银狐IOC情报 批次#20260601055022
摘要
银狐恶意软件IOC情报新增: 8个IP, 4个域名, 30个样本, 50个路径。数据时间: 2026-05-31 21:01 UTC
正文
# 银狐恶意软件 IOC 情报(新增) ## 基本信息 - **批次ID**: 20260601055022 - **数据更新时间**: 2026-05-31 21:01:31 UTC - **采集时间**: 2026-05-31 21:50:51 UTC ## 本批次新增统计 | 类型 | 新增数量 | |------|----------| | 恶意IP | 8 | | 恶意域名 | 4 | | 恶意样本 | 30 | | 释放路径 | 50 | ## 新增恶意 IP 地址 | # | IP 地址 | |---|---------| | 1 | `23.249.20.51` | | 2 | `23.249.20.45` | | 3 | `118.107.0.147` | | 4 | `38.47.213.156` | | 5 | `161.248.86.8` | | 6 | `54.46.75.246` | | 7 | `192.252.181.103` | | 8 | `38.181.23.51` | ## 新增恶意域名 | # | 域名 | |---|------| | 1 | `qweaat.icu` | | 2 | `qexylup.com` | | 3 | `qekykev.com` | | 4 | `qexyryl.com` | ## 新增恶意样本哈希 | # | SHA256 | MD5 | SHA1 | |---|--------|-----|------| | 1 | `8803ca80c665e5a7...fce53bec` | - | - | | 2 | `6613ede41478ec5d...7ee50389` | - | - | | 3 | `f6d8958d282d83ae...7995efe2` | - | - | | 4 | `7ca0fd68f220cb95...5eae51fd` | - | - | | 5 | `d2499fc2e179eefd...57b0c59c` | - | - | | 6 | `3855e08391122a48...6365eb0a` | - | - | | 7 | `fd689f0af58ee07e...a2346a3d` | - | - | | 8 | `ec8970f8cb3ca437...d63478ef` | - | - | | 9 | `abeee53cc66fbd40...b325927b` | - | - | | 10 | `a31a9fd3a80c139c...c35878d5` | - | - | | 11 | `4eb51e65b5363f3d...49aa55d1` | - | - | | 12 | `7d5af942ec4d87a0...6686db01` | - | - | | 13 | `535a775ee740304e...2ce6b41a` | - | - | | 14 | `a311766bcf9e3b65...a08955b1` | - | - | | 15 | `c0ce801c7efc3b3d...99e7a74d` | - | - | | 16 | `bf52bcf384167354...83ba54c2` | - | - | | 17 | `7898c83cb8231f5e...939a864a` | - | - | | 18 | `ab8dd958b4907abb...c62fa440` | - | - | | 19 | `a2bd2e1ed40558a4...06940c0c` | - | - | | 20 | `0e4d7fc19fc912a5...2ec0e90e` | - | - | | 21 | `32eac5bd1ee48007...9d1b1c38` | - | - | | 22 | `f5355b8935993f67...dd4017b6` | - | - | | 23 | `726a64fcc2aad0fb...0c1a7aac` | - | - | | 24 | `d08059799a87a46b...d5b7c6d8` | - | - | | 25 | `f9fe34ca477c56a5...633b2fe7` | - | - | | 26 | `1d4594f0ab8045f7...611989b8` | - | - | | 27 | `9f6ab1b15848ccf9...9f8dd674` | - | - | | 28 | `bdc95c2e07e4cb5e...b67d9ac6` | - | - | | 29 | `a48b15bfc2316ec2...38adc2c3` | - | - | | 30 | `dfce149ba208ec0b...47988815` | - | - | ## 新增释放文件路径 | # | 文件路径 | 文件名 | |---|----------|--------| | 1 | `C:\ProgramData\Microsoft\WindowsDiagTrack\VERSION.dll` | `VERSION.dll` | | 2 | `C:\ProgramData\Microsoft\WindowsDiagTrack\WinTeleSvc.exe` | `WinTeleSvc.exe` | | 3 | `C:\Program Files (x86)\汽水音乐\汽水音乐\Utility.dll` | `Utility.dll` | | 4 | `C:\ProgramData\970JCN8w\EDACoreDll.dll` | `EDACoreDll.dll` | | 5 | `C:\Windows\Installer\ea77318.msi` | `ea77318.msi` | | 6 | `C:\Users\Administrator\AppData\Local\Temp\tmp793B.tmp` | `tmp793B.tmp` | | 7 | `C:\Users\Admin\AppData\Roaming\汽水音乐\汽水音乐 7.1.3\install\2026052336汽水音乐1.cab` | `2026052336汽水音乐1.cab` | | 8 | `C:\Users\Administrator\AppData\Local\Temp\tmp105F.tmp` | `tmp105F.tmp` | | 9 | `C:\Drivers\xc1ISG\OnJ1cV\xvHtmX\B1D3z\is-J4NB4U5K2Y.tmp` | `is-J4NB4U5K2Y.tmp` | | 10 | `C:\Users\Administrator\AppData\Local\Temp\tmpF083.tmp` | `tmpF083.tmp` | | 