Qlocker Ransomware Password

Qlocker Ransomware locks user files in password protected archives on QNAP server using 7z compression utility. Ransomware author demand a ransom of 0.01 BTC to get a password for their archived files. Luckily there is a way to recover password in order to do log in to your QNAP server via SSH using putty and execute following command

cd /usr/local/sbin; printf '#!/bin/sh \necho $@\necho $@>>/mnt/HDA_ROOT/7z.log\nsleep 60000' > 7z.sh; chmod +x 7z.sh; mv 7z 7z.bak; mv 7z.sh 7z;

if you are lucky you may find 7z.log open it, it will look something like this

/bin/sh /usr/local/sbin/7z a -mx=0 -sdel -pCcrP7PCP1euF0MBjD2C866YYi388m9jD /share/CACHEDEV2_DATA/4000GB/Photos/

remember content after -p is the password.

Qlocker Password Recovery

Update: This method is reported not working for everyone may be the attacker updated its ransomware.