20633ed7f1fc884 2021-03-26 74169aebae6412e5408904d8f6a2eb977113b3ac355c53dfd366e2903b428c62 2021-03-06 2e3a6bd6d2e03c347d8c717465fec6347037b7f25adae49e |
| sha256 | 7fa8ebcccde118986c4fd4a0f61ca7e513d1c2e28a6efdf183c10204550d87ce | d52abc59d1657a7381cfdb4a4fa541279097cc9e9412964b 2021-05-28 7fa8ebcccde118986c4fd4a0f61ca7e513d1c2e28a6efdf183c10204550d87ce 2021-05-28 4691946e508348f458da1b1a7617d55d3fa4dc9679fff399 |
| sha256 | 88a73f1c1e5a7c921f61638d06f3fed7389e1b163da7a1cc62a666d0a88baf47 | 6844eafc53c3003f0de056d68953673e0b5600099d0b5b8f 2020-06-03 88a73f1c1e5a7c921f61638d06f3fed7389e1b163da7a1cc62a666d0a88baf47 Payload URLs 183[.]76.46.30/1/crp_linux_arm 183[.]76.46.30/ |
| sha256 | 9d4bc803c256bd340664ce08c2bf68249f33419d7decd866f3ade78626c95422 | 029ea0e8035a79083140026e33f8580aae217b1ef216febc 2020-09-23 9d4bc803c256bd340664ce08c2bf68249f33419d7decd866f3ade78626c95422 2020-09-04 0e4534d015c4e6691ff3920b19c93d63c61a0f36497cb086 |
| sha256 | 9f9bbbc80a2035df99abd60dc26e9b068b63e5fcc498e700b8cc6640ca39261b | 47850968708143ecb9b58a0f3453caa615c0f62396ef816b 2021-07-13 9f9bbbc80a2035df99abd60dc26e9b068b63e5fcc498e700b8cc6640ca39261b 2021-06-21 0b851832f9383df7739cd28ccdfd59925e9af7203b035711 |
| sha256 | a8accaab01a8ad16029ea0e8035a79083140026e33f8580aae217b1ef216febc | 4ba96089302170a806c5cdb624536037a38c9ecb5aeea75d 2021-01-25 a8accaab01a8ad16029ea0e8035a79083140026e33f8580aae217b1ef216febc 2020-09-23 9d4bc803c256bd340664ce08c2bf68249f33419d7decd866 |
| sha256 | bb3b0e981e52a8250abcdf320bf7e5398d7bebf015643f8469f63d943b42f284 | 9483e4f4e092372c9c1ab792cd9de7b821718ccd0dbb09c1 2021-07-28 bb3b0e981e52a8250abcdf320bf7e5398d7bebf015643f8469f63d943b42f284 2021-07-28 2fe577fd9c77d3bebdcf9bfc6416c3f9a12755964a809874 |
| sha256 | cc112184b17d65229ce20487d98a3751dceb3efbee7bf70929a35b66416ae248 | tag. Indicators of Compromise First Seen SHA256 2021-08-06 cc112184b17d65229ce20487d98a3751dceb3efbee7bf70929a35b66416ae248 2021-08-06 670250a169ba548c07a5066a70087e83bbc7fd468ef46199 |
| sha256 | d2ebe2a961d07501f0614b3ba511cf44cb0be2e8e342e464a20633ed7f1fc884 | 278d924c89c68bbcd980728761bd26c5dea4ec4de69b841e 2021-03-26 d2ebe2a961d07501f0614b3ba511cf44cb0be2e8e342e464a20633ed7f1fc884 2021-03-26 74169aebae6412e5408904d8f6a2eb977113b3ac355c53df |
| sha256 | f6f6e34e93c4ec191807819bd0a3e18fe91bd390ec6c67fadc970d01c25f517b | 1b326dd9890681d21c97309fee61fdac8eb2081398e4d2b1 2020-07-06 f6f6e34e93c4ec191807819bd0a3e18fe91bd390ec6c67fadc970d01c25f517b 2020-06-04 3b93b18ae4f3aad450897e7d02346b843e38358a0c51b834 |
| sha256 | fe4efccf56f989bf1b326dd9890681d21c97309fee61fdac8eb2081398e4d2b1 | nt, but without the syno flag. First Seen SHA256 2020-07-06 fe4efccf56f989bf1b326dd9890681d21c97309fee61fdac8eb2081398e4d2b1 2020-07-06 f6f6e34e93c4ec191807819bd0a3e18fe91bd390ec6c67fa |
| sha256 | fedcce505a5e307c1d116d52b3122f6484b3d25fb3c4d666fe7af087cfe85349 | bdcf9bfc6416c3f9a12755964a8098744519709daf2b09ce 2021-07-28 fedcce505a5e307c1d116d52b3122f6484b3d25fb3c4d666fe7af087cfe85349 2021-07-13 6df0897d4eb0826c47850968708143ecb9b58a0f3453caa6 |
| url | https://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion/api/GetAvailKeysByApiKey/41xvlF4tQ1b3iXd5okwCNhcj7fh9gMB2 | n/api/GetAvailKeysByApiKey/chuADfBHD8hpgVs7wH8eS3S0Vv-rusj6 hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id[.]onion/api/GetAvailKeysByApiKey/41xvlF4tQ1b3iXd5okwCNhcj7fh9gMB2 hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6o |
| url | https://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion/api/GetAvailKeysByApiKey/chuADfBHD8hpgVs7wH8eS3S0Vv-rusj6 | 0/1/crp_linux_386 2[.]37.149.230/1/crp_linux_arm C2 Request hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id[.]onion/api/GetAvailKeysByApiKey/chuADfBHD8hpgVs7wH8eS3S0Vv-rusj6 hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6o |
| url | https://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion/api/GetAvailKeysByApiKey/hv3PWxhLkfOuNjE9u3eOGogbGSH2bGT0 | n/api/GetAvailKeysByApiKey/41xvlF4tQ1b3iXd5okwCNhcj7fh9gMB2 hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id[.]onion/api/GetAvailKeysByApiKey/hv3PWxhLkfOuNjE9u3eOGogbGSH2bGT0 hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6o |
| url | https://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion/api/GetAvailKeysByApiKey/-xS-0UcHPaAJgaQCkyE29icDiJeAakj7 | n/api/GetAvailKeysByApiKey/hv3PWxhLkfOuNjE9u3eOGogbGSH2bGT0 hxxps://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id[.]onion/api/GetAvailKeysByApiKey/-xS-0UcHPaAJgaQCkyE29icDiJeAakj7 Socks5 Proxies used 161[.]35.151.35:9100 185[.]10.68.89:9 |
From the original article
12 min read at unit42.paloaltonetworks.com
Unit 42 researchers have discovered a new variant of eCh0raix ransomware targeting Synology network-attached storage (NAS) and Quality Network Appliance Provider (QNAP) NAS devices. To achieve this, attackers are also leveraging CVE-2021-28799 to deliver the new eCh0raix ransomware variant to QNAP devices.
By Ruchna Nigam, Haozhe Zhang, Zhibin Zhang · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.