银狐IOC情报 批次#20260721055034
摘要
银狐恶意软件IOC情报新增: 7个IP, 2个域名, 30个样本, 49个路径。数据时间: 2026-07-20 21:01 UTC
正文
# 银狐恶意软件 IOC 情报(新增) ## 基本信息 - **批次ID**: 20260721055034 - **数据更新时间**: 2026-07-20 21:01:26 UTC - **采集时间**: 2026-07-20 21:51:03 UTC ## 本批次新增统计 | 类型 | 新增数量 | |------|----------| | 恶意IP | 7 | | 恶意域名 | 2 | | 恶意样本 | 30 | | 释放路径 | 49 | ## 新增恶意 IP 地址 | # | IP 地址 | |---|---------| | 1 | `150.109.48.238` | | 2 | `156.234.58.194` | | 3 | `154.82.93.140` | | 4 | `45.204.200.26` | | 5 | `156.238.238.90` | | 6 | `95.41.61.167` | | 7 | `154.91.74.87` | ## 新增恶意域名 | # | 域名 | |---|------| | 1 | `www.fkgaafhl.com` | | 2 | `osgyx.cn` | ## 新增恶意样本哈希 | # | SHA256 | MD5 | SHA1 | |---|--------|-----|------| | 1 | `4675d4bc6f90104e...5125288e` | - | - | | 2 | `63522452b1ed07e4...b691522f` | - | - | | 3 | `383d31b2f45850ee...22f9457c` | - | - | | 4 | `56320dd9c2947bd1...09759695` | - | - | | 5 | `92b294349ef72adf...d7144490` | - | - | | 6 | `35655d18c3125f9d...c91a9a78` | - | - | | 7 | `06398ed992cbfe95...90dd9581` | - | - | | 8 | `29c3018a1e280d5b...76cd5769` | - | - | | 9 | `f60479b170d3f48d...64dc0230` | - | - | | 10 | `1da6f290459efcf1...ac1657a3` | - | - | | 11 | `fa6455cf93170b4b...c7e1aebb` | - | - | | 12 | `44144753956267af...0a861b7f` | - | - | | 13 | `d6e0045d00be694a...4a4eff93` | - | - | | 14 | `4dbec5f088f61f50...27eadd99` | - | - | | 15 | `c5b0139ebedadf16...7de2dc6b` | - | - | | 16 | `db47572a9bb1e916...7f861092` | - | - | | 17 | `d3a54b3bc04ac88a...b2429aeb` | - | - | | 18 | `3a1c8262c985154e...9ed3ddad` | - | - | | 19 | `e3aea27b131113f3...c0450dcb` | - | - | | 20 | `1abe096d6916f812...759feae5` | - | - | | 21 | `647156b15b68d188...da8e9b8c` | - | - | | 22 | `4c00b92ef3df4a61...3eef3982` | - | - | | 23 | `c0f4ed7f9399eef2...c46d2e35` | - | - | | 24 | `072ed95b6478d5eb...b6ac83fd` | - | - | | 25 | `96c0911c225219cf...3e20d6fb` | - | - | | 26 | `88af6777ff214739...20922840` | - | - | | 27 | `1b9f18a7d6badb96...0b0cb315` | - | - | | 28 | `cbfa8bb98c49a1ec...35e7aaf0` | - | - | | 29 | `394819a153d6802f...dab78fb9` | - | - | | 30 | `fe5fecbb60b41fea...754577c3` | - | - | ## 新增释放文件路径 | # | 文件路径 | 文件名 | |---|----------|--------| | 1 | `C:\msys64\FCJPX\yzrvzJ\P1u6\7uYq\uJQ.2w` | `uJQ.2w` | | 2 | `C:\Users\Public\deeSMl\UxEnhance64.dll` | `UxEnhance64.dll` | | 3 | `C:\Users\Public\vuPYGS\UxEnhance64.dll` | `UxEnhance64.dll` | | 4 | `C:\Users\Admin\AppData\Local\chrmstp.exe` | `chrmstp.exe` | | 5 | `c:\users\administrator\appdata\local\temp\tmp47c8.tmp` | `tmp47c8.tmp` | | 6 | `c:\users\administrator\appdata\local\temp\1fbe.tmp` | `1fbe.tmp` | | 7 | `C:\Users\Administrator\AppData\Roaming\Microsoft\EdgeUpdate\msedgeupdate.db` | `msedgeupdate.db` | | 8 | `C:\Program Files (x86)\jEqzMx\XPSPLOG.dll` | `XPSPLOG.dll` | | 9 | `C:\Users\Admin\AppData\Local\Temp\MyApp\Utility.dll` | `Utility.dll` | | 10 | `C:\Windows\Installer\ea9808b.msi` | `ea9808b.msi` | | 11 | `C:\Program Files (x86)\2mCsT\XPSPLOG.dll` | `XPSPLOG.dll` | | 12 | `C:\Users\Admin\AppData\Roaming\TrustAsia\intel.dll` | `intel.dll` | | 13 | `C:\Users\Admin\AppData\Roaming\Config2.json` | `Config2.json` | | 14 | `C:\Users\Administrator\AppData\Roaming\aggrhrhsehsehsehshsehshrsehsehsehshshshhdrhdrhdrhturururafafafFJSGESGSESG\is-7N8UC.tmp` | `is-7N8UC.tmp` | | 15 | `C:\Program Files (x86)\kugou\mfc100u.dll` | `mfc100u.dll` | | 16 | `C:\Users\Administrator\AppData\Roaming\aggrhrhsehsehsehshsehshrsehsehsehshshshhdrhdrhdrhturururafafafFJSGESGSESG\is-BAC1I.tmp` | `is-BAC1I.tmp` | | 17 | `C:\ProgramData\build-\V6imPnb\is-54HRE.tmp` | `is-54HRE.tmp` | | 18 | `C:\Users\Public\algnro\UxEnhance64.dll` | `UxEnhance64.dll` | | 19 | `C:\Users\Administrator\AppData\Roaming\Microsoft\EdgeUpdate\tsdmdcvs.bat` | `tsdmdcvs.bat` | | 20 | `C:\Users\Administrator\AppData\Roaming\Config.json` | `Config.json` | | 21 | `c:\users\administrator\appdata\local\temp\tmp9948.tmp` | `tmp9948.tmp` | | 22 | `C:\Windows\Installer\ea81042.msi` | `ea81042.msi` | | 23 | `C:\ProgramData\build-\V6imPnb\is-7H8GL.tmp` | `is-7H8GL.tmp` | | 24 | `C:\Program Files (x86)\cI4TN4\XPSPLOG.dll` | `XPSPLOG.dll` | | 25 | `c:\users\administrator\appdata\local\temp\tmpa9ae.tmp` | `tmpa9ae.tmp` | | 26 | `C:\Program Files (x86)\CoremailClient\PegPad.dll` | `PegPad.dll` | | 27 | `C:\Users\Administrator\AppData\Local\chrmstp.exe` | `chrmstp.exe` | | 28 | `c:\programdata\quicklauncher\quicklauncher.exe` | `quicklauncher.exe` | | 29 | `C:\Users\Public\Videos\htrjhj_fit.dll` | `htrjhj_fit.dll` | | 30 | `C:\Users\Administrator\AppData\Roaming\Microsoft\EdgeUpdate\dovyhmfc.bat` | `dovyhmfc.bat` | | 31 | `C:\Windows\Installer\ea955b2.msi` | `ea955b2.msi` | | 32 | `C:\Users\Administrator\AppData\Roaming\Config2.json` | `Config2.json` | | 33 | `C:\Windows\Installer\ea94c2d.msi` | `ea94c2d.msi` | | 34 | `C:\Users\Administrator\AppData\Local\Temp\2Lj0NI.exe` | `2Lj0NI.exe` | | 35 | `C:\Users\Admin\AppData\Roaming\Config.json` | `Config.json` | | 36 | `C:\Windows\Installer\ea96301.msi` | `ea96301.msi` | | 37 | `C:\Users\Public\bmUG69\UxEnhance64.dll` | `UxEnhance64.dll` | | 38 | `c:\users\administrator\appdata\local\temp\tmp7204.tmp` | `tmp7204.tmp` | | 39 | `C:\Windows\Installer\ea958cf.msi` | `ea958cf.msi` | | 40 | `C:\Users\Public\oOFWmb\UxEnhance64.dll` | `UxEnhance64.dll` | | 41 | `C:\ProgramData\OpenraVPN\Svchost.dll` | `Svchost.dll` | | 42 | `C:\Windows\Installer\ea7b4f3.msi` | `ea7b4f3.msi` | | 43 | `C:\Users\Public\Videos\htrjhj__fit.dll` | `htrjhj__fit.dll` | | 44 | `C:\Users\Administrator\AppData\Roaming\TrustAsia\intel.dll` | `intel.dll` | | 45 | `C:\Users\Public\2Bzawm\UxEnhance64.dll` | `UxEnhance64.dll` | | 46 | `C:\Users\Administrator\AppData\Roaming\aggrhrhsehsehsehshsehshrsehsehsehshshshhdrhdrhdrhturururafafafFJSGESGSESG\is-0EFES.tmp` | `is-0EFES.tmp` | | 47 | `C:\Drivers\836tzS\iloQOk\Q33pG\cKQg\is-5REHU.tmp` | `is-5REHU.tmp` | | 48 | `C:\Users\Public\DxDc2L\UxEnhance64.dll` | `UxEnhance64.dll` | | 49 | `C:\Users\Administrator\AppData\Local\Microsoft\Edge-v1\sec_920C\EVENT.dll` | `EVENT.dll` |
标签
