BQ Y IE CQNG HOA xlH(H cHir NGHIA VIt:T NAMCQe CONONOH9THON'G 'I.' IlQc I~p - TV do - R,nh phuc

S6: 1s: ICND-CSHTV/y theo d~i~phong ch5ng rna dQc

WannaCry

Hil Ni)i, ngay If thdng 5 niim 2017

Kinh giri:- Cac Vu, C\lC, Tang C\lC,Van phong BQ, Thanh tra BQ;- Cac dun vi tnrc thu¢c HQY t8;- Sa Y t~ cac tinh, thanh phd tlV'c thuQc Trung irong.

Nh~ phong ngira, ngan chan vi~c tAn cong cua rna oQc RansornwareWannaCry (hoac diroe biet voi cac ten khac nhtr: WannaCrypt, WanaCryptOr2.0) ...) vilo Vi~t Nam, ngay 13/5/2017 Trung tam (rng oiru kh§n cAp may tinhViet Nam VNCERT da co cong van s6 144IVNCERT-DPU'C v~ viec thea doi,ngan ch~ k~t n6i may chu di~u khi~n rna dQc WannaCry.

Da.y Ia rna dQc rAt nguy hi~rn, co th8 drum cAp thong tin va rna hoa toan bQdfr li~u trong may chu h~ thdng cGng nhir may tinh ca nhan, gay nen nhi~u h~uqua nghiem trQng ,khac. Vi ~y, C1)CCong ngh~ thong tin dS nghj cae dun vithgc hi~n khAn cAp cac vi~c sau day:

,1. Doi vai can bQ, cong chuc, vien ~huc, nguai lao dQng:

- Khong nhAp vao cae duang lien kSt, t?P tin dinh kern va bi~u tugngquang c'a~J<hong ro ngu3n gac.

- Khi xay ra S1)' cd, nhanh chong ngirng sir d\ll1g may tinh, ng~t k~t ndim~g va:bao ngay v6i t6 chuc va cclnhan,chuyen trach v~ cong ngh~ thong tin.

2. D6i vai t6 chuc chuyen trach cong ugh~ thong tin:

- Ki~m tra, hu6ng ddn, th\Ic hi~n c~p nh~t ban va cae 16 h6ng bao rn~ttren h~ di:8u hanh, ung d\lng d8i v6i cae mity tinh ca nhan, may chu cua dan vi.

- Th\]'c hi~n sao lUll ngay cac dli li~u quan trQng cua dan vi va d~ each Iyan toano

- Theo doi, ngan ch~n k~t nbi d~n cac may chu <lieu khi8n rna d9cWannaCiy va e"~pnh~t vao cae h~ thbng bao v~ nhu IDSIIPS, Firewall ... caethong tin nh~ d~ng t~i phl,l h;lC dinh kern.

- Sil d\ll1g cac phfut mSm eo kha nang phat hi~n va tieu di~t rna dQc da raquet toan be;>h~ thbng.

Chlmg till!: C~c Cong ngh~thong tinNgay IcY: 17/0512017 10:J ~ :49H~ th6ng VOffice BO Y Te

Lru;uild~Q·'CAedon vi chu,:(lQng~gi~ sa4··chl·"'0. kip thm Con!tac t6 ehucphong, et~ngmJ dge, di.m baaan to8n~qilli~li-~aho't;d~ngehung ella<toovi.

Xiu;~-;n--Qtlg cam on'

Nlfi n!r#n:• Nhutren;• ThCr tru6n~teQuang CWng (eta b/e);• CI,lC tnr6n&~da bJc);• Luu: VT, CSBT .

