ea294112a604c9fd4d7431ab20216c6d768d5569ab686da6f61be449d0996f78

Sharing

Copy URL Twitter E-mail

General

Target
ea294112a604c9fd4d7431ab20216c6d768d5569ab686da6f61be449d0996f78
Size 3.1MB
Sample260813-eterbs1fqf
SHA256 ea294112a604c9fd4d7431ab20216c6d768d5569ab686da6f61be449d0996f78
MD5 eb10541d1f8f746d7e9829132083c813
SHA1 0030e310e3fd4214bd1caed6c8db8ab77def2aea
SHA512 04074f0a27d0c98f46117da10162a9f22de1c9973466028b140257c47a5c2e0086a10c5bf75ba2dad9267e58c3f1a9c29736983f70e0b765ae5ab01a5af1d162
SSDEEP 98304:BeuMIz149yfGfMwbboXR/fD+bt0NftQefFriVjEN6jOR9g:9MyfQjbq7G+1QehMjD
TLSH
T149E5339DFB3D9A6AEC119C56472FB3B3149C32AEAF467DB1C92B4A717C1281F6507200
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence ransomware

Malware Config

Targets

- Target
  医务管理密改/医务/医务管理/~$评分数据库原文.docx
- Size 162B
- SHA256 be8de34d77f172f557c670212f6b1e845997dd27b221bac11bc37d86d4206bdf
- MD5 31acc4712ed25dc9317536cf762bcc7c
- SHA1 4746210f0ce41afad8d7aa873239bef5aa1bcb5b
- SHA512 9ab3b7ba526c3822d1a77a3ab5a3d2ce9f642f46b5679378541646566ac8dbc001f479462e151116d4e6e6b0662a904850c60d1518e0e04e1f72fe89306e4754
- MD5 SHA1 SHA512
Score

1^/10

persistence ransomware
behavioral1 behavioral2
- Target
  医务管理密改/医务/医务管理/病历评分数据库原文.docx
- Size 948KB
- SHA256 a196c28c9fa2a46265ad438596c21fadac0f5bcda7f0e4009786fa4f6b44ef85
- MD5 9d26d4d409a9960384fb64f3c32aeab0
- SHA1 f48c4e40555bb25e0886d6d8979a89ffd806b281
- SHA512 0e33d54fb71ff61efe1bdde85f0d6b68b94077900ff74e9aacb6a9cdfca8d66a691b5d6412814dda4c7b181620472b6d6817926c41537c5f158305225693b030
- SSDEEP 12288:DCZzyM3SfizKUxCZFO8YZTttM2IfF3ZPR+TvQBwHYK4qDEmpI7rqDw8QFU36Op:WZOkSffUxC0ZTtYfR2OwHYK4Mqq9y6
- TLSH
  T16725E037B1A00C99CD7CA930B0E7054349971C79473BD6B99D4B9AE2F1EEF85BC012A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  医务管理密改/医务/医务质控/~$医务质控.docx
- Size 162B
- SHA256 be8de34d77f172f557c670212f6b1e845997dd27b221bac11bc37d86d4206bdf
- MD5 31acc4712ed25dc9317536cf762bcc7c
- SHA1 4746210f0ce41afad8d7aa873239bef5aa1bcb5b
- SHA512 9ab3b7ba526c3822d1a77a3ab5a3d2ce9f642f46b5679378541646566ac8dbc001f479462e151116d4e6e6b0662a904850c60d1518e0e04e1f72fe89306e4754
- MD5 SHA1 SHA512
Score

1^/10

persistence ransomware
behavioral5 behavioral6
- Target
  医务管理密改/医务/医务质控/~$质控密改截图.docx
- Size 162B
- SHA256 be8de34d77f172f557c670212f6b1e845997dd27b221bac11bc37d86d4206bdf
- MD5 31acc4712ed25dc9317536cf762bcc7c
- SHA1 4746210f0ce41afad8d7aa873239bef5aa1bcb5b
- SHA512 9ab3b7ba526c3822d1a77a3ab5a3d2ce9f642f46b5679378541646566ac8dbc001f479462e151116d4e6e6b0662a904850c60d1518e0e04e1f72fe89306e4754
- MD5 SHA1 SHA512
Score

