银狐IOC情报 批次#20260719055016
摘要
银狐恶意软件IOC情报新增: 5个IP, 3个域名, 26个样本, 47个路径。数据时间: 2026-07-18 21:01 UTC
正文
# 银狐恶意软件 IOC 情报(新增) ## 基本信息 - **批次ID**: 20260719055016 - **数据更新时间**: 2026-07-18 21:01:40 UTC - **采集时间**: 2026-07-18 21:50:41 UTC ## 本批次新增统计 | 类型 | 新增数量 | |------|----------| | 恶意IP | 5 | | 恶意域名 | 3 | | 恶意样本 | 26 | | 释放路径 | 47 | ## 新增恶意 IP 地址 | # | IP 地址 | |---|---------| | 1 | `122.248.198.240` | | 2 | `154.198.50.170` | | 3 | `43.155.35.209` | | 4 | `27.124.9.47` | | 5 | `122.10.20.126` | ## 新增恶意域名 | # | 域名 | |---|------| | 1 | `babyy2.com` | | 2 | `womsz.com` | | 3 | `www.m1ppyse87.com` | ## 新增恶意样本哈希 | # | SHA256 | MD5 | SHA1 | |---|--------|-----|------| | 1 | `bb545e036e1e1f90...12110676` | - | - | | 2 | `b576ff518f0fc86c...f7b65fd0` | - | - | | 3 | `28844652fb3520ac...eae6e6a9` | - | - | | 4 | `d42f87f8b1da6f22...7bfce871` | - | - | | 5 | `adfc4d71a5882079...9637c0e4` | - | - | | 6 | `ce00b39d553c7bfd...c232612d` | - | - | | 7 | `a478b3b2f5202704...1f9e6b7e` | - | - | | 8 | `b4bcff86db3b4aa2...70bfc9b2` | - | - | | 9 | `26b7d6d287377127...5d5a5a75` | - | - | | 10 | `002caa844bf72a53...f88e8bd1` | - | - | | 11 | `0008fbdd1f940cfb...a9a25c92` | - | - | | 12 | `9e18d7ceceae6fec...b0c5eebf` | - | - | | 13 | `81b47df5f3ab79bc...ba624edb` | - | - | | 14 | `fb0007b099f52678...d49f8545` | - | - | | 15 | `989f724739d82159...6ae2eff1` | - | - | | 16 | `d8bddadb81210503...f3c8eae9` | - | - | | 17 | `21967765b554320f...dd6e22b4` | - | - | | 18 | `e53c5228e6b86c58...07893ca4` | - | - | | 19 | `b77d1aff23807e71...dfcee0c3` | - | - | | 20 | `4a4c809e89fdb6d2...e807eb75` | - | - | | 21 | `8ddea47adf3fc3af...4d567b93` | - | - | | 22 | `36ee6efce0b114a5...cca0f978` | - | - | | 23 | `9a029f86044b1df4...d7a35279` | - | - | | 24 | `0027d3f6ed77a4cc...0b37c53d` | - | - | | 25 | `4064751d6ed35f47...ee068617` | - | - | | 26 | `7b122f19a9900e6c...db54d40f` | - | - | ## 新增释放文件路径 | # | 文件路径 | 文件名 | |---|----------|--------| | 1 | `C:\winget\hDqF\bR80\NyQV\log_02DB\AliyunWrap.dll` | `AliyunWrap.dll` | | 2 | `C:\mingw64\Qpb8s\7cx0Z\nNDy\crsvc_91C6\AliyunWrap.dll` | `AliyunWrap.dll` | | 3 | `C:\Windows\Installer\ea92aab.msi` | `ea92aab.msi` | | 4 | `C:\Windows\Installer\ea958a0.msi` | `ea958a0.msi` | | 5 | `c:\users\administrator\appdata\local\temp\5d82.tmp` | `5d82.tmp` | | 6 | `C:\Users\Administrator\AppData\Local\Temp\tmp8205.tmp` | `tmp8205.tmp` | | 7 | `C:\Windows\Installer\ea96998.msi` | `ea96998.msi` | | 8 | `C:\Users\Administrator\AppData\Local\Temp\kb_10bc8c9a\runtimebroker.exe` | `runtimebroker.exe` | | 9 | `C:\Users\Public\m0lyntcswiio\active_desktop_render_x64.dll` | `active_desktop_render_x64.dll` | | 