Backing Your Backup: Defending NAS Devices Against Evolving Threats
Image Description
Common Information
Type Value
UUID 966d1712-db0e-4434-8c3e-0067db3d2262
Fingerprint 14cb6ac014f5366bbaf6041f85a5259790f0e72b9bfb09e5323b8cd3c9cdc9c2
Analysis status DONE
Considered CTI value 2
Text language
Published Jan. 19, 2022, 9:53 a.m.
Added to db April 14, 2024, 3:33 a.m.
Last updated Aug. 31, 2024, 6:47 a.m.
Headline Backing Your Backup: Defending NAS Devices Against Evolving Threats
Title Backing Your Backup: Defending NAS Devices Against Evolving Threats
Detected Hints/Tags/Attributes 160/2/218
Attributes
Details Type #Events CTI Value
Details CVE 16
cve-2021-28799
Details Domain 245
shutterstock.com
Details Domain 2
re.sh
Details Domain 110
exploit.in
Details Domain 33
start.sh
Details Domain 1
caaclothing.com
Details Domain 2
aquamangts.tk
Details Domain 1
hongying.biz
Details Domain 60
documents.trendmicro.com
Details Domain 604
www.trendmicro.com
Details Domain 32
www.qnap.com
Details Domain 243
cve.mitre.org
Details Domain 1373
twitter.com
Details Domain 224
unit42.paloaltonetworks.com
Details Domain 175
www.zdnet.com
Details Domain 81
blog.malwarebytes.com
Details Domain 23
www.synology.com
Details Domain 4
xmrig.com
Details Domain 1
community.synology.com
Details Domain 13
securityscorecard.com
Details Domain 98
www.ncsc.gov.uk
Details Domain 2
qnap.com
Details Domain 1
kb.synology.com
Details File 4
backup.php
Details File 14
readme_for_decrypt.txt
Details File 2
qnapsystem.php
Details File 153
config.json
Details File 1
wp-worm-war-the-botnet-battle-for-iot-territory.pdf
Details File 1
routers-still-compromised-.html
Details File 3
darkside-linux-vms-targeted.html
Details File 2
botnet-battle-for-iot-territory.pdf
Details File 4
compromised-.html
Details File 1
analysis-of-the-dovecat-and-hy4-linux-malware.html
Details sha256 1
c084c0bdf62ae17bda55d91e42f23893146455f799faf9e4548dd12417d1cb35
Details sha256 1
3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d
Details sha256 1
559e9c0a2ef6898fabaf0a5fb10ac4a0f8d721edde4758351910200fe16b5fa7
Details sha256 1
796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4
Details sha256 1
d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763
Details sha256 2
ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4
Details sha256 2
039a997681655004aed1cc4c6ee24bf112d79e4f3b823ccae96b4a32c5ed1b4c
Details sha256 2
0b851832f9383df7739cd28ccdfd59925e9af7203b035711a7d96bba34a9eb04
Details sha256 2
0e4534d015c4e6691ff3920b19c93d63c61a0f36497cb0861a149999b61b98e1
Details sha256 2
19448f9aa1fe6c07d52abc59d1657a7381cfdb4a4fa541279097cc9e9412964b
Details sha256 1
2093952483c2c8f419eb55e0ebaec718e0a1559d1115401ef6e29edfbc02793c