11 | `C:\iratnt\EduWebContainer.dll` | `EduWebContainer.dll` | | 12 | `c:\users\administrator\appdata\local\temp\udthhoycdkcatvbu.tmp` | `udthhoycdkcatvbu.tmp` | | 13 | `C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\dllcache\newdev.exe` | `newdev.exe` | | 14 | `C:\Users\Administrator\AppData\Local\Temp\164ipnew-安装.exe` | `164ipnew-安装.exe` | | 15 | `C:\Program Files (x86)\系统更新\系统更新\Utility.dll` | `Utility.dll` | | 16 | `C:\Users\Administrator\AppData\Local\Temp\tmp2B0C.tmp` | `tmp2B0C.tmp` | | 17 | `C:\Drivers\8kOHs\kxtuf\4Pna\UHOR\is-L1NBP.tmp` | `is-L1NBP.tmp` | | 18 | `C:\Program Files (x86)\T3j0fAB\t6d.tmp` | `t6d.tmp` | | 19 | `C:\Program Files (x86)\DriveLeadLinux\NewLxsUoBaOZ.exe` | `NewLxsUoBaOZ.exe` | | 20 | `C:\Users\Administrator\AppData\Local\Snegee.ini` | `Snegee.ini` | | 21 | `C:\Program Files (x86)\T3j0fAB\mdexuq.dll` | `mdexuq.dll` | | 22 | `c:\users\administrator\appdata\local\temp\d5f.tmp` | `d5f.tmp` | | 23 | `c:\users\administrator\appdata\local\temp\b63b.tmp` | `b63b.tmp` | | 24 | `C:\Program Files (x86)\oCvIlG\t6d.tmp` | `t6d.tmp` | | 25 | `C:\Users\Administrator\AppData\Local\Temp\tmp5B91.tmp` | `tmp5B91.tmp` | | 26 | `C:\Drivers\8kOHs\kxtuf\4Pna\UHOR\is-C4B8N.tmp` | `is-C4B8N.tmp` | | 27 | `C:\Users\Public\Documents\RunCode.exe` | `RunCode.exe` | | 28 | `C:\Users\Administrator\AppData\Roaming\Config.json` | `Config.json` | | 29 | `c:\users\administrator\appdata\local\temp\c89.tmp` | `c89.tmp` | | 30 | `C:\Users\Administrator\AppData\Local\Temp\tmp133E.tmp` | `tmp133E.tmp` | | 31 | `C:\Users\Administrator\AppData\Roaming\汽水音乐\汽水音乐 7.1.3\install\2026052336汽水音乐1.cab` | `2026052336汽水音乐1.cab` | | 32 | `C:\Users\Administrator\AppData\Local\chrmstp.exe` | `chrmstp.exe` | | 33 | `C:\arztow\EduWebContainer.dll` | `EduWebContainer.dll` | | 34 | `C:\Users\Administrator\AppData\Local\Temp\bmiga.exe` | `bmiga.exe` | | 35 | `C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\dllcache\pcaui.exe` | `pcaui.exe` | | 36 | `C:\Drivers\8kOHs\kxtuf\4Pna\UHOR\is-DKO21.tmp` | `is-DKO21.tmp` | | 37 | `C:\Users\Administrator\AppData\Local\Temp\Clash.Verge_.exe` | `Clash.Verge_.exe` | | 38 | `C:\Users\Administrator\AppData\Roaming\Config2.json` | `Config2.json` | | 39 | `C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\dllcache\TapiUnattend.exe` | `TapiUnattend.exe` | | 40 | `C:\Windows\powrprof.dll` | `powrprof.dll` | | 41 | `C:\Users\Administrator\AppData\Local\Temp\tmp30D8.tmp` | `tmp30D8.tmp` | | 42 | `D:\LXrnrlmd.exe` | `LXrnrlmd.exe` | | 43 | `C:\Users\Public\Documents\x86-Microsoft-Windowsdata\Cndom6.sys` | `Cndom6.sys` | | 44 | `C:\Users\Administrator\AppData\Roaming\系统更新\系统更新 7.1.3\install\2026052336-单妈妈1.cab` | `2026052336-单妈妈1.cab` | | 45 | `C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\OKVYXXBW\xiazai[1]` | `xiazai[1]` | | 46 | `C:\Program Files (x86)\系统更新\系统更新\user.dat` | `user.dat` | | 47 | `C:\Program Files (x86)\汽水音乐\汽水音乐\user.dat` | `user.dat` | | 48 | `C:\Users\Administrator\AppData\Roaming\TrustAsia\intel.dll` | `intel.dll` | | 49 | `C:\Users\Administrator\AppData\Local\Temp\Danma.exe` | `Danma.exe` | | 50 | `C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\dllcache\at.exe` | `at.exe` |
标签