10 | `C:\Users\Public\TYNAra\UxEnhance64.dll` | `UxEnhance64.dll` | | 11 | `C:\Users\Public\Libraries\L3RZyb\Rb9i8sBC6.dat` | `Rb9i8sBC6.dat` | | 12 | `C:\Users\Public\Libraries\L3RZyb\edge.xml` | `edge.xml` | | 13 | `C:\mingw64\Qpb8s\NU2Wv\msupd_16212\bywwofj.exe` | `bywwofj.exe` | | 14 | `C:\msys64\bj9X\gz36v\mnlROJ\is-MQ94R.tmp` | `is-MQ94R.tmp` | | 15 | `C:\Users\Public\Libraries\L3RZyb\Rb9i8sBC6.exe` | `Rb9i8sBC6.exe` | | 16 | `C:\Users\Administrator\AppData\Local\Local\assembly\dl3\IkZGz\HwqU\c3dU\lTYm\M7VCq.l` | `M7VCq.l` | | 17 | `C:\Users\Administrator\AppData\Local\Temp\tmp7D4F.tmp` | `tmp7D4F.tmp` | | 18 | `C:\Program Files (x86)\Youdao-x64\Youdao-x64\appi\guard.pyd` | `guard.pyd` | | 19 | `C:\Windows\Installer\ea92701.msi` | `ea92701.msi` | | 20 | `C:\winget\hDqF\bR80\NyQV\diag_D2F8\AliyunWrap.dll` | `AliyunWrap.dll` | | 21 | `C:\Users\Public\Videos\4mXdmHm\edge.xml` | `edge.xml` | | 22 | `C:\msys64\I1HS\YIui9Q\SK5R\pEyO\r.0r` | `r.0r` | | 23 | `C:\Users\Public\ZpaP0z\UxEnhance64.dll` | `UxEnhance64.dll` | | 24 | `C:\Program Files (x86)\Youdao-x64\Youdao-x64\appi\svchost.pyc` | `svchost.pyc` | | 25 | `C:\Users\Public\Videos\4mXdmHm\UtAu.exe` | `UtAu.exe` | | 26 | `C:\Program Files (x86)\Your Product\iDQsDKJY.tBd` | `iDQsDKJY.tBd` | | 27 | `C:\Windows\Installer\ea94334.msi` | `ea94334.msi` | | 28 | `C:\Windows\Installer\ea94dd3.msi` | `ea94dd3.msi` | | 29 | `c:\users\administrator\appdata\local\temp\tmpf241.tmp` | `tmpf241.tmp` | | 30 | `C:\Users\Public\Videos\4mXdmHm\6rceAakO.exe` | `6rceAakO.exe` | | 31 | `C:\msys64\4Km3\G82pRg\sRy12G\e907\n.N` | `n.N` | | 32 | `C:\Users\Public\Libraries\L3RZyb\XK2.dat` | `XK2.dat` | | 33 | `C:\Drivers\gGX6H\2Kl5c\jFSQvd\ma3FF3Km.MQR` | `ma3FF3Km.MQR` | | 34 | `C:\mingw64\Qpb8s\7cx0Z\nNDy\diag_A8D4\AliyunWrap.dll` | `AliyunWrap.dll` | | 35 | `C:\msys64\bj9X\gz36v\mnlROJ\is-U4LU1.tmp` | `is-U4LU1.tmp` | | 36 | `C:\Users\Administrator\Desktop\527hAGW\5xrc8T\XPSPLOG.dll` | `XPSPLOG.dll` | | 37 | `C:\Users\Public\Yk01Ck\UxEnhance64.dll` | `UxEnhance64.dll` | | 38 | `C:\Users\Administrator\Desktop\m6dlH9\XPSPLOG.dll` | `XPSPLOG.dll` | | 39 | `C:\Users\Public\Libraries\L3RZyb\XK2.exe` | `XK2.exe` | | 40 | `C:\winget\hDqF\XrwD2\msupd_81473\deobgp.exe` | `deobgp.exe` | | 41 | `C:\msys64\B4gPit\O5U83\5SqkZp\RWg.zQ1` | `RWg.zQ1` | | 42 | `C:\Windows\Installer\ea970cc.msi` | `ea970cc.msi` | | 43 | `C:\Users\Public\bF2LYO\UxEnhance64.dll` | `UxEnhance64.dll` | | 44 | `C:\Users\Public\ehLVbD\UxEnhance64.dll` | `UxEnhance64.dll` | | 45 | `C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\OKVYXXBW\4[1]` | `4[1]` | | 46 | `C:\Windows\Installer\eaa270c.msi` | `eaa270c.msi` | | 47 | `C:\Program Files (x86)\Your Product\iU5a087.329` | `iU5a087.329` |
标签