- ioc
- ioc:domain
- ioc:filepath
- ioc:hash
- ioc:ip
- silverfox
- threatbook
- threat_intelligence
扩展字段
{
"batch_id": "20260721055034",
"domains": [
{
"value": "www.fkgaafhl.com"
},
{
"value": "osgyx.cn"
}
],
"file_paths": [
{
"file_name": "uJQ.2w",
"path": "C:\\msys64\\FCJPX\\yzrvzJ\\P1u6\\7uYq\\uJQ.2w"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\deeSMl\\UxEnhance64.dll"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\vuPYGS\\UxEnhance64.dll"
},
{
"file_name": "chrmstp.exe",
"path": "C:\\Users\\Admin\\AppData\\Local\\chrmstp.exe"
},
{
"file_name": "tmp47c8.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\tmp47c8.tmp"
},
{
"file_name": "1fbe.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\1fbe.tmp"
},
{
"file_name": "msedgeupdate.db",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\EdgeUpdate\\msedgeupdate.db"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\jEqzMx\\XPSPLOG.dll"
},
{
"file_name": "Utility.dll",
"path": "C:\\Users\\Admin\\AppData\\Local\\Temp\\MyApp\\Utility.dll"
},
{
"file_name": "ea9808b.msi",
"path": "C:\\Windows\\Installer\\ea9808b.msi"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\2mCsT\\XPSPLOG.dll"
},
{
"file_name": "intel.dll",
"path": "C:\\Users\\Admin\\AppData\\Roaming\\TrustAsia\\intel.dll"
},
{
"file_name": "Config2.json",
"path": "C:\\Users\\Admin\\AppData\\Roaming\\Config2.json"
},
{
"file_name": "is-7N8UC.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\aggrhrhsehsehsehshsehshrsehsehsehshshshhdrhdrhdrhturururafafafFJSGESGSESG\\is-7N8UC.tmp"
},
{
"file_name": "mfc100u.dll",
"path": "C:\\Program Files (x86)\\kugou\\mfc100u.dll"
},
{
"file_name": "is-BAC1I.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\aggrhrhsehsehsehshsehshrsehsehsehshshshhdrhdrhdrhturururafafafFJSGESGSESG\\is-BAC1I.tmp"
},
{
"file_name": "is-54HRE.tmp",
"path": "C:\\ProgramData\\build-\\V6imPnb\\is-54HRE.tmp"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\algnro\\UxEnhance64.dll"
},
{
"file_name": "tsdmdcvs.bat",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\EdgeUpdate\\tsdmdcvs.bat"
},
{
"file_name": "Config.json",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Config.json"
},
{
"file_name": "tmp9948.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\tmp9948.tmp"
},
{
"file_name": "ea81042.msi",
"path": "C:\\Windows\\Installer\\ea81042.msi"
},
{
"file_name": "is-7H8GL.tmp",
"path": "C:\\ProgramData\\build-\\V6imPnb\\is-7H8GL.tmp"
},
{
"file_name": "XPSPLOG.dll",
"path": "C:\\Program Files (x86)\\cI4TN4\\XPSPLOG.dll"
},
{
"file_name": "tmpa9ae.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\tmpa9ae.tmp"
},
{
"file_name": "PegPad.dll",
"path": "C:\\Program Files (x86)\\CoremailClient\\PegPad.dll"
},
{