1^/10

persistence ransomware
behavioral7 behavioral8
- Target
  医务管理密改/医务/医务质控/医务质控.docx
- Size 860KB
- SHA256 dc04e52cfc4d60a4d03ab89ca31101496a877257cca4efdaaea707e5fc91b684
- MD5 4007043cc7a3a7e69802d3b2e4b02024
- SHA1 537b010800c0876249f9c6a9cf67076fca811f0f
- SHA512 47d7e58b48b6c3e59e8f5cb4a30d0622c99c8359b2a5655aba8f02ef80c5d176df8874d7f97bb64ab2ecbdc8e03dd7c9acf8e422d3a6eecfa8c5424a6482b054
- SSDEEP 24576:vdvx279QPejyTASd4sjhfAcvDRUUQqaVYcBhWweH8:Vq2ejyTASd9hpvW7ScLWwO8
- TLSH
  T1781522145172DE60EDDB077624571F823A36AA5E02F1CF23C3B9BD2CFD4ACAA8901647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  医务管理密改/医务/医务质控/医务质控密改截图.docx
- Size 199KB
- SHA256 7030dbc01b6fc55102617e572f035a170287a3ecd5efb32f1c894fa47fa8bf64
- MD5 d6eb43318862a2cd0fa4252952b7f0b3
- SHA1 2a9c5286f41214aabc7e5d633a251dc3a58692ce
- SHA512 bb4d7dae4cc2297e0da3f3274531e6f370725693d8448c99310bbfd0c08a3e97b25dd6b0e508a470f511870ed9be9f8832054b7855eb9a1fec2ac1b06ed84152
- SSDEEP 6144:7DMnKx0YI9Ik6sHub12KoUXB5ypeEvvppR7v1y:7DSKx0YSIk6sI2KyVvvpLk
- TLSH
  T17F14120C9E66C807EB63633461A05F79BB2D1A7FF459A347C631686A5E12F18322F71C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  医务管理密改/医务管理/DLLAPP/Fugle.CISYWGL.Contract.dll
- Size 30KB
- SHA256 18d310a9ed03c59047adf4732f403c4aedfe8525096105677a3525522ed8dbdb
- MD5 2a52ecef1ea0a9cae2c2c63fa2eb7898
- SHA1 f6b44befd242983b73d34bb3928708fce34feb55
- SHA512 626504f0287e9cbe93cf97bd8fcc1e8472c0ab63c1a6927e08b0038cb630d5d02d35289844797a97af7b5236c7bbc8e017fa4c52271ff44f1054289bb97d39db
- SSDEEP 768:yR5IoYKFAMC1fTq0Jii8pVK+cwr68a6hjg2:yR5r/3Co80pVK9a68a6h7
- TLSH
  T1C2E2D5D5AB9CC8FAF889923DFC5DA4492369D768421387DA32809C795E077C5234C3BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  医务管理密改/医务管理/DLLAPP/Fugle.CISYWGL.Entity.dll
- Size 107KB
- SHA256 d2e648c81099d40e5a7355d97f2b01d23b9b97893e4931bc5adc69cd876df5c9
- MD5 bdfd5cb4b8b1d6e0a454354fb39a15e0
- SHA1 d2b6623f040d747db4811bfdb42d4ad9245cdb5f
- SHA512 07f20be0e85d1971322c4cb4ae3749291e77898bdd32b1e0d88ad44ea9f691c7d98d8e2f869b96f7b72625b7bd8613b529e6d83f9db268e7194ed98775fa2409
- SSDEEP 1536:ml8m7JMSfe5/t3AM22QiN/iBUPwNZQesfaGN61dUrR44qcXhZ2XG/:8idPhQvHnsfxNmq
- TLSH
  T11AB362D11378D36DD9590576F2294C3E0647BA4D7476EAF2CB10F88B3A2CBCA61188BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  医务管理密改/医务管理/DLLAPP/Fugle.CISYWGL.cDllForm.dll