- ioc
- ioc:domain
- ioc:filepath
- ioc:hash
- ioc:ip
- silverfox
- threatbook
- threat_intelligence
扩展字段
{
"batch_id": "20260719055016",
"domains": [
{
"value": "babyy2.com"
},
{
"value": "womsz.com"
},
{
"value": "www.m1ppyse87.com"
}
],
"file_paths": [
{
"file_name": "AliyunWrap.dll",
"path": "C:\\winget\\hDqF\\bR80\\NyQV\\log_02DB\\AliyunWrap.dll"
},
{
"file_name": "AliyunWrap.dll",
"path": "C:\\mingw64\\Qpb8s\\7cx0Z\\nNDy\\crsvc_91C6\\AliyunWrap.dll"
},
{
"file_name": "ea92aab.msi",
"path": "C:\\Windows\\Installer\\ea92aab.msi"
},
{
"file_name": "ea958a0.msi",
"path": "C:\\Windows\\Installer\\ea958a0.msi"
},
{
"file_name": "5d82.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\5d82.tmp"
},
{
"file_name": "tmp8205.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp8205.tmp"
},
{
"file_name": "ea96998.msi",
"path": "C:\\Windows\\Installer\\ea96998.msi"
},
{
"file_name": "runtimebroker.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\kb_10bc8c9a\\runtimebroker.exe"
},
{
"file_name": "active_desktop_render_x64.dll",
"path": "C:\\Users\\Public\\m0lyntcswiio\\active_desktop_render_x64.dll"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\TYNAra\\UxEnhance64.dll"
},
{
"file_name": "Rb9i8sBC6.dat",
"path": "C:\\Users\\Public\\Libraries\\L3RZyb\\Rb9i8sBC6.dat"
},
{
"file_name": "edge.xml",
"path": "C:\\Users\\Public\\Libraries\\L3RZyb\\edge.xml"
},
{
"file_name": "bywwofj.exe",
"path": "C:\\mingw64\\Qpb8s\\NU2Wv\\msupd_16212\\bywwofj.exe"
},
{
"file_name": "is-MQ94R.tmp",
"path": "C:\\msys64\\bj9X\\gz36v\\mnlROJ\\is-MQ94R.tmp"
},
{
"file_name": "Rb9i8sBC6.exe",
"path": "C:\\Users\\Public\\Libraries\\L3RZyb\\Rb9i8sBC6.exe"
},
{
"file_name": "M7VCq.l",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Local\\assembly\\dl3\\IkZGz\\HwqU\\c3dU\\lTYm\\M7VCq.l"
},
{
"file_name": "tmp7D4F.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tmp7D4F.tmp"
},
{
"file_name": "guard.pyd",
"path": "C:\\Program Files (x86)\\Youdao-x64\\Youdao-x64\\appi\\guard.pyd"
},
{
"file_name": "ea92701.msi",
"path": "C:\\Windows\\Installer\\ea92701.msi"
},
{
"file_name": "AliyunWrap.dll",
"path": "C:\\winget\\hDqF\\bR80\\NyQV\\diag_D2F8\\AliyunWrap.dll"
},
{
"file_name": "edge.xml",
"path": "C:\\Users\\Public\\Videos\\4mXdmHm\\edge.xml"
},
{
"file_name": "r.0r",
"path": "C:\\msys64\\I1HS\\YIui9Q\\SK5R\\pEyO\\r.0r"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\ZpaP0z\\UxEnhance64.dll"
},
{
"file_name": "svchost.pyc",
"path": "C:\\Program Files (x86)\\Youdao-x64\\Youdao-x64\\appi\\svchost.pyc"
},
{
"file_name": "UtAu.exe",
"path": "C:\\Users\\Public\\Videos\\4mXdmHm\\UtAu.exe"
},
{
"file_name": "iDQsDKJY.tBd",
"path": "C:\\Program Files (x86)\\Your Product\\iDQsDKJY.tBd"
},
{
"file_name": "ea94334.msi",
"path": "C:\\Windows\\Installer\\ea94334.msi"
},
{
"file_name": "ea94dd3.msi",
"path": "C:\\Windows\\Installer\\ea94dd3.msi"
},
{
"file_name": "tmpf241.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\tmpf241.tmp"
},
{
"file_name": "6rceAakO.exe",
"path": "C:\\Users\\Public\\Videos\\4mXdmHm\\6rceAakO.exe"
},
{
"file_name": "n.N",
"path": "C:\\msys64\\4Km3\\G82pRg\\sRy12G\\e907\\n.N"
},
{
"file_name": "XK2.dat",
"path": "C:\\Users\\Public\\Libraries\\L3RZyb\\XK2.dat"
},
{
"file_name": "ma3FF3Km.MQR",
"path": "C:\\Drivers\\gGX6H\\2Kl5c\\jFSQvd\\ma3FF3Km.MQR"
},
{
"file_name": "AliyunWrap.dll",
"path": "C:\\mingw64\\Qpb8s\\7cx0Z\\nNDy\\diag_A8D4\\AliyunWrap.dll"
},
{
"file_name": "is-U4LU1.tmp",
"path": "C:\\msys64\\bj9X\\gz36v\\mnlROJ\\is-U4LU1.tmp"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Users\\Administrator\\Desktop\\527hAGW\\5xrc8T\\XPSPLOG.dll"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\Yk01Ck\\UxEnhance64.dll"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Users\\Administrator\\Desktop\\m6dlH9\\XPSPLOG.dll"
},
{
"file_name": "XK2.exe",
"path": "C:\\Users\\Public\\Libraries\\L3RZyb\\XK2.exe"
},
{
"file_name": "deobgp.exe",
"path": "C:\\winget\\hDqF\\XrwD2\\msupd_81473\\deobgp.exe"
},
{
"file_name": "RWg.zQ1",
"path": "C:\\msys64\\B4gPit\\O5U83\\5SqkZp\\RWg.zQ1"
},
{
"file_name": "ea970cc.msi",
"path": "C:\\Windows\\Installer\\ea970cc.msi"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\bF2LYO\\UxEnhance64.dll"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\ehLVbD\\UxEnhance64.dll"
},
{
"file_name": "4[1]",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\OKVYXXBW\\4[1]"
},
{
"file_name": "eaa270c.msi",
"path": "C:\\Windows\\Installer\\eaa270c.msi"
},
{
"file_name": "iU5a087.329",
"path": "C:\\Program Files (x86)\\Your Product\\iU5a087.329"
}
],
"hashes": [
{
"md5": null,
"sha1": null,
"sha256": "bb545e036e1e1f90b9cd254211e4fa4c96f51c234d2bc522426c415812110676"
},
{
"md5": null,
"sha1": null,
"sha256": "b576ff518f0fc86c6a20675beecebbe78ee93f0f18b9be99d6f58cb1f7b65fd0"
},
{
"md5": null,
"sha1": null,
"sha256": "28844652fb3520ac318ab50de154c5e75b1561036c59e5a52c30315ceae6e6a9"
},
{
"md5": null,
"sha1": null,
"sha256": "d42f87f8b1da6f22e80435696d22849cfdae25a1380ca7bdbc03389b7bfce871"
},
{
"md5": null,
"sha1": null,
"sha256": "adfc4d71a5882079358e8c5bcaf9550858dfe4c4acc1624006dfa0e79637c0e4"
},
{
"md5": null,