"file_name": "chrmstp.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\chrmstp.exe"
},
{
"file_name": "quicklauncher.exe",
"path": "c:\\programdata\\quicklauncher\\quicklauncher.exe"
},
{
"file_name": "htrjhj_fit.dll",
"path": "C:\\Users\\Public\\Videos\\htrjhj_fit.dll"
},
{
"file_name": "dovyhmfc.bat",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\EdgeUpdate\\dovyhmfc.bat"
},
{
"file_name": "ea955b2.msi",
"path": "C:\\Windows\\Installer\\ea955b2.msi"
},
{
"file_name": "Config2.json",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\Config2.json"
},
{
"file_name": "ea94c2d.msi",
"path": "C:\\Windows\\Installer\\ea94c2d.msi"
},
{
"file_name": "2Lj0NI.exe",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\2Lj0NI.exe"
},
{
"file_name": "Config.json",
"path": "C:\\Users\\Admin\\AppData\\Roaming\\Config.json"
},
{
"file_name": "ea96301.msi",
"path": "C:\\Windows\\Installer\\ea96301.msi"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\bmUG69\\UxEnhance64.dll"
},
{
"file_name": "tmp7204.tmp",
"path": "c:\\users\\administrator\\appdata\\local\\temp\\tmp7204.tmp"
},
{
"file_name": "ea958cf.msi",
"path": "C:\\Windows\\Installer\\ea958cf.msi"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\oOFWmb\\UxEnhance64.dll"
},
{
"file_name": "Svchost.dll",
"path": "C:\\ProgramData\\OpenraVPN\\Svchost.dll"
},
{
"file_name": "ea7b4f3.msi",
"path": "C:\\Windows\\Installer\\ea7b4f3.msi"
},
{
"file_name": "htrjhj__fit.dll",
"path": "C:\\Users\\Public\\Videos\\htrjhj__fit.dll"
},
{
"file_name": "intel.dll",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\TrustAsia\\intel.dll"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\2Bzawm\\UxEnhance64.dll"
},
{
"file_name": "is-0EFES.tmp",
"path": "C:\\Users\\Administrator\\AppData\\Roaming\\aggrhrhsehsehsehshsehshrsehsehsehshshshhdrhdrhdrhturururafafafFJSGESGSESG\\is-0EFES.tmp"
},
{
"file_name": "is-5REHU.tmp",
"path": "C:\\Drivers\\836tzS\\iloQOk\\Q33pG\\cKQg\\is-5REHU.tmp"
},
{
"file_name": "UxEnhance64.dll",
"path": "C:\\Users\\Public\\DxDc2L\\UxEnhance64.dll"
},
{
"file_name": "EVENT.dll",
"path": "C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Edge-v1\\sec_920C\\EVENT.dll"
}
],
"hashes": [
{
"md5": null,
"sha1": null,
"sha256": "4675d4bc6f90104e79e53601d25078eeca6ca970487e89103e5d198f5125288e"
},
{
"md5": null,
"sha1": null,
"sha256": "63522452b1ed07e4f33376b0b8c85a4045e85594c3e7b03354afd985b691522f"
},
{
"md5": null,
"sha1": null,
"sha256": "383d31b2f45850ee3efa41459fa48aff5e88b8d8bbf68900b7a4e9e322f9457c"
},
{
"md5": null,
"sha1": null,
"sha256": "56320dd9c2947bd185d99129ed41caedb20ac3e26ac06b2cdf44562b09759695"
},
{
"md5": null,
"sha1": null,
"sha256": "92b294349ef72adfac748df7881c5c3be19d5fbcfe0236a8d923330ed7144490"
},
{
"md5": null,
"sha1": null,
"sha256": "35655d18c3125f9db3697ef91b8530c3ddbfc13013e9d73c615b3988c91a9a78"
},
{
"md5": null,
"sha1": null,
"sha256": "06398ed992cbfe95d887b8b16b57820a340d48c63a7d8fa6821c68fd90dd9581"
},
{
"md5": null,
"sha1": null,
"sha256": "29c3018a1e280d5bb9f146fcccbb5da95cfa102a0f81b714b8ac0a0d76cd5769"
},
{
"md5": null,
"sha1": null,
"sha256": "f60479b170d3f48d3f7fdf8dbbad436ac1b49d2cb1aa7ee72b2ebf1864dc0230"
},
{
"md5": null,
"sha1": null,
"sha256": "1da6f290459efcf121d9a84d43bbe052488e615ca49d91ed736cddbbac1657a3"
},
{
"md5": null,
"sha1": null,
"sha256": "fa6455cf93170b4bd0c874629752e71e3ed735b7e90d2154680384c1c7e1aebb"
},
{
"md5": null,
"sha1": null,
"sha256": "44144753956267affd496b5c930f102112139735c93f7e12017162650a861b7f"
},
{
"md5": null,
"sha1": null,
"sha256": "d6e0045d00be694af337f039ace6a9398c374f9f5cf83ede5b2c3f234a4eff93"
},
{
"md5": null,
"sha1": null,
"sha256": "4dbec5f088f61f5094a640cbedc9917b99e2532603b8c597e02b08e027eadd99"
},
{
"md5": null,
"sha1": null,
"sha256": "c5b0139ebedadf166c966f008a6e4800280a0574ea9098ea14af4fbe7de2dc6b"
},
{
"md5": null,
"sha1": null,
"sha256": "db47572a9bb1e9166c9f3f5ee0c82bc688f90c867c166099344749407f861092"
},
{
"md5": null,
"sha1": null,
"sha256": "d3a54b3bc04ac88ac578d4ada20d9c922535e41e15511b16ffbd62dfb2429aeb"
},
{
"md5": null,
"sha1": null,
"sha256": "3a1c8262c985154e7868f6e523fc059e0b0e28f14a920f3ad822d6399ed3ddad"
},
{
"md5": null,
"sha1": null,
"sha256": "e3aea27b131113f3da5e3f1f442ea35fd911eb68599c43a94191ab57c0450dcb"
},
{
"md5": null,
"sha1": null,
"sha256": "1abe096d6916f812e4638285d820819c30ced8dd2353250dfa480333759feae5"
},
{
"md5": null,
"sha1": null,
"sha256": "647156b15b68d18873a51581199075622958dba071d08acece1447c0da8e9b8c"
},
{
"md5": null,
"sha1": null,
"sha256": "4c00b92ef3df4a61ebcb324afd3ea2ea42de162f5aaac2de84bd4bf73eef3982"
},
{
"md5": null,
"sha1": null,
"sha256": "c0f4ed7f9399eef2b6ed989e6137045d51eaa2f7344146b2114f4d40c46d2e35"
},
{
"md5": null,
"sha1": null,
"sha256": "072ed95b6478d5ebf4917211091a0cf466cb643f74e2a6bb262d8d55b6ac83fd"
},
{
"md5": null,
"sha1": null,
"sha256": "96c0911c225219cfd380076f5196d7ee87c617cddb968d3d465122473e20d6fb"
},
{
"md5": null,
"sha1": null,
"sha256": "88af6777ff214739153827ce057a48606fbe6dc834e1221877257d2a20922840"
},
{
"md5": null,
"sha1": null,
"sha256": "1b9f18a7d6badb9661442f06028ad84be2da2528a906f934772144ae0b0cb315"
},
{
"md5": null,
"sha1": null,
"sha256": "cbfa8bb98c49a1ecf6af40d61d114e5941f837b71a0d2adef4121cea35e7aaf0"
},
{
"md5": null,
"sha1": null,
"sha256": "394819a153d6802ffd27db1a1ddc0c8a0bfcc9ee01494d72fa9f244adab78fb9"
},
{
"md5": null,
"sha1": null,
"sha256": "fe5fecbb60b41feac1e6814301b7eb250f97bc700184a4857744f7a9754577c3"
}
],
"ips": [
{
"value": "150.109.48.238"
},
{
"value": "156.234.58.194"
},
{
"value": "154.82.93.140"
},
{
"value": "45.204.200.26"
},
{
"value": "156.238.238.90"
},
{
"value": "95.41.61.167"
},
{
"value": "154.91.74.87"
}
],
"stats": {
"new_domains": 2,
"new_file_paths": 49,
"new_hashes": 30,
"new_ips": 7,
"total_new": 88
},
"update_time": "2026-07-20T21:01:26.227000+00:00",
"update_time_ms": 1784581286227
}