Details sha256 2
21d5021d00e95dba6e23cee3e83b126b068ad936128894a1750bbcd4f1eb9391
Details sha256 2
230d4522c2ffe31d6facd9eae829d486dfc5b4f55b2814e28471c6d0e7c9bf49
Details sha256 2
283b2fa0fcddff18278d924c89c68bbcd980728761bd26c5dea4ec4de69b841e
Details sha256 2
2e3a6bd6d2e03c347d8c717465fec6347037b7f25adae49e9e089bc744706545
Details sha256 2
2fe577fd9c77d3bebdcf9bfc6416c3f9a12755964a8098744519709daf2b09ce
Details sha256 2
36cfb1a7c971041c9483e4f4e092372c9c1ab792cd9de7b821718ccd0dbb09c1
Details sha256 2
3c533054390bc2d04ba96089302170a806c5cdb624536037a38c9ecb5aeea75d
Details sha256 2
4691946e508348f458da1b1a7617d55d3fa4dc9679fff39993853e018fc28f8e
Details sha256 2
551e03e17d1df9bd5b712bec7763578c01e7bffe9b93db246e36ec0a174f7467
Details sha256 2
670250a169ba548c07a5066a70087e83bbc7fd468ef46199d76f97f9e7f72f36
Details sha256 2
6df0897d4eb0826c47850968708143ecb9b58a0f3453caa615c0f62396ef816b
Details sha256 2
74169aebae6412e5408904d8f6a2eb977113b3ac355c53dfd366e2903b428c62
Details sha256 2
7fa8ebcccde118986c4fd4a0f61ca7e513d1c2e28a6efdf183c10204550d87ce
Details sha256 1
8e3fdb5baeaa667862d427a67ba1fa10853f07b3c671a1bffa4952937627125a
Details sha256 2
9d4bc803c256bd340664ce08c2bf68249f33419d7decd866f3ade78626c95422
Details sha256 2
9f9bbbc80a2035df99abd60dc26e9b068b63e5fcc498e700b8cc6640ca39261b
Details sha256 2
a8accaab01a8ad16029ea0e8035a79083140026e33f8580aae217b1ef216febc
Details sha256 2
bb3b0e981e52a8250abcdf320bf7e5398d7bebf015643f8469f63d943b42f284
Details sha256 2
cc112184b17d65229ce20487d98a3751dceb3efbee7bf70929a35b66416ae248
Details sha256 1
ccd846a074a4a7e9ad40d11e7125322efe381bac6c25fa3cfc07b9b2941c4002
Details sha256 2
d2ebe2a961d07501f0614b3ba511cf44cb0be2e8e342e464a20633ed7f1fc884
Details sha256 2
fedcce505a5e307c1d116d52b3122f6484b3d25fb3c4d666fe7af087cfe85349
Details sha256 4
984ce69083f2865ce90b48569291982e786980aeef83345953276adfcbbeece8
Details sha256 4
9cc3c217e3790f3247a0c0d3d18d6917701571a8526159e942d0fffb848acffb
Details sha256 1
c16fc61415f537f42b9d813cd9538898f53865e1f5b46f25db2ab26bad2dffd2
Details sha256 4
c93e6237abf041bc2530ccb510dd016ef1cc6847d43bf023351dce2a96fdc33b
Details sha256 4
da3bb9669fb983ad8d2ffc01aab9d56198bd9cedf2cc4387f19f4604a070a9b5
Details sha256 1
00b522d18df034aff252a0bbf0c558ee201bcd50915f1ee61205998daaba3bfc
Details sha256 1
011dc45c80330b74e2966ba498caf664c5ed2ec3bf42d89ff838723952d3ad80
Details sha256 1
06f70c14fb5ef90f7d3b755ba3f0375265dd5c5514b1cd9619f97477643b19bd
Details sha256 1
0956bee618e9559afa1054b27e32060db419dd92a5aefa536fc5eb8eaf42ae8b
Details sha256 1
09e2959447d6915e01d9214182af442ff7ddaa85531a3d9a418a91988f05075e
Details sha256 1
0a8b5c7ceef3068326aeba85d7682b87528768e4e719343dccae26fbb5f4ec65
