银狐IOC情报 批次#20260715055022
摘要
银狐恶意软件IOC情报新增: 6个IP, 2个域名, 30个样本, 40个路径。数据时间: 2026-07-14 21:01 UTC
正文
# 银狐恶意软件 IOC 情报(新增) ## 基本信息 - **批次ID**: 20260715055022 - **数据更新时间**: 2026-07-14 21:01:35 UTC - **采集时间**: 2026-07-14 21:50:52 UTC ## 本批次新增统计 | 类型 | 新增数量 | |------|----------| | 恶意IP | 6 | | 恶意域名 | 2 | | 恶意样本 | 30 | | 释放路径 | 40 | ## 新增恶意 IP 地址 | # | IP 地址 | |---|---------| | 1 | `134.122.204.241` | | 2 | `75.2.88.106` | | 3 | `18.163.130.119` | | 4 | `43.157.212.233` | | 5 | `43.226.47.236` | | 6 | `43.199.110.109` | ## 新增恶意域名 | # | 域名 | |---|------| | 1 | `ljhdfdevcaa.cn` | | 2 | `www.cfaq1.cyou` | ## 新增恶意样本哈希 | # | SHA256 | MD5 | SHA1 | |---|--------|-----|------| | 1 | `0418846619536e6e...e044f601` | - | - | | 2 | `367afee3dc168391...3b554bc4` | - | - | | 3 | `c7a2e45edfcdc2fd...1fdafbed` | - | - | | 4 | `a5a68aae46173faa...9114e6b7` | - | - | | 5 | `5c33858ce0a150bf...8dadd7eb` | - | - | | 6 | `4c03df1a74a6146e...9769a61d` | - | - | | 7 | `61c9ccc19177088d...ab176fe6` | - | - | | 8 | `d015472045853167...35bc30ed` | - | - | | 9 | `2754b8afe8f09075...5a8d676a` | - | - | | 10 | `ea1746383b6b14b6...14a00679` | - | - | | 11 | `64bc8c28ba2fbe5c...e833bc12` | - | - | | 12 | `6f475cd0adf89b55...ee874c0e` | - | - | | 13 | `46a779e611bd8734...d0fa0118` | - | - | | 14 | `6a1faf29261b42a7...51506685` | - | - | | 15 | `bae15240492c59f9...dd7d827c` | - | - | | 16 | `a4d2034e1d131536...bc666439` | - | - | | 17 | `feb5f1e749f6d759...1ecf497c` | - | - | | 18 | `5fe53e223f079bc1...92973cb2` | - | - | | 19 | `ad985a3a3a3ed090...25fa9e2c` | - | - | | 20 | `9b598c4b3e74161a...94d3d7e6` | - | - | | 21 | `8e6cbc3c3969d86a...2360430e` | - | - | | 22 | `c7dec91b41eee6d0...e7bd5818` | - | - | | 23 | `72dec3c02dfac216...bc36bffc` | - | - | | 24 | `f25d960a546f1aa8...f91412e4` | - | - | | 25 | `afd735c149aa7bf8...0ede49c5` | - | - | | 26 | `c80fc0ffdd56020a...bbd14e9c` | - | - | | 27 | `4c185f4f3de356e6...1ce7541e` | - | - | | 28 | `d9ff4aa7d35e3c2d...bc1730f5` | - | - | | 29 | `07d0a120f7180b28...7ad3f78b` | - | - | | 30 | `299d23e6d5323b3a...f1808397` | - | - | ## 新增释放文件路径 | # | 文件路径 | 文件名 | |---|----------|--------| | 1 | `C:\Users\Administrator\AppData\Local\Temp\aicoin Setup.exe` | `aicoin Setup.exe` | | 2 | `C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D5THM8JX\cache[1].dat` | `cache[1].dat` | | 3 | `C:\ProgramData\CfServerSoftwareDistribution\is-GNDJ4.tmp` | `is-GNDJ4.tmp` | | 4 | `C:\Program Files (x86)\SlCcUI\XPSPLOG.dll` | `XPSPLOG.dll` | | 5 | `C:\Program Files (x86)\5b0CIZ\XPSPLOG.dll` | `XPSPLOG.dll` | | 6 | `C:\Windows\Installer\ea9a5c6.msi` | `ea9a5c6.msi` | | 7 | `C:\Users\Public\OlOIQr\UxEnhance64.dll` | `UxEnhance64.dll` | | 8 | `C:\Users\Administrator\Desktop\Clas_2501.38x64\Clas_x64-setup.exe` | `Clas_x64-setup.exe` | | 9 | `C:\mingw64\Qpb8s\7cx0Z\nNDy\sec_E898\AliyunWrap.dll` | `AliyunWrap.dll` | | 10 | `C:\Users\Administrator\AppData\Local\Temp\tmp531A.tmp` | `tmp531A.tmp` | | 11 | `C:\Program Files (x86)\h0KzID\XPSPLOG.dll` | `XPSPLOG.dll` | | 12 | `C:\Program Files (x86)\Um7qzx\XPSPLOG.dll` | `XPSPLOG.dll` | | 13 | `C:\Program Files (x86)\uaPyw6\XPSPLOG.dll` | `XPSPLOG.dll` | | 14 | `c:\windows\apppatch\svchost.exe` | `svchost.exe` | | 15 | `C:\scoop\xjz9\KtGZ\v8m3\bkp_4155\AliyunWrap.dll` | `AliyunWrap.dll` | | 16 | `C:\ProgramData\CfServerSoftwareDistribution\is-NTJK0.tmp` | `is-NTJK0.tmp` | | 17 | `C:\Program Files (x86)\pttz03\XPSPLOG.dll` | `XPSPLOG.dll` | | 18 | `C:\Windows\Installer\ea93ff8.msi` | `ea93ff8.msi` | | 19 | `C:\Windows\Installer\ea99626.msi` | `ea99626.msi` | | 20 | `C:\Users\Administrator\AppData\Local\Temp\is-P5D9P.tmp\6bf5f2.tmp` | `6bf5f2.tmp` | | 21 | `C:\Drivers\jysMxb\SYYeNN\jEAm\is-L3C0U.tmp` | `is-L3C0U.tmp` | | 22 | `C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7VKYJQ5\libcef[1].txt` | `libcef[1].txt` | | 23 | `C:\winget\hDqF\bR80\NyQV\cfg_4393\AliyunWrap.dll` | `AliyunWrap.dll` | | 24 | `C:\msys64\WFuX4o\2xgA\YvgEMA\is-LDPDF.tmp` | `is-LDPDF.tmp` | | 25 | `C:\Users\Public\Mbq4in\UxEnhance64.dll` | `UxEnhance64.dll` | | 26 | `C:\Drivers\jysMxb\SYYeNN\jEAm\is-BDIH0.tmp` | `is-BDIH0.tmp` | | 27 | `C:\Drivers\jysMxb\SYYeNN\jEAm\is-2R5ND.tmp` | `is-2R5ND.tmp` | | 28 | `C:\msys64\WFuX4o\2xgA\YvgEMA\is-CUJ77.tmp` | `is-CUJ77.tmp` | | 29 | `C:\Program Files (x86)\2jlN2w\XPSPLOG.dll` | `XPSPLOG.dll` | | 30 | `C:\Users\Public\qbn2dwxshs\active_desktop_render_x64.dll` | `active_desktop_render_x64.dll` | | 31 | `C:\Users\Administrator\AppData\Local\Temp\is-KSK3N.tmp\CoreLogic.dll` | `CoreLogic.dll` | | 32 | `C:\Users\Administrator\AppData\Local\Temp\is-KSK3N.tmp\is-7N6DJ.tmp` | `is-7N6DJ.tmp` | | 33 | `c:\users\administrator\appdata\local\temp\9e4.tmp` | `9e4.tmp` | | 34 | `C:\Program Files (x86)\aCnN0n\XPSPLOG.dll` | `XPSPLOG.dll` | | 35 | `C:\Users\Public\U7FruL\UxEnhance64.dll` | `UxEnhance64.dll` | | 36 | `C:\Windows\Installer\ea8479e.msi` | `ea8479e.msi` | | 37 | `C:\Users\Public\jSSqfR\UxEnhance64.dll` | `UxEnhance64.dll` | | 38 | `C:\Users\Administrator\AppData\Local\Temp\nsu3084.tmp\nsis_tauri_utils.dll` | `nsis_tauri_utils.dll` | | 39 | `c:\program files\internet explorer\nvml.dll` | `nvml.dll` | | 40 | `C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\dllcache\WerFaultSecure.exe` | `WerFaultSecure.exe` |
标签
