Overview

overview

10

Static

static

3

77714a501b...e9.exe

windows10-2004-x64

10

77714a501b...e9.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
  • Size 521KB
  • Sample260916-kydbyshm41
  • SHA256 77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistenceransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Downloads\数据恢复说明_README.txt

Ransom Note
  • ================================================================================ 您的文件已被加密 / YOUR FILES HAVE BEEN ENCRYPTED ================================================================================ 【中文说明】 贵公司的所有重要文件已使用 AES-256 + RSA-4096 军事级加密算法加密。 所有备份系统（含 NetBackup 55TB 备份）、数据库灾备（Oracle Data Guard / MSSQL Log Shipping）均已被同步销毁，无法通过任何已有备份恢复。 ◆ 重要警告：在过去数周内，我们已全面渗透贵公司内部网络，并下载了 数TB规模的核心业务数据，涵盖全部数据库、文件服务器及备份系统。 如果未能在规定时间内达成协议，这些数据将被公开发布或出售给竞争 对手及第三方。 您的唯一标识码: 1ea386a96a6bfd5ab710e743eb2a6e7a 已加密/销毁的核心业务系统包括： 1. 金蝶 EAS 财务/人力/供应链核心系统 (Oracle, 3.7TB) 2. 金蝶 EAS 业务数据库 (Oracle, 1.35TB, 含 8,496 张业务表) 3. 药品管理系统 PMS (MSSQL, 含全部药品/处方/库存数据) 4. OA 办公自动化系统 (ecology9, 含全部审批流/合同/公文) 5. CRM 客户关系管理系统 (含全部客户/销售/订单数据) 6. 人力资源系统 (17,000+ 员工信息, 含身份证号/手机号/薪资) 7. 采购管理系统 (61,500+ 用户, 含供应商/合同/报价) 8. 电子签约系统 (全部电子合同/签章记录) 9. ERP 生产管理 (物料/BOM/生产工单/质量检验) 10. 一卡通系统 (门禁/考勤/消费记录) 11. 文件服务器 (专利文档/技术资料/财务报表/审计材料) 12. 所有 NetBackup 备份 (3 台存储节点, 55TB 物理数据, 已销毁) 13. Oracle Data Guard 灾备 (实时同步副本, 已断开并销毁) 14. MSSQL Log Shipping 灾备 (3 条链路, 已断开并销毁) 15. 全部域控制器及 Active Directory (986 台域内计算机) ◆ 我们已掌握的数据 ◆ • 金蝶 EAS 财务系统完整数据库（全部财务报表/凭证/往来款/成本核算） • 17,000+ 员工完整个人信息（身份证号/手机号/家庭住址/薪资明细/社保） • 61,500+ 用户采购系统数据（供应商/合同/报价/中标记录） • 全部采购合同/投标文件/供应商报价单/定价策略 • 专利文档/药品配方/技术资料/研发数据/质检报告 • OA 系统全量数据（审批流程/内部通信/管理层会议纪要/决策记录） • CRM 客户数据（全部客户信息/销售记录/订单历史/回款明细） • 药品管理系统核心数据（全部药品注册/处方/库存/GMP 相关文件） • 电子签约系统（全部电子合同原件/签章记录/法律文件） • GitLab 代码仓库（内部系统源码及硬编码凭据） • Active Directory 域控数据（全部用户账户/密码/组策略/网络拓扑） • 邮件系统通信记录及附件 ◆ 赎金金额 ◆ USD $800,000 = 5350000人民币 24小时内联系并在3天内完成支付可享受折扣价: USD $500,000 = 3350000人民币 上述金额包含： 1. 全部文件的解密工具及技术支持 2. 永久删除我们持有的所有贵公司数据（提供删除证明） 3. 安全漏洞报告（告知入侵路径，防止再次发生） 4. 我们承诺不公开、不出售、不再次联系 可通过以下加密货币支付： BTC: 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw XMR: 86MB9FuijDj2Cxi4vPEBXKTo5qadAE2GUPP5K8wA5LuNHFe3NcCytfAapC5MJjWEWYCSmxQpW7USiQcExuaRjwQF3UVzSM8 ETH (ERC20): 0x3b03709d520ac631e1Bc1eAD8706eE30593F0B6b USDT (TRC20): TQYxfsGpdFuubdbq9MRXz8R2DQC3pfpdK4 ◆ 时间期限 ◆ 您有 24 小时联系我们开始谈判。 逾期后果如下： • 第 1 天未联系 → 赎金金额翻倍，并在公开渠道发布贵公司数据泄露公告 • 第 3 天未达成协议 → 公布部分数据样本（含员工身份证信息/财务数据） • 第 7 天 → 全量数据公开发布或出售给第三方/竞争对手 数据一旦公开即不可撤回，届时即使付款也无法阻止已传播的数据。 此外，个人信息泄露将触发《个人信息保护法》合规调查。 ◆ 请勿执行以下操作 ◆ • 重命名已加密文件 • 使用第三方工具尝试解密（会永久损坏文件） • 重装操作系统 • 联系执法机构（他们无法帮助恢复，且调查介入将导致我们立即公开数据） • 关闭或重启服务器（可能导致加密状态异常） • 试图自行恢复 — 所有备份系统及灾备副本均已被销毁 ◆ 如何恢复数据 ◆ 1. 通过以下方式联系我们，并提供您的唯一标识码 2. 我们将免费解密 2-3 个文件作为解密能力证明 3. 我们将提供已下载数据的样本截图作为数据持有证明 4. 达成协议后提供完整解密工具 + 永久删除所有数据 联系方式 / Contact: Email-1: [email protected] Email-2: [email protected] ================================================================================ [ENGLISH] All critical files across your organization have been encrypted using military-grade AES-256 + RSA-4096 encryption. All backup systems (including NetBackup 55TB), disaster recovery replicas (Oracle Data Guard / MSSQL Log Shipping) have been destroyed simultaneously. Recovery through existing backups is impossible. ◆ CRITICAL: Over the past several weeks, we have fully infiltrated your internal network and downloaded terabytes of core business data covering all databases, file servers, and backup systems. If an agreement is not reached within the specified timeframe, this data will be published or sold to competitors and third parties. Your unique ID: 1ea386a96a6bfd5ab710e743eb2a6e7a Encrypted/destroyed core business systems include: 1. Kingdee EAS Finance/HR/SCM Core System (Oracle, 3.7TB) 2. Kingdee EAS Business Database (Oracle, 1.35TB, 8,496 tables) 3. Pharmaceutical Management System PMS (MSSQL, all drug/prescription/inventory