- Size 3.7MB
- SHA256 1daf02675af54ce472bbd1bc246cc96cbdc24e910059b3024bb7c5fc9b54e47e
- MD5 7faed4489563a6ce677c3c6e645f8649
- SHA1 7671feb1c625baae8cd68ff3308b8890f87bfb03
- SHA512 f09301a50776f78b3fb3b3480fa646d7b2e8ab100fa5bac57630c0e66b30e667827188a9f9095bb8f1fdb239af60712182b7442f5d170e52dd5f8354b9bc2b02
- SSDEEP 49152:YrBRV/sWxpGjS8osKTdth1f5TC6KPRrW+x:YrdNx15THKP
- TLSH
  T14D0683903A344F51D03E83F6225B152617F8AB1F85A4DA5ACCD2B9CA1CE1FC01A9FD5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  医务管理密改/医务管理/DLLAPP/Fugle.CISZDPF.Contract.dll
- Size 8KB
- SHA256 91044419b198a9275124517a32c5abbf533e793050751b3b75525589ec7e1be9
- MD5 409a1629e231a1ad729a6e12888774b0
- SHA1 82b7043993500c93cab42b833db1252e4f8c537f
- SHA512 7be8400d37caeacaf94da43001d5af20908d6daf7b08e2933e36650ec6c20f6971a67e9d3aa1c29643e3e64c9607b21799e0b40c7c48ec70b6a015d245992b99
- SSDEEP 192:CvS4i6IQTrOu0KrUvNGZJUq9vAt7oB5mHHPMe/ejSolf:ES4i6cR0U1GZJdFaPMLJ
- TLSH
  T17BF1B755EBF64733DDBB0AB9ECAA57400BB5EB108C42DF1F098A201B5C53E610E52676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  医务管理密改/医务管理/Fugle.CISYWGL.Contract.dll
- Size 30KB
- SHA256 18d310a9ed03c59047adf4732f403c4aedfe8525096105677a3525522ed8dbdb
- MD5 2a52ecef1ea0a9cae2c2c63fa2eb7898
- SHA1 f6b44befd242983b73d34bb3928708fce34feb55
- SHA512 626504f0287e9cbe93cf97bd8fcc1e8472c0ab63c1a6927e08b0038cb630d5d02d35289844797a97af7b5236c7bbc8e017fa4c52271ff44f1054289bb97d39db
- SSDEEP 768:yR5IoYKFAMC1fTq0Jii8pVK+cwr68a6hjg2:yR5r/3Co80pVK9a68a6h7
- TLSH
  T1C2E2D5D5AB9CC8FAF889923DFC5DA4492369D768421387DA32809C795E077C5234C3BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  医务管理密改/医务管理/Fugle.CISYWGL.Entity.dll
- Size 107KB
- SHA256 d2e648c81099d40e5a7355d97f2b01d23b9b97893e4931bc5adc69cd876df5c9
- MD5 bdfd5cb4b8b1d6e0a454354fb39a15e0
- SHA1 d2b6623f040d747db4811bfdb42d4ad9245cdb5f
- SHA512 07f20be0e85d1971322c4cb4ae3749291e77898bdd32b1e0d88ad44ea9f691c7d98d8e2f869b96f7b72625b7bd8613b529e6d83f9db268e7194ed98775fa2409
- SSDEEP 1536:ml8m7JMSfe5/t3AM22QiN/iBUPwNZQesfaGN61dUrR44qcXhZ2XG/:8idPhQvHnsfxNmq
- TLSH
  T11AB362D11378D36DD9590576F2294C3E0647BA4D7476EAF2CB10F88B3A2CBCA61188BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  医务管理密改/医务管理/Fugle.CISYWGL.sBizLogic.dll
