QSnatch (Malware Family)

QSnatch

The malware infects QNAP NAS devices, is persisting via various mechanisms and resists cleaning by preventing firmware updates and interfering with QNAP MalwareRemover. The malware steals passwords and hashes

References

2022-01-20 ⋅ Trend Micro ⋅ Stephen Hilt, Fernando Mercês
Backing Your Backup Defending NAS Devices Against Evolving Threats
QNAPCrypt QSnatch

2021-12-09 ⋅ Trend Micro ⋅ Veronica Chierzi
The Evolution of IoT Linux Malware Based on MITRE ATT&CK TTPs
Dark Nexus QSnatch

2020-07-27 ⋅ NCSC UK ⋅ NCSC UK, CISA
Alert: Potential legacy risk from malware targeting QNAP NAS devices
QSnatch

2020-07-27 ⋅ CISA ⋅ NCSC UK, CISA
Alert (AA20-209A): Potential Legacy Risk from Malware Targeting QNAP NAS Devices
QSnatch

2019-11-12 ⋅ Johannes Bader Blog ⋅ Johannes Bader
The DGA of QSnatch
QSnatch

2019-10-25 ⋅ Finnish Transport & Communications Agency ⋅ Finnish Transport & Communications Agency
QSnatch - Malware designed for QNAP NAS devices
QSnatch

Yara Rules

[TLP:WHITE] elf_qsnatch_w0 (20191113 | Detects QSnatch shell scripts)

/*
    based on these samples:
      - 09ab3031796bea1b8b79fcfd2b86dac8f38b1f95f0fce6bd2590361f6dcd6764
      - 5cb5dce0a1e03fc4d3ffc831e4a356bce80e928423b374fc80ee997e7c62d3f8
      - 8fd16e639f99cdaa7a2b730fc9af34a203c41fb353eaa250a536a09caf78253b
      - 9526ccdeb9bf7cfd9b34d290bdb49ab6a6acefc17bff0e85d9ebb46cca8b9dc2
      - 3c38e7bb004b000bd90ad94446437096f46140292a138bfc9f7e44dc136bac8d
      - 5130282cdb4e371b5b9257e6c992fb7c11243b2511a6d4185eafc0faa0e0a3a6
      - 15892206207fdef1a60af17684ea18bcaa5434a1c7bdca55f460bb69abec0bdc
*/
rule elf_qsnatch_w0 {
    meta:
        author = "Johannes Bader mail@johannesbader.ch"
        date = "2019-11-13"
        description = "Detects QSnatch shell scripts"
        
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.qsnatch"
        malpedia_version = "20191113"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $shebang = "#!/bin/sh"

        $pat_url = "https://${host}.${ext}/qnap_firmware.xml?t=$(date +%s)"
        $pat_public_key = "DNnpDGbq632Bs8ESd3ueHk9OY/UZxWeN3UdbseFxK35XAgMBAAE="
        $pat_decrypt_key = "7C0vK4SzMO15zBxLD7XCi5hbjgP1ZjkJ"

    condition:
        $shebang at 0 
        and any of ($pat_*) 
        and filesize < 200KB

}

Download all Yara Rules

QSnatch Propose Change

References

Yara Rules

QSnatch