data) 4. OA Office Automation (ecology9, all approvals/contracts/documents) 5. CRM Customer Relationship Management (all customer/sales/order data) 6. HR System (17,000+ employee records including ID numbers/phone/salary) 7. Procurement System (61,500+ users, supplier/contract/quotation data) 8. Electronic Contract Signing System (all e-contracts/digital seals) 9. ERP Production Management (materials/BOM/work orders/quality inspection) 10. Smart Card System (access control/attendance/consumption records) 11. File Servers (patent documents/technical data/financial reports/audit materials) 12. All NetBackup Backups (3 media servers, 55TB physical data, DESTROYED) 13. Oracle Data Guard DR Replica (real-time sync copy, DISCONNECTED & DESTROYED) 14. MSSQL Log Shipping DR (3 active links, DISCONNECTED & DESTROYED) 15. All Domain Controllers & Active Directory (986 domain computers) ◆ DATA IN OUR POSSESSION ◆ • Kingdee EAS Financial System (complete DB: financial reports/vouchers/AP-AR/costing) • 17,000+ employee PII (ID numbers/phone/address/salary/social security) • 61,500+ user procurement system (suppliers/contracts/quotes/bid records) • All procurement contracts/bidding docs/supplier quotes/pricing strategies • Patent documents/drug formulas/technical specs/R&D data/QC reports • OA system (all workflows/internal comms/management meeting minutes/decisions) • CRM data (all clients/sales records/order history/payment details) • Pharmaceutical Management System (drug registration/prescriptions/inventory/GMP docs) • Electronic Contract System (all original e-contracts/digital seals/legal docs) • GitLab repositories (internal source code with hardcoded credentials) • Active Directory (all accounts/passwords/group policies/network topology) • Email system communications and attachments ◆ RANSOM AMOUNT ◆ USD $800,000 = 5350000人民币 24小时内联系并在3天内完成支付可享受折扣价: USD $500,000 = 3350000人民币 This amount includes: 1. Full decryption tool with technical support 2. Permanent deletion of all your data in our possession (with proof) 3. Security vulnerability report (how we got in, to prevent recurrence) 4. Our commitment to never publish, sell, or contact you again Accepted cryptocurrency: BTC: 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw XMR: 86MB9FuijDj2Cxi4vPEBXKTo5qadAE2GUPP5K8wA5LuNHFe3NcCytfAapC5MJjWEWYCSmxQpW7USiQcExuaRjwQF3UVzSM8 ETH (ERC20): 0x3b03709d520ac631e1Bc1eAD8706eE30593F0B6b USDT (TRC20): TQYxfsGpdFuubdbq9MRXz8R2DQC3pfpdK4 ◆ DEADLINE ◆ You have 24 hours to contact us and begin negotiation. Consequences of non-compliance: • Day 1 (no contact) → Ransom doubles; public breach announcement posted • Day 3 (no agreement) → Partial data samples published (employee PII/financial) • Day 7 → Full data dump published or sold to third parties/competitors Once published, this cannot be reversed. Payment after publication cannot stop data that has already spread. Additionally, PII disclosure triggers Personal Information Protection Law (PIPL) compliance investigations. ◆ DO NOT ◆ • Rename encrypted files • Attempt decryption with third-party tools (will permanently damage files) • Reinstall the operating system • Contact law enforcement (they cannot help; investigation involvement will cause us to publish data immediately) • Shutdown or restart servers (may corrupt encryption state) • Attempt self-recovery — all backups and DR replicas have been destroyed ◆ HOW TO RECOVER ◆ 1. Contact us using the methods below with your unique ID 2. We will decrypt 2-3 files for free as proof of decryption capability 3. We will provide sample screenshots of downloaded data as proof of possession 4. Full decryption tool + permanent data deletion after agreement Contact: Email-1: [email protected] Email-2: [email protected] ================================================================================
Wallets