"sha1": null,
"sha256": "ce00b39d553c7bfd8d09aecee9ecfa617482ac27ee3af74179e4923dc232612d"
},
{
"md5": null,
"sha1": null,
"sha256": "a478b3b2f5202704c91eb169d9862fefe1c6bfc453deb020d424b6921f9e6b7e"
},
{
"md5": null,
"sha1": null,
"sha256": "b4bcff86db3b4aa2e161b0e08f717ee95d575a8c8b2c48ae0a1f5e5c70bfc9b2"
},
{
"md5": null,
"sha1": null,
"sha256": "26b7d6d287377127e8a6884bf5c13eff64a704c9809f69562173402e5d5a5a75"
},
{
"md5": null,
"sha1": null,
"sha256": "002caa844bf72a530dee5ebed010ce8ae2be470a214909da9a9515a2f88e8bd1"
},
{
"md5": null,
"sha1": null,
"sha256": "0008fbdd1f940cfb720005caa4cf0611c017e4d17e12902c9958cf33a9a25c92"
},
{
"md5": null,
"sha1": null,
"sha256": "9e18d7ceceae6fec7056562a080f8f742e6859d9b6457e59f0276654b0c5eebf"
},
{
"md5": null,
"sha1": null,
"sha256": "81b47df5f3ab79bce5efad4171fe4e442df2bf3af5021e7120e9e682ba624edb"
},
{
"md5": null,
"sha1": null,
"sha256": "fb0007b099f52678c7bd3931b09ec25833db9c1d5c7a954bc360172bd49f8545"
},
{
"md5": null,
"sha1": null,
"sha256": "989f724739d82159f9caa8dbaa0a04953251acf69e1a6f2f37da76c86ae2eff1"
},
{
"md5": null,
"sha1": null,
"sha256": "d8bddadb8121050305ae401bb50c485ab27f7ec8ff26b545c1b6b05df3c8eae9"
},
{
"md5": null,
"sha1": null,
"sha256": "21967765b554320f47686a3ed12900ae18ae5bb16e3c44fb92145c4ddd6e22b4"
},
{
"md5": null,
"sha1": null,
"sha256": "e53c5228e6b86c58920666e95d53d9ee067df6ef9e8c6e47062d1d2707893ca4"
},
{
"md5": null,
"sha1": null,
"sha256": "b77d1aff23807e71f63d60ea22f46a5cfe45da3f97515b4ff09854abdfcee0c3"
},
{
"md5": null,
"sha1": null,
"sha256": "4a4c809e89fdb6d21651144463920cba267cf84a1d8dc667abaec2cbe807eb75"
},
{
"md5": null,
"sha1": null,
"sha256": "8ddea47adf3fc3af0bfce1448aeb46297ee26f9e20d2db16b8ed8ea74d567b93"
},
{
"md5": null,
"sha1": null,
"sha256": "36ee6efce0b114a5e60ac12098e6faeb54ebb30718d6d9325653a035cca0f978"
},
{
"md5": null,
"sha1": null,
"sha256": "9a029f86044b1df492ec02aa0c26497b55b93f3bcf7fd714ea60a1a1d7a35279"
},
{
"md5": null,
"sha1": null,
"sha256": "0027d3f6ed77a4cc99a0f56f5f1026ecf36d32262118dde9562659340b37c53d"
},
{
"md5": null,
"sha1": null,
"sha256": "4064751d6ed35f47bb7ec33fe06c6403627a42d1dfd357677272aff4ee068617"
},
{
"md5": null,
"sha1": null,
"sha256": "7b122f19a9900e6c1fb70978f4ebdfcd6af2331dd48454b51b5dcb15db54d40f"
}
],
"ips": [
{
"value": "122.248.198.240"
},
{
"value": "154.198.50.170"
},
{
"value": "43.155.35.209"
},
{
"value": "27.124.9.47"
},
{
"value": "122.10.20.126"
}
],
"stats": {
"new_domains": 3,
"new_file_paths": 47,
"new_hashes": 26,
"new_ips": 5,
"total_new": 81
},
"update_time": "2026-07-18T21:01:40.652000+00:00",
"update_time_ms": 1784408500652
}