- Size 42KB
- SHA256 22290f25c00d832948324512b60c995421dba7729f8ff010365cf40c225be489
- MD5 27f81bc0e7ef09128f16f7d3d3f7eddb
- SHA1 0eddacef8e92ac37f6bb53ec9b6b52b82367ee51
- SHA512 4830bb2894437b372a8e5fdf0f640c45ece83310d501624c2a38ad877020218adc802e9737c6aabc8a2313e1556ec9ca280a4e90834202954754cfcfafd24d67
- SSDEEP 768:Pqnp3zIJiHD1MibjI7ZORkHej0y43VKfT65Y68a6hjgmM:Pqnp1xMcjUZORk+YJ3VK+e68a6hu
- TLSH
  T1D813DC6C5EF42436C88CD3FC44EA45324B259A46CA53E3272781B0F6D8B771ADA471EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  医务管理密改/医务管理/Fugle.CISYWGL.sBizRule.dll
- Size 113KB
- SHA256 ac83bf65136387e29ecf42db34cfe6019dcbb992447ffdd140ca9e24443753dd
- MD5 45b72fd0503ada652cc1b526cb18ed36
- SHA1 b315eaf63cb55f363fe734845047f5737a3ca3d2
- SHA512 4e9bc26f8729c1111eabe6501c3be23e373a5a059e267481a77122f802395401286bf6df0538f147d371f711219ceaa47b5cb1b4b3a5600ebefe3d683fe85893
- SSDEEP 3072:n4fE233xE9BsL+/+6hC+UinSf+BBmWWZ2BGFrPK0EWz:4fE233xELBmPoQrPK0
- TLSH
  T13FB3D6887BF49F25EA7D85F5D6A0413153F0849AC181EBEA0CC6B4F70CB13AA5B49C67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  医务管理密改/医务管理/Fugle.CISYWGL.sDBBaseRule.dll
- Size 802KB
- SHA256 3eb73cf0a7e626d720b14212ada9e909ecf71e8a6ff264f61e2db6866d87522b
- MD5 e2b4c623e17b93a7805a3dccdfb139be
- SHA1 115201821063e8e1617848d0e7a93271033b4ddd
- SHA512 95eced067b160d524e6cb019cf372c324ff4a39b5f26a0a1ebb420efcd31bf26ed7a5c374c406aa57df368bd537e7f9099d69a9035aa370ffe8ea62d511b2e09
- SSDEEP 6144:ZmMlMWmJeT7kMiPPsu4crta8NeVGCq31gCPPe:ZmMlMWm4sa8NeVGCq31gCPP
- TLSH
  T14F05A44C338D4204D57C296556B84B2886B7B9BBD039D3BE0CCD69768BB37498960FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  医务管理密改/医务管理/Fugle.CISZDPF.Contract.dll
- Size 8KB
- SHA256 91044419b198a9275124517a32c5abbf533e793050751b3b75525589ec7e1be9
- MD5 409a1629e231a1ad729a6e12888774b0
- SHA1 82b7043993500c93cab42b833db1252e4f8c537f
- SHA512 7be8400d37caeacaf94da43001d5af20908d6daf7b08e2933e36650ec6c20f6971a67e9d3aa1c29643e3e64c9607b21799e0b40c7c48ec70b6a015d245992b99
- SSDEEP 192:CvS4i6IQTrOu0KrUvNGZJUq9vAt7oB5mHHPMe/ejSolf:ES4i6cR0U1GZJdFaPMLJ
- TLSH
  T17BF1B755EBF64733DDBB0AB9ECAA57400BB5EB108C42DF1F098A201B5C53E610E52676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32