  • 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw

Extracted

Path

  • C:\Users\Admin\Downloads\数据恢复说明_README.txt

Ransom Note
  • ================================================================================ 您的文件已被加密 / YOUR FILES HAVE BEEN ENCRYPTED ================================================================================ 【中文说明】 贵公司的所有重要文件已使用 AES-256 + RSA-4096 军事级加密算法加密。 所有备份系统（含 NetBackup 55TB 备份）、数据库灾备（Oracle Data Guard / MSSQL Log Shipping）均已被同步销毁，无法通过任何已有备份恢复。 ◆ 重要警告：在过去数周内，我们已全面渗透贵公司内部网络，并下载了 数TB规模的核心业务数据，涵盖全部数据库、文件服务器及备份系统。 如果未能在规定时间内达成协议，这些数据将被公开发布或出售给竞争 对手及第三方。 您的唯一标识码: 21d4290644befc1668ad3a18a90fe3cc 已加密/销毁的核心业务系统包括： 1. 金蝶 EAS 财务/人力/供应链核心系统 (Oracle, 3.7TB) 2. 金蝶 EAS 业务数据库 (Oracle, 1.35TB, 含 8,496 张业务表) 3. 药品管理系统 PMS (MSSQL, 含全部药品/处方/库存数据) 4. OA 办公自动化系统 (ecology9, 含全部审批流/合同/公文) 5. CRM 客户关系管理系统 (含全部客户/销售/订单数据) 6. 人力资源系统 (17,000+ 员工信息, 含身份证号/手机号/薪资) 7. 采购管理系统 (61,500+ 用户, 含供应商/合同/报价) 8. 电子签约系统 (全部电子合同/签章记录) 9. ERP 生产管理 (物料/BOM/生产工单/质量检验) 10. 一卡通系统 (门禁/考勤/消费记录) 11. 文件服务器 (专利文档/技术资料/财务报表/审计材料) 12. 所有 NetBackup 备份 (3 台存储节点, 55TB 物理数据, 已销毁) 13. Oracle Data Guard 灾备 (实时同步副本, 已断开并销毁) 14. MSSQL Log Shipping 灾备 (3 条链路, 已断开并销毁) 15. 全部域控制器及 Active Directory (986 台域内计算机) ◆ 我们已掌握的数据 ◆ • 金蝶 EAS 财务系统完整数据库（全部财务报表/凭证/往来款/成本核算） • 17,000+ 员工完整个人信息（身份证号/手机号/家庭住址/薪资明细/社保） • 61,500+ 用户采购系统数据（供应商/合同/报价/中标记录） • 全部采购合同/投标文件/供应商报价单/定价策略 • 专利文档/药品配方/技术资料/研发数据/质检报告 • OA 系统全量数据（审批流程/内部通信/管理层会议纪要/决策记录） • CRM 客户数据（全部客户信息/销售记录/订单历史/回款明细） • 药品管理系统核心数据（全部药品注册/处方/库存/GMP 相关文件） • 电子签约系统（全部电子合同原件/签章记录/法律文件） • GitLab 代码仓库（内部系统源码及硬编码凭据） • Active Directory 域控数据（全部用户账户/密码/组策略/网络拓扑） • 邮件系统通信记录及附件 ◆ 赎金金额 ◆ USD $800,000 = 5350000人民币 24小时内联系并在3天内完成支付可享受折扣价: USD $500,000 = 3350000人民币 上述金额包含： 1. 全部文件的解密工具及技术支持 2. 永久删除我们持有的所有贵公司数据（提供删除证明） 3. 安全漏洞报告（告知入侵路径，防止再次发生） 4. 我们承诺不公开、不出售、不再次联系 可通过以下加密货币支付： BTC: 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw XMR: 86MB9FuijDj2Cxi4vPEBXKTo5qadAE2GUPP5K8wA5LuNHFe3NcCytfAapC5MJjWEWYCSmxQpW7USiQcExuaRjwQF3UVzSM8 ETH (ERC20): 0x3b03709d520ac631e1Bc1eAD8706eE30593F0B6b USDT (TRC20): TQYxfsGpdFuubdbq9MRXz8R2DQC3pfpdK4 ◆ 时间期限 ◆ 您有 24 小时联系我们开始谈判。 逾期后果如下： • 第 1 天未联系 → 赎金金额翻倍，并在公开渠道发布贵公司数据泄露公告 • 第 3 天未达成协议 → 公布部分数据样本（含员工身份证信息/财务数据） • 第 7 天 → 全量数据公开发布或出售给第三方/竞争对手 数据一旦公开即不可撤回，届时即使付款也无法阻止已传播的数据。 此外，个人信息泄露将触发《个人信息保护法》合规调查。 ◆ 请勿执行以下操作 ◆ • 重命名已加密文件 • 使用第三方工具尝试解密（会永久损坏文件） • 重装操作系统 • 联系执法机构（他们无法帮助恢复，且调查介入将导致我们立即公开数据） • 关闭或重启服务器（可能导致加密状态异常） • 试图自行恢复 — 所有备份系统及灾备副本均已被销毁 ◆ 如何恢复数据 ◆ 1. 通过以下方式联系我们，并提供您的唯一标识码 2. 我们将免费解密 2-3 个文件作为解密能力证明 3. 我们将提供已下载数据的样本截图作为数据持有证明 4. 