.' "

...il. _ _A'"

," :i::",

.,

Be) Y TE C(>NG BOA xA HOI can NGHiA VIlT NAMC1)CCONG NGH¥-THONG TIN flQc l{ip- TV do - H\1nh phuc

.PHVLVCTHONG TIN vt MA DOC WANNACRY

(kern theo cong van sa A '1...5 /CNTT-CSHT ngiry J1 thang -5 ndm 2017cua C~cCongngh? thong tin)

SIT Bia chi IP C&C STT Ilia ¢hi lP C&C1 128.31.0.39 18 . 213.239.216.2222 136.243.176.148 19 213.61.66J 163 146.0.32.144 20 38.229.72.164 163.172.153.12 21 50.7.151,475 163.172.185.132 22 50.7.1-61.2186 163.172.25.118 23 51.255,41.657 171.25.193.9 24 62.138.10.608 178.254.44.135 25 62.138.7.2319 178.254.44.135 2.6 79.172.193.3210 178.62.173.203 27 81.30.158.22311 . 185.97.32.18 28 8'2.94.251.22712 . 188.138.33.220 29 83.162.202.18213 188.166.23.127 30 83.169.6.1214 192.42.115.102 31 86.59.21.3815 193.23.244.244 32 89.45.235.2116 198.199.64.217 33 94.23.173.9317 212.47.232.237

B. Danhsach te~ntfP tin

STr ..File name STT FileName--_

1 -@WanaDeczyptor@.exe 6 taskse.exe2 b.wnry 7 t.wnry3 c._w.nry 8 u.wnry4 s.wnry 9 Ca.e file vffi phcln mq rong ".wnry"5 taskdl.exe 10 Cac file voi phan rna rQng

".WNCRY"

,'"

SIT SIIA~256.. ~ -

1 edOlebfbcgeb5bbea545-af4dQlbf5fl07166184048Q439c6e~babe8e08.Oe41aa2 c365ddaa345cfcaIDd629505572a484c'fr5221933d{l·8e4a52130b8bb7badat93 09a46b3e 1be080745a6d8d88d6B.Sbd3'S1bl'c7586aeOdc94dOc238ee36421cafa4 Oa73291ab5607aet7db23863cf8e72f55bcb3c273bb47tUOedtol1515aeb58945 428f22a9afd2797ede7c0583d34a052c32693cbb55f567a60298587b6e675c6f6 5clf4f6ge45cff9725d9969f9ffcf79d07bd~I624e06cfa5bcbacd2211 046ed67 62d828ee000e44f670ba322644c2351 fe31af5b88a98f2b2ce27e423dcfl d1bl8 72af12d8139a80f317eS,Sla60021fdf208871 ed334G12637f49d819ab4b033dd9 8S;ce324b8f78021ecfc9b811c748fl9b82e61bb093:ff64f2eab457tgefl9b186. ,', '" ..

10 ald9cd6fl89beff28aOa49blQf8fe4510J2~471fP04b~.~42839(ic1f785~4906b11 ' a93ee7ea 13'238bd038bcbec6:35:tl9619db56614549'8fe5eOea60eoe76a614bd312 b43b2340 12b8233b3dfoodb7cOaSb2b13cc2354dd6de27e0928 {,_3.bfS$af26.93c13 eb47cd6a93722141 1bb8daf35900ci9897fb234t60087089a064066a65f 42bcd414 24:d004al04d4d54034dbcffc2a4b19al1f39008a57Saa614ea0470348,Ob 1022c15 2c2d8bc91564050cf073145flb 117f4ffdd6470e87166abdfecll Oeodff()40a2e16 7a828afd2abfl53d840.9380.90d498072b7e507cl02)e4cdd8c6baf721Gafc54517 a897345b6819'1fd36.f8cefb5Ze6a77ach2367432abb648b9aeOa.9d708406de5b18 tbOb6044347e972e21b6c376e37ell !5dab494a2c6b9fb~8b92ble45b45dOebc19 95,88t2ef06b7 e1c8509f32d8~ddfal a04la9ecI 5b 1c90d6da484a39f8dcdf96720 b43 1)234012b8233b3df6adb7cOa3b2b13c02354dd6de21 e092873bfS'8af2693c21 4186675cb6]06i9dS 1167tb0f14cd3 fSfcfb906S093£62b1OaISf7d9a6e8d98222 09a46b3e 1be080745a6dSd88d6b5b.d351b1cT586aeOdc94dOc238ee36421cafa

." ,

__ __. _~~_-,-- ~ ':"__-'-----1_