- ioc
- ioc:domain
- ioc:filepath
- ioc:hash
- ioc:ip
- silverfox
- threatbook
- threat_intelligence
扩展字段
{
"batch_id": "20260715055022",
"domains": [
{
"value": "ljhdfdevcaa.cn"
},
{
"value": "www.cfaq1.cyou"
}
],
"file_paths": [
{
"file_name": "aicoin Setup.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\aicoin Setup.exe"
},
{
"file_name": "cache[1].dat",
"path": "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D5THM8JX\\cache[1].dat"
},
{
"file_name": "is-GNDJ4.tmp",
"path": "C:\\ProgramData\\CfServerSoftwareDistribution\\is-GNDJ4.tmp"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\SlCcUI\\XPSPLOG.dll"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\5b0CIZ\\XPSPLOG.dll"
},
{
"file_name": "ea9a5c6.msi",
"path": "C:\\Windows\\Installer\\ea9a5c6.msi"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\OlOIQr\\UxEnhance64.dll"
},
{
"file_name": "Clas_x64-setup.exe",
"path": "C:\\Users\\Administrator\\Desktop\\Clas_2501.38x64\\Clas_x64-setup.exe"
},
{
"file_name": "AliyunWrap.dll",
"path": "C:\\mingw64\\Qpb8s\\7cx0Z\\nNDy\\sec_E898\\AliyunWrap.dll"
},
{
"file_name": "tmp531A.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp531A.tmp"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\h0KzID\\XPSPLOG.dll"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\Um7qzx\\XPSPLOG.dll"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\uaPyw6\\XPSPLOG.dll"
},
{
"file_name": "svchost.exe",
"path": "c:\\windows\\apppatch\\svchost.exe"
},
{
"file_name": "AliyunWrap.dll",
"path": "C:\\scoop\\xjz9\\KtGZ\\v8m3\\bkp_4155\\AliyunWrap.dll"
},
{
"file_name": "is-NTJK0.tmp",
"path": "C:\\ProgramData\\CfServerSoftwareDistribution\\is-NTJK0.tmp"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\pttz03\\XPSPLOG.dll"
},
{
"file_name": "ea93ff8.msi",
"path": "C:\\Windows\\Installer\\ea93ff8.msi"
},
{
"file_name": "ea99626.msi",
"path": "C:\\Windows\\Installer\\ea99626.msi"
},
{
"file_name": "6bf5f2.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\is-P5D9P.tmp\\6bf5f2.tmp"
},
{
"file_name": "is-L3C0U.tmp",
"path": "C:\\Drivers\\jysMxb\\SYYeNN\\jEAm\\is-L3C0U.tmp"
},
{
"file_name": "libcef[1].txt",
"path": "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\H7VKYJQ5\\libcef[1].txt"
},
{
"file_name": "AliyunWrap.dll",
"path": "C:\\winget\\hDqF\\bR80\\NyQV\\cfg_4393\\AliyunWrap.dll"
},
{
"file_name": "is-LDPDF.tmp",
"path": "C:\\msys64\\WFuX4o\\2xgA\\YvgEMA\\is-LDPDF.tmp"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\Mbq4in\\UxEnhance64.dll"
},
{
"file_name": "is-BDIH0.tmp",
"path": "C:\\Drivers\\jysMxb\\SYYeNN\\jEAm\\is-BDIH0.tmp"
},
{
"file_name": "is-2R5ND.tmp",
"path": "C:\\Drivers\\jysMxb\\SYYeNN\\jEAm\\is-2R5ND.tmp"
},
{
"file_name": "is-CUJ77.tmp",
"path": "C:\\msys64\\WFuX4o\\2xgA\\YvgEMA\\is-CUJ77.tmp"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\2jlN2w\\XPSPLOG.dll"
},
{
"file_name": "active_desktop_render_x64.dll",
"path": "C:\\Users\\Public\\qbn2dwxshs\\active_desktop_render_x64.dll"
},
{
"file_name": "CoreLogic.dll",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\is-KSK3N.tmp\\CoreLogic.dll"
},
{
"file_name": "is-7N6DJ.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\is-KSK3N.tmp\\is-7N6DJ.tmp"
},
{
"file_name": "9e4.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\9e4.tmp"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\aCnN0n\\XPSPLOG.dll"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\U7FruL\\UxEnhance64.dll"
},
{
"file_name": "ea8479e.msi",
"path": "C:\\Windows\\Installer\\ea8479e.msi"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\jSSqfR\\UxEnhance64.dll"
},
{
"file_name": "nsis_tauri_utils.dll",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\nsu3084.tmp\\nsis_tauri_utils.dll"
},
{
"file_name": "nvml.dll",
"path": "c:\\program files\\internet explorer\\nvml.dll"
},
{
"file_name": "WerFaultSecure.exe",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\dllcache\\WerFaultSecure.exe"
}
],
"hashes": [
{
"md5": null,
"sha1": null,
"sha256": "0418846619536e6e7ae7693de62e1f732302ea69b2d3d6fbc78ddb68e044f601"
},
{
"md5": null,
"sha1": null,
"sha256": "367afee3dc1683915a1f78b8d6df83540da7378689ab1e81be5e4e3a3b554bc4"
},
{
"md5": null,
"sha1": null,
"sha256": "c7a2e45edfcdc2fd6f8e153e9dfaa68b1d1f333d7010bbe07f9512b81fdafbed"
},
{
"md5": null,
"sha1": null,
"sha256": "a5a68aae46173faaa17b4862d13b13b9ca411104fb869a5fb6f7603e9114e6b7"
},
{
"md5": null,
"sha1": null,
"sha256": "5c33858ce0a150bf66b7d0e355ca9f735a825a9233fa38021c63adeb8dadd7eb"
},
{
"md5": null,
"sha1": null,
"sha256": "4c03df1a74a6146e2eb86dfa909f57752c711a85e522e1acf852a0cc9769a61d"
},
{
"md5": null,
"sha1": null,
"sha256": "61c9ccc19177088d3edc2be219d47b74fff75773d658a9a59f8621d1ab176fe6"
},
{
"md5": null,
"sha1": null,
"sha256": "d01547204585316775b9f6f4f5f7b2d462489c23137303ca92f9387d35bc30ed"
},
{
"md5": null,
"sha1": null,
"sha256": "2754b8afe8f09075f8166f5514da33d3bc2be9c1ad09961f1281af155a8d676a"
},
{
"md5": null,
"sha1": null,
"sha256": "ea1746383b6b14b6562cb9e9c8778634c4edc94e80dc86c6e540393514a00679"
},
{
"md5": null,
"sha1": null,
"sha256": "64bc8c28ba2fbe5c7a86d41b50edb06da38f370ca8bbff4b7a0aabe5e833bc12"
},
{
"md5": null,
"sha1": null,
"sha256": "6f475cd0adf89b55de74264a7361c94d170b305dc5abc9ea98b7c4b6ee874c0e"
},
{
"md5": null,
"sha1": null,
"sha256": "46a779e611bd8734dcb3d3592fd9354961a88837cc45ebcd3600fdf1d0fa0118"
},
{
"md5": null,
"sha1": null,
"sha256": "6a1faf29261b42a777e451871df2d32226de62fd1022d26d4e243d6b51506685"
},
{
"md5": null,
"sha1": null,
"sha256": "bae15240492c59f9154ae03e743e2ee49b34853850c27bc8086c9d81dd7d827c"
},
{
"md5": null,
"sha1": null,
"sha256": "a4d2034e1d131536a23d5b75e96963581e5eebb0961ef6bb93c97e8ebc666439"
},
{
"md5": null,
"sha1": null,
"sha256": "feb5f1e749f6d7592fa8aec84c297fd790933dd37f68b51f13d952741ecf497c"
},
{
"md5": null,
"sha1": null,
"sha256": "5fe53e223f079bc18b4b262d88acea69e8da71396f521e1c60e00f6e92973cb2"
},
{
"md5": null,
"sha1": null,
"sha256": "ad985a3a3a3ed090b3464db9a90e27fa39f42fcc4ba50673019908f425fa9e2c"
},
{
"md5": null,
"sha1": null,
"sha256": "9b598c4b3e74161a2633c3447463e21f93b67f82e34dd0d0c69c923b94d3d7e6"
},
{
"md5": null,
"sha1": null,
"sha256": "8e6cbc3c3969d86a047ccd327a51b73c30756ce23f2b61b326cc54362360430e"
},
{
"md5": null,
"sha1": null,
"sha256": "c7dec91b41eee6d0b917ad99fd238d68ed154281102e69e1920844c5e7bd5818"
},
{
"md5": null,
"sha1": null,
"sha256": "72dec3c02dfac216934d5bc83c8cd83f43a7f4caca3442cac0662f17bc36bffc"
},
{
"md5": null,
"sha1": null,
"sha256": "f25d960a546f1aa8a9b4af8a82ff9ffebb405d0548a2cf385c1b30aaf91412e4"
},
{
"md5": null,
"sha1": null,
"sha256": "afd735c149aa7bf8e66a85a8263ecdba07c9e2a9886608104208b64c0ede49c5"
},
{
"md5": null,
"sha1": null,
"sha256": "c80fc0ffdd56020a481dd2b4fdd94d44399616da08575546e770fa61bbd14e9c"
},
{
"md5": null,
"sha1": null,
"sha256": "4c185f4f3de356e6d961945afd0ac113b681ab968b6986ce00cc22871ce7541e"
},
{
"md5": null,
"sha1": null,
"sha256": "d9ff4aa7d35e3c2d0dad1528a4ed1db03232eef5312c7925d850528dbc1730f5"
},
{
"md5": null,
"sha1": null,
"sha256": "07d0a120f7180b2855ba1e70f61da0a0d1933254184f4529c3fdab247ad3f78b"
},
{
"md5": null,
"sha1": null,
"sha256": "299d23e6d5323b3a13e87570e07a2dc863a4a9c67a94149e79f499c9f1808397"
}
],
"ips": [
{
"value": "134.122.204.241"
},
{
"value": "75.2.88.106"
},
{
"value": "18.163.130.119"
},
{
"value": "43.157.212.233"
},
{
"value": "43.226.47.236"
},
{
"value": "43.199.110.109"
}
],
"stats": {
"new_domains": 2,
"new_file_paths": 40,
"new_hashes": 30,
"new_ips": 6,
"total_new": 78
},
"update_time": "2026-07-14T21:01:35.759000+00:00",
"update_time_ms": 1784062895759
}