达成协议后提供完整解密工具 + 永久删除所有数据 联系方式 / Contact: Email-1: [email protected] Email-2: [email protected] ================================================================================ [ENGLISH] All critical files across your organization have been encrypted using military-grade AES-256 + RSA-4096 encryption. All backup systems (including NetBackup 55TB), disaster recovery replicas (Oracle Data Guard / MSSQL Log Shipping) have been destroyed simultaneously. Recovery through existing backups is impossible. ◆ CRITICAL: Over the past several weeks, we have fully infiltrated your internal network and downloaded terabytes of core business data covering all databases, file servers, and backup systems. If an agreement is not reached within the specified timeframe, this data will be published or sold to competitors and third parties. Your unique ID: 21d4290644befc1668ad3a18a90fe3cc Encrypted/destroyed core business systems include: 1. Kingdee EAS Finance/HR/SCM Core System (Oracle, 3.7TB) 2. Kingdee EAS Business Database (Oracle, 1.35TB, 8,496 tables) 3. Pharmaceutical Management System PMS (MSSQL, all drug/prescription/inventory data) 4. OA Office Automation (ecology9, all approvals/contracts/documents) 5. CRM Customer Relationship Management (all customer/sales/order data) 6. HR System (17,000+ employee records including ID numbers/phone/salary) 7. Procurement System (61,500+ users, supplier/contract/quotation data) 8. Electronic Contract Signing System (all e-contracts/digital seals) 9. ERP Production Management (materials/BOM/work orders/quality inspection) 10. Smart Card System (access control/attendance/consumption records) 11. File Servers (patent documents/technical data/financial reports/audit materials) 12. All NetBackup Backups (3 media servers, 55TB physical data, DESTROYED) 13. Oracle Data Guard DR Replica (real-time sync copy, DISCONNECTED & DESTROYED) 14. MSSQL Log Shipping DR (3 active links, DISCONNECTED & DESTROYED) 15. All Domain Controllers & Active Directory (986 domain computers) ◆ DATA IN OUR POSSESSION ◆ • Kingdee EAS Financial System (complete DB: financial reports/vouchers/AP-AR/costing) • 17,000+ employee PII (ID numbers/phone/address/salary/social security) • 61,500+ user procurement system (suppliers/contracts/quotes/bid records) • All procurement contracts/bidding docs/supplier quotes/pricing strategies • Patent documents/drug formulas/technical specs/R&D data/QC reports • OA system (all workflows/internal comms/management meeting minutes/decisions) • CRM data (all clients/sales records/order history/payment details) • Pharmaceutical Management System (drug registration/prescriptions/inventory/GMP docs) • Electronic