Details sha256 1
0ab92cb02b4a89cd17c41ee9b796708b63ef485b49e12e5797a9277f1fbba5a5
Details sha256 1
0d8f0596d278ee601eff8afb6dd8b0c722a483bd70617e2d9ea0df293734463e
Details sha256 1
10b06641dc0f7327f86928a6a806441cb7461495d86aa6995e0f933af6398430
Details sha256 1
18289752fce41c493f8586c46305bada7dd25cd220ba46432ad0610fe3760c5c
Details sha256 1
18919aa67020135d7a25c5b2db7771746d44aa8dd9a0fad7a55892c444829c4e
Details sha256 1
194aca964ebdc059258f39835c85bafc41d8779655fbc3870c45efd28d986617
Details sha256 1
198c2181bf8d83e3675995eef75b91d61a9c2762338fcc71f1a67edd35a73c29
Details sha256 1
242c0df5f0abff4e15a25db6649ab2da6f71d5cd901ad83bcadf03f3e38d29b3
Details sha256 1
255a59f16670cb5d959da0435e053c32036999638d22875dcbdaacea7365b0fc
Details sha256 1
2c56667ed1671ff52999cf67e5f2fee31424a0afa3e4995ae8867b759dd49753
Details sha256 1
2f27b57e045b963da63ccad229dd80a19589a58ca414aad12d38e438b9b96fcf
Details sha256 1
2faf4181b6c2434df493676f87a87bda3a0d00bdaa6f57d74ddd5e139d6df71e
Details sha256 1
3583c86517a9d7f37294ab8076595d904dd24cef6de16f6833338e559f95e327
Details sha256 1
3c765908c64bd9e553822e3af4a06a63e1860fa4d2ea1940472aacd14c15fe08
Details sha256 1
41b56f6faded9b15709cdc4da8773e9346f8377ce3d467289daf70a688dd177e
Details sha256 1
4219b1e74e1e2ab07164ebf800bf479455b657b396398f08cd5f2d626c67e3bd
Details sha256 1
4393a4e6eb41b55b83adbbbb0dab6da1a9f061f3761c4d78f279e1814807eccd
Details sha256 1
454c4aeb965877c7e4471787c4e0501f7204b481fd9e431841aa4788297993d9
Details sha256 1
45eabf4d2c123825ae31ebe7f29adbdc8b74471fe198e955b0c4e4097510a935
Details sha256 1
4a3384e65f82229bde7bc08c7a999340b74a306b9b79b5cc17793ba803eeeb46
Details sha256 1
4cb0006871d8cb7879b6cb529eaa713ef4c0f7a491c518b2278cae814aee2d14
Details sha256 1
4e1a3bbe7e1383195cefbf9588f139d601cd42ad903d0d36060beaf17a5d8086
Details sha256 1
5189c4e8e00d72b1aee7d791a290e77218cabaaa4e846225c5a2d7f0816ca61c
Details sha256 1
51c5770a8fde8ecdc55c012a06563f792edf38e3c8058dbd0eaf05e86297351f
Details sha256 1
522a0629587aeeb8f1cf1e76c3103fd62bb50c7c51859e55df7254c27aa3740c
Details sha256 1
58a87ad85d0de2409cdb0a43c56cdc99e064f1b8f50d2d735f9147698bf2ebc8
Details sha256 1
590d4fe4cb89e81266969a60c827ebbdf81fd0cf904bab88db770c84cdde8d73
Details sha256 1
5b8ea3fa55874e66d54126680c475731e8c3ec9e9d81208193cc52406fc8fff7
Details sha256 1
5ba347c3d656c3092dd79808e8de5f56c84fd3bda06726c892d67b7c4db1400a
Details sha256 1
5c1171253f75b81c5536206cfeb04da30d691fcb4627dabc474ef7326b613ac1
Details sha256 1
5c97d8fd565fff27af7195c05f49b02003b77ef96d6538804db5e792349674ca
Details sha256 1
5fabc6ae7049f39921d5867dfcad0aca081fc1954142262fec23bc7fbc320c5c
Details sha256 1
6535fcd6c18c94fa85f9c979115f902e631d8e82c863cb112e7e44b5b6a1f61e
Details sha256 1
6582bf7b092c5d0eb8b8be9950b0874b2d3f83519344565bb6ba79cbb289ac14
Details sha256 1
67b3b3f982e34f3ee51f3bcda5db65d89adb214e18eb134f2408dbc89c8e3adf
Details sha256 1
6b463e18e01f47269d6cd7509aa6d2788cc2e7473bc9b8169bdb003f2f61c913
Details sha256 1
6e7694ae8dd15e3b4e0a5a9d3131715ec2f17deb53285609d00d34cb8ffec0a8
Details sha256 1
6faf30a11465894c125a6983d9667d82dfb183a2f1289197b55717d1424fc5b3
Details sha256 1
73449107f1bf81972351a4ab1d2c2a535603b5c7fc13396bc99a6362d978cea7
Details sha256 1
7477404c6e5fb07b425048598baa2af0e58f0334649e2923af250faef3241192
Details sha256 1
75cc1c70305377ab0b86c310bc67e8c5fe86a66988c55f9f2ec5d679dee26c63
Details sha256 1
76fbab1afd421201a25fe8b143807c9f92f6d9c9fad8594cdf146eded3e68ff9
Details sha256 1
79cda18c2042a425d92d6bb83a42d8ba684687683c5465fba2148d421170100b
Details sha256 1
7a2b89b67bc2af4f9941090d25d302f34010ef3e5ea3d019b1664dd77a22786c
Details sha256 1
7fd2af75160c6ce8f41fbfffb9b895b2b3fa49ebfa80086f0f3bdc24a64a89bd
Details sha256 1
84dfa212005b4035401a1fb2f4595550302aaf237f8306700dc597dde046e78b
Details sha256 1
8945661affddc330564c4450282ec99a914d7daf29129adb5f9a4802138c6beb
Details sha256 1
917aa25f8496f3b7a191523693e9cda6eaab6045894c203627a6f0b88b3de892
Details sha256 1
943d663609c98cbcb090b9811e987d0524dc5f2bebf69fb2005f4c2fed4e0334
Details sha256 1
9e27260c7466320ca00a4f172f373371f3e15b53f846c0f03c4c81f8d531266d
Details sha256 1
a28302658da800b44a2cdf50c434bc7fef314b59640d597253d1b1b230c3c9c0
Details sha256 1
a4fe359f2605850b92e083b25463af91a489d65f573d9802523d0622521d3c05
Details sha256 1
a567dd30cf544f92e0011574133dcee3e212e0e2d93b2eb7b1f1568f7271ee06
Details sha256 1
a75f03ebab61b8333063d099050cbb14cc3d62f327b5d08c3dc465b3719bfa06
Details sha256 1
ae2792360d25844e752ec45c5751fe8a91d9921cc57563618f2634fae3de3d3c
Details sha256 1
ae3f551d2bbaeee5cb4d799868d23bc9e8335c6a5f1b0d57e376ad05fb24601e
Details sha256 1
b255a07089d1f5b3cb00847e8c1ac99f15b10dfc21a441cdfdf2fd8cc4574531
Details sha256 1
b30c41280d1044b179d001125cce7d5a17961b549a942a80e68ea1cd805cd330
Details sha256 1
b9545c4bea3c3889bdbb6d24575b792765a4af61a30a3f72c3655d3762009fcc
Details sha256 1
b99d1c9433845e6929fda419a735abfb8414fa9aeff4885d194259e9348aecfc
Details sha256 1
bae220e07ab8ebce0ea32067534ff5213e51cdc1158992dd48b778f4fef03a7b
Details sha256 1
c196aa480ca9933631ef21cade491d1313f205616021951a98dd549514a97dde
Details sha256 1
c43a60dad2a09dc27c047f85bccd5ada28bab9e97395e952fd398b6b0ec98d82
Details sha256 1
c7d061ad6848084a826f3df421e32d5184167f70c36687223cb3e1a2c38b8689
Details sha256 1
c8b5ec142c416456b0aea1a220a533e18c3f74a2ffbfa9d5722ac56af65a536c
Details sha256 1
c904b9b6782a9809c6e8fc88b24c6852017e50802d7d734dc6cb4c2a70513cca
Details sha256 1
ca9c1045711514d705e5f8a019ded550a6517a0627a6a91537451d8ce9ba2c82
Details sha256 1
d0ab3c1004c43276236ced367aa6bf705d580813348bd041fa4b37722d6ebc0a
Details sha256 1
d16511c9791f78060f1e958646e9a61c47c8f3052727085c907621f4ac1ab132
Details sha256 1
d309b3ba20ddc0a7d77b16fa5810750f0e514cf3f6e6408f44ab7e1f452d2446
Details sha256 1
d56f3f48bf84a65f60dc2da3ee689cf6a20be55b7aa65f7de1c942231c94e0a6
Details sha256 1
d70511f773f0b825b3e3217276fc4c05b55d1f5dc10ac5b5078fc26f82ffed50
Details sha256 1
da334829f7fafc3826334a1d8af016e9e4107d1f0c3697f6a9503ee1c86b4242
Details sha256 1
da74a02b0a2cb4aa195c03be31783b40ed0d0784843627e2f8e1f34f0e410f34
Details sha256 1
dcd1ffdbd378409bd3dbf451968288d5cd96e77ea34e453b6f06c2b4bd541715
Details sha256 1
dde51499451ccdefbc315f73a0c6ab59bc8e0af17db5f1134336249aa28b3ec3
Details sha256 1
de335bf6fca87887b1452d866eb8cd9b2202f3ca1af84a087d052dc809c01f7c
Details sha256 1
e5a15d6dcb11297635127c486f14611a0232060736044e6dc317d6234f16085f
Details sha256 1
ee97250b4bd2801b7a82385e076fca498f14163950f84d4efae98080000b520b
Details sha256 1
f377ad557d27b764ba060d122dd0b80192e19d092887218521819f08fede2a31
Details sha256 1
f4270d32fd87a6d98a4cf82968389b2775f6ec665f1fdfcee0aa9549bc2901e9
Details sha256 1
f7225c2ee2a5555f50dce65b14de3a47917ff84236b32731db65acf323879d99
Details sha256 1
f9b87391b13215272e088a605540d2260fc2076fb237a6cdb674172a4e600555
Details sha256 1
fab29d4690765c4e6f6d7b1ea229443badc55e606eb7799f7f73833400c9b69d
Details sha256 1
fe0771b0ebca55f3b1898b7d40ee51b42735bc2ed1fe298c808e0c0c2823ba97
Details sha256 1
adbd60b39b3aee3cd031995e439644583aecc4877162ac50d8d438ef77f7712b
Details sha256 1
e1f9b523dd3e2e0ff4eb90428779fde0e8241c285c771fd90240a994b8ec739b
Details sha256 1
e23c9507ee0a00cd5c7a94c43a4345f75b4793c1210ea36db1d0d84d82e5dd9e
Details sha256 1
10c0ed6e8223e4c18475c39beec579911bb18d5e64bf33d2de051c9c59138a08
Details sha256 1
df1bf44d467ab16debfb7aedfa5e963fc567640bf96fd5837bfb2e7dd481c23f
Details sha256 1
fcf1bd7bac112481bb80751fe8121f290c172f80fe578f756c6149d6be9f60d0
Details sha256 1
0723031d53c8c1d14d3d5d531564022229b276405dc5b888e65f08c801547c35
Details sha256 2
09ab3031796bea1b8b79fcfd2b86dac8f38b1f95f0fce6bd2590361f6dcd6764
Details sha256 2
15892206207fdef1a60af17684ea18bcaa5434a1c7bdca55f460bb69abec0bdc
Details sha256 2
18a4f2e7847a2c4e3c9a949cc610044bde319184ef1f4d23a8053e5087ab641b
Details sha256 2
3615f0019e9a64a78ccb57faa99380db0b36146ec62df768361bca2d9a5c27f2
Details sha256 2
3c38e7bb004b000bd90ad94446437096f46140292a138bfc9f7e44dc136bac8d
Details sha256 2
473c5df2617cee5a1f73880c2d66ad9668eeb2e6c0c86a2e9e33757976391d1a
Details sha256 2
4b514278a3ad03f5efb9488f41585458c7d42d0028e48f6e45c944047f3a15e9
Details sha256 2
5130282cdb4e371b5b9257e6c992fb7c11243b2511a6d4185eafc0faa0e0a3a6
Details sha256 1
525c2b85684a634cf3b43967e32eb1bf42bf65b40c78bebb4eae5a7ff3454be3
Details sha256 2
55b5671876f463f2f75db423b188a1d478a466c5e68e6f9d4f340396f6558b9f
Details sha256 2
5cb5dce0a1e03fc4d3ffc831e4a356bce80e928423b374fc80ee997e7c62d3f8
Details sha256 2
62426146b8fcaeaf6abb24d42543c6374b5f51e06c32206ccb9042350b832ea8
Details sha256 2
6e0f793025537edf285c5749b3fcd83a689db0f1c697abe70561399938380f89
Details sha256 1
7c7bfde74607fc90d5aca245dfca751e8017f20066c4ac44dcabd8f148b54564
Details sha256 2
845759bb54b992a6abcbca4af9662e94794b8d7c87063387b05034ce779f7d52
Details sha256 2
8fd16e639f99cdaa7a2b730fc9af34a203c41fb353eaa250a536a09caf78253b
Details sha256 2
9526ccdeb9bf7cfd9b34d290bdb49ab6a6acefc17bff0e85d9ebb46cca8b9dc2
Details sha256 1
ab90c167bb332b0ec05a8fb555d4e00a08ec1ee1b9d89fce81795929f414a22d
Details sha256 1
b7a8c1cdb8846dd2b18861e35da4a9cd7df25ca497b2500adf5992f15708b3a2
Details sha256 1
d6017dd6db4d969b2c8b55f37f0c50f4f48506c41ced733fd90c865ebdc5713b
Details IPv4 2
161.35.151.35
Details IPv4 2
176.122.23.54
Details IPv4 1
178.128.198.212
Details IPv4 2
185.10.68.89
Details IPv4 2
185.181.229.175
Details IPv4 1
158.69.22.139
Details IPv4 1
174.62.79.238
Details IPv4 2
183.76.46.30
Details IPv4 2
2.37.149.230
Details IPv4 2
64.42.152.46
Details IPv4 2
98.144.56.47
Details Url 1
http://ip.of.the.nas/backup.php
Details Url 7
https://documents.trendmicro.com/assets/white_papers
Details Url 1
https://www.trendmicro.com/en_us/research/21/a/vpnfilter-two-years-later-
Details Url 1
https://www.qnap.com
Details Url 5
https://cve.mitre.org/cgi-bin/cvename.
Details Url 4
https://unit42.paloaltonetworks.com
Details Url 1
https://www.zdnet.com/article/colonial-pipeline-cyberattack-shuts-down-pipeline-that-
Details Url 3
https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
Details Url 2
https://documents.trendmicro.com/assets/white_papers/wp-worm-war-the-
Details Url 3
https://www.trendmicro.com/en_us/research/21/a/vpnfilter-two-years-later-routers-still-
Details Url 1
https://unit42.paloaltonetworks.com/new-mirai-variant-
Details Url 1
https://blog.malwarebytes.com/threat-analysis/2019/02/new-golang-brute-forcer-discovered-
Details Url 1
https://www.synology.com/en-global/company/news/article/bruteforce.
Details Url 1
https://xmrig.com/docs/miner/config.
Details Url 1
https://ruffell.nz/reverse-engineering/writeups/2020/10/27/analysis-of-the-dovecat-and-hy4-linux-malware.html
Details Url 1
https://www.ncsc.gov.uk/news/legacy-risk-malware-targeting-qnap-nas-devices.
Details Url 1
https://kb.synology
Details Url 1
https://kb.synology.com/en-us/dsm/tutorial/how_to_add_extra_security_to_your_synology_nas.