- ioc
- ioc:domain
- ioc:filepath
- ioc:hash
- ioc:ip
- silverfox
- threatbook
- threat_intelligence
扩展字段
{
"batch_id": "20260601055022",
"domains": [
{
"value": "qweaat.icu"
},
{
"value": "qexylup.com"
},
{
"value": "qekykev.com"
},
{
"value": "qexyryl.com"
}
],
"file_paths": [
{
"file_name": "VERSION.dll",
"path": "C:\\ProgramData\\Microsoft\\WindowsDiagTrack\\VERSION.dll"
},
{
"file_name": "WinTeleSvc.exe",
"path": "C:\\ProgramData\\Microsoft\\WindowsDiagTrack\\WinTeleSvc.exe"
},
{
"file_name": "Utility.dll",
"path": "C:\\Program Files (x86)\\汽水音乐\\汽水音乐\\Utility.dll"
},
{
"file_name": "EDACoreDll.dll",
"path": "C:\\ProgramData\\970JCN8w\\EDACoreDll.dll"
},
{
"file_name": "ea77318.msi",
"path": "C:\\Windows\\Installer\\ea77318.msi"
},
{
"file_name": "tmp793B.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp793B.tmp"
},
{
"file_name": "2026052336汽水音乐1.cab",
"path": "C:\\Users\\Admin\\AppData\\Roaming\\汽水音乐\\汽水音乐 7.1.3\\install\\2026052336汽水音乐1.cab"
},
{
"file_name": "tmp105F.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp105F.tmp"
},
{
"file_name": "is-J4NB4U5K2Y.tmp",
"path": "C:\\Drivers\\xc1ISG\\OnJ1cV\\xvHtmX\\B1D3z\\is-J4NB4U5K2Y.tmp"
},
{
"file_name": "tmpF083.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmpF083.tmp"
},
{
"file_name": "EduWebContainer.dll",
"path": "C:\\iratnt\\EduWebContainer.dll"
},
{
"file_name": "udthhoycdkcatvbu.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\udthhoycdkcatvbu.tmp"
},
{
"file_name": "newdev.exe",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\dllcache\\newdev.exe"
},
{
"file_name": "164ipnew-安装.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\164ipnew-安装.exe"
},
{
"file_name": "Utility.dll",
"path": "C:\\Program Files (x86)\\系统更新\\系统更新\\Utility.dll"
},
{
"file_name": "tmp2B0C.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp2B0C.tmp"
},
{
"file_name": "is-L1NBP.tmp",
"path": "C:\\Drivers\\8kOHs\\kxtuf\\4Pna\\UHOR\\is-L1NBP.tmp"
},
{
"file_name": "t6d.tmp",
"path": "C:\\Program Files (x86)\\T3j0fAB\\t6d.tmp"
},
{
"file_name": "NewLxsUoBaOZ.exe",
"path": "C:\\Program Files (x86)\\DriveLeadLinux\\NewLxsUoBaOZ.exe"
},
{
"file_name": "Snegee.ini",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Snegee.ini"
},
{
"file_name": "mdexuq.dll",
"path": "C:\\Program Files (x86)\\T3j0fAB\\mdexuq.dll"
},
{
"file_name": "d5f.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\d5f.tmp"
},
{
"file_name": "b63b.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\b63b.tmp"
},
{
"file_name": "t6d.tmp",
"path": "C:\\Program Files (x86)\\oCvIlG\\t6d.tmp"
},
{
"file_name": "tmp5B91.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp5B91.tmp"
},
{
"file_name": "is-C4B8N.tmp",
"path": "C:\\Drivers\\8kOHs\\kxtuf\\4Pna\\UHOR\\is-C4B8N.tmp"
},
{
"file_name": "RunCode.exe",
"path": "C:\\Users\\Public\\Documents\\RunCode.exe"
},
{
"file_name": "Config.json",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Config.json"
},
{
"file_name": "c89.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\c89.tmp"
},
{
"file_name": "tmp133E.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp133E.tmp"
},
{
"file_name": "2026052336汽水音乐1.cab",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\汽水音乐\\汽水音乐 7.1.3\\install\\2026052336汽水音乐1.cab"
},
{
"file_name": "chrmstp.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\chrmstp.exe"
},
{
"file_name": "EduWebContainer.dll",
"path": "C:\\arztow\\EduWebContainer.dll"
},
{
"file_name": "bmiga.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\bmiga.exe"
},
{
"file_name": "pcaui.exe",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\dllcache\\pcaui.exe"
},
{
"file_name": "is-DKO21.tmp",
"path": "C:\\Drivers\\8kOHs\\kxtuf\\4Pna\\UHOR\\is-DKO21.tmp"
},
{
"file_name": "Clash.Verge_.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\Clash.Verge_.exe"
},
{
"file_name": "Config2.json",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Config2.json"
},
{
"file_name": "TapiUnattend.exe",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\dllcache\\TapiUnattend.exe"
},
{
"file_name": "powrprof.dll",
"path": "C:\\Windows\\powrprof.dll"
},
{
"file_name": "tmp30D8.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp30D8.tmp"
},
{
"file_name": "LXrnrlmd.exe",
"path": "D:\\LXrnrlmd.exe"
},
{
"file_name": "Cndom6.sys",
"path": "C:\\Users\\Public\\Documents\\x86-Microsoft-Windowsdata\\Cndom6.sys"
},
{
"file_name": "2026052336-单妈妈1.cab",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\系统更新\\系统更新 7.1.3\\install\\2026052336-单妈妈1.cab"
},
{
"file_name": "xiazai[1]",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\OKVYXXBW\\xiazai[1]"
},
{
"file_name": "user.dat",
"path": "C:\\Program Files (x86)\\系统更新\\系统更新\\user.dat"
},
{
"file_name": "user.dat",
"path": "C:\\Program Files (x86)\\汽水音乐\\汽水音乐\\user.dat"
},
{
"file_name": "intel.dll",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\TrustAsia\\intel.dll"
},
{
"file_name": "Danma.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\Danma.exe"
},
{
"file_name": "at.exe",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\dllcache\\at.exe"
}
],
"hashes": [
{
"md5": null,
"sha1": null,
"sha256": "8803ca80c665e5a707ff4375b923bb8b7117002bcc3c063f318728b8fce53bec"
},
{
"md5": null,
"sha1": null,
"sha256": "6613ede41478ec5d4e7b4d5f04429b974c5f8f7fa4a46cf5d7e08bc67ee50389"
},
{
"md5": null,
"sha1": null,
"sha256": "f6d8958d282d83ae1d16390afc286550496685ba6e0292e3e3a9de117995efe2"
},
{
"md5": null,
"sha1": null,
"sha256": "7ca0fd68f220cb95b516ee20973be7b2b316c3f1cab137d624e7a6495eae51fd"
},
{
"md5": null,
"sha1": null,
"sha256": "d2499fc2e179eefd4bd5c5c77647b2dd3b9eeaf2a19c70fcf1139a9b57b0c59c"
},
{
"md5": null,
"sha1": null,
"sha256": "3855e08391122a482e8239338e6bba8b699107dddb691505998a35dd6365eb0a"
},
{
"md5": null,
"sha1": null,
"sha256": "fd689f0af58ee07e606fb4f49046c602a61f2c06286522798200955fa2346a3d"
},
{
"md5": null,
"sha1": null,
"sha256": "ec8970f8cb3ca437c131850152f421053d685231552b549437d14db9d63478ef"
},
{
"md5": null,
"sha1": null,
"sha256": "abeee53cc66fbd4000a0a5c6bc4d59b9c201c713e5300bc8bf21ed7eb325927b"
},
{
"md5": null,
"sha1": null,
"sha256": "a31a9fd3a80c139cfc76bde07544a78cb0f090ba764089c9c422ec19c35878d5"
},
{
"md5": null,
"sha1": null,
"sha256": "4eb51e65b5363f3d0e417eebb38bdbde5d15f5fd399cad7a8b013fcf49aa55d1"
},
{
"md5": null,
"sha1": null,
"sha256": "7d5af942ec4d87a0c772b3cd273cdc320b5206ee366fc118892b36376686db01"
},
{
"md5": null,
"sha1": null,
"sha256": "535a775ee740304eb064ba07f5cf6da2b1b0e6498921039165fff1b62ce6b41a"
},
{
"md5": null,
"sha1": null,
"sha256": "a311766bcf9e3b65cb2ef0c9306b3661b839cb5dafa32b521affb097a08955b1"
},
{
"md5": null,
"sha1": null,
"sha256": "c0ce801c7efc3b3dde13776a397bea600b6774c69e21dfcc36142a4099e7a74d"
},
{
"md5": null,
"sha1": null,
"sha256": "bf52bcf384167354f4bfea7d7ee4f50789e576bf88869a66819a930783ba54c2"
},
{
"md5": null,
"sha1": null,
"sha256": "7898c83cb8231f5ead848bf7697b131cbcfb6a2139b56a5a68ee9198939a864a"
},
{
"md5": null,
"sha1": null,
"sha256": "ab8dd958b4907abb41d630d8237d8d3794c4f71c47ab55d150f9013cc62fa440"
},
{
"md5": null,
"sha1": null,
"sha256": "a2bd2e1ed40558a4aaf6c9454c639ecc4c30d76f2141b7d8424b368006940c0c"
},
{
"md5": null,
"sha1": null,
"sha256": "0e4d7fc19fc912a50e26ef99ca954613c480a3d05155bd23e3d78cf52ec0e90e"
},
{
"md5": null,
"sha1": null,
"sha256": "32eac5bd1ee48007dea357b077edfa51bf82c6cc1feb0a31a672ca839d1b1c38"
},
{
"md5": null,
"sha1": null,
"sha256": "f5355b8935993f67ba31cdd70f238392f98e4568acffa8d42395a30add4017b6"
},
{
"md5": null,
"sha1": null,
"sha256": "726a64fcc2aad0fbca72f9d3ffac54ef89bc90f70810eee6043297230c1a7aac"
},
{
"md5": null,
"sha1": null,
"sha256": "d08059799a87a46b24bf7e6fe4110799758f084b13f8379cb0785768d5b7c6d8"
},
{
"md5": null,
"sha1": null,
"sha256": "f9fe34ca477c56a56ea1584e97bd8df08c40cb43d52d2f7a587cf116633b2fe7"
},
{
"md5": null,
"sha1": null,
"sha256": "1d4594f0ab8045f725eba757285f8d34cd74df7a5dc2ea30636f7ecf611989b8"
},
{
"md5": null,
"sha1": null,
"sha256": "9f6ab1b15848ccf99ad67a7d89412522d52faf2dffba62274a06c9349f8dd674"
},
{
"md5": null,
"sha1": null,
"sha256": "bdc95c2e07e4cb5e3d9a4575b4e20f332732eee2a814977625ccfe39b67d9ac6"
},
{
"md5": null,
"sha1": null,
"sha256": "a48b15bfc2316ec24ec23412f2c4092001f33b0ef71a2c4a88b530ee38adc2c3"
},
{
"md5": null,
"sha1": null,
"sha256": "dfce149ba208ec0b50ddda0c203410a7fadc5c3dae3b38bb6c03b21547988815"
}
],
"ips": [
{
"value": "23.249.20.51"
},
{
"value": "23.249.20.45"
},
{
"value": "118.107.0.147"
},
{
"value": "38.47.213.156"
},
{
"value": "161.248.86.8"
},
{
"value": "54.46.75.246"
},
{
"value": "192.252.181.103"
},
{
"value": "38.181.23.51"
}
],
"stats": {
"new_domains": 4,
"new_file_paths": 50,
"new_hashes": 30,
"new_ips": 8,
"total_new": 92
},
"update_time": "2026-05-31T21:01:31.799000+00:00",
"update_time_ms": 1780261291799
}