Contract System (all original e-contracts/digital seals/legal docs) • GitLab repositories (internal source code with hardcoded credentials) • Active Directory (all accounts/passwords/group policies/network topology) • Email system communications and attachments ◆ RANSOM AMOUNT ◆ USD $800,000 = 5350000人民币 24小时内联系并在3天内完成支付可享受折扣价: USD $500,000 = 3350000人民币 This amount includes: 1. Full decryption tool with technical support 2. Permanent deletion of all your data in our possession (with proof) 3. Security vulnerability report (how we got in, to prevent recurrence) 4. Our commitment to never publish, sell, or contact you again Accepted cryptocurrency: BTC: 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw XMR: 86MB9FuijDj2Cxi4vPEBXKTo5qadAE2GUPP5K8wA5LuNHFe3NcCytfAapC5MJjWEWYCSmxQpW7USiQcExuaRjwQF3UVzSM8 ETH (ERC20): 0x3b03709d520ac631e1Bc1eAD8706eE30593F0B6b USDT (TRC20): TQYxfsGpdFuubdbq9MRXz8R2DQC3pfpdK4 ◆ DEADLINE ◆ You have 24 hours to contact us and begin negotiation. Consequences of non-compliance: • Day 1 (no contact) → Ransom doubles; public breach announcement posted • Day 3 (no agreement) → Partial data samples published (employee PII/financial) • Day 7 → Full data dump published or sold to third parties/competitors Once published, this cannot be reversed. Payment after publication cannot stop data that has already spread. Additionally, PII disclosure triggers Personal Information Protection Law (PIPL) compliance investigations. ◆ DO NOT ◆ • Rename encrypted files • Attempt decryption with third-party tools (will permanently damage files) • Reinstall the operating system • Contact law enforcement (they cannot help; investigation involvement will cause us to publish data immediately) • Shutdown or restart servers (may corrupt encryption state) • Attempt self-recovery — all backups and DR replicas have been destroyed ◆ HOW TO RECOVER ◆ 1. Contact us using the methods below with your unique ID 2. We will decrypt 2-3 files for free as proof of decryption capability 3. We will provide sample screenshots of downloaded data as proof of possession 4. Full decryption tool + permanent data deletion after agreement Contact: Email-1: [email protected] Email-2: [email protected] ================================================================================
Wallets

  • 1DZ6V3AVf9TztSyawrLn1YC1C7E67Jjyzw

Targets

    • Target
      77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
    • Size 521KB
    • SHA256 77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionexecutionpersistenceransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks