● 背景 ●
钓鱼文件样例整理
- 2024年*****局企业补贴政策通知.msi
- 资料全套.msi
- 2024财会人员补贴所需材料.msi
- 3月1日退税步骤详情.msi
- 2024年XXX局企业补贴政策通知.msi
- **集团一女员工被丈夫举报与领导通J聚众Y乱.rar
- **集团一女员工被丈夫举报与领导通J聚众Y乱(1).rar
- (密码123)原版视频.zip
- (密码123)原版视频(1).zip
- 原版视频MP4.exe
- 原版MP4.exe
- 原版视频.exe
- 2024mp4.exe
- (密码123)原版视频.exe
- 原版视频.zip
- **集团一女员工被丈夫举报与领导通J聚众Y乱.exe
- 高中女老师出轨16岁学生.exe
技术分析
- https://lldwt-oss.oss-cn-beijing.a**yuncs[.]com/b.dat
- https://lldwt-oss.oss-cn-beijing.a**yuncs[.]com/1.png
- https://lldwt-oss.oss-cn-beijing.a**yuncs[.]com/2.png
- https://lldwt-oss.oss-cn-beijing.a**yuncs[.]com/3.png
- https://lldwt-oss.oss-cn-beijing.a**yuncs[.]com/4.png
- C:\xx.exe
- C:\ProgramData\xxx.rar
- C:\ProgramData\xxxx\xxx.rar
- C:\ProgramData\xxxx\xxx.exe
- C:\Microsoft\iXXX3XXX.dat
- 4OY.exe(hash:AE105528A6C5758CCF18705A8C208A97)
- ClassicExplorer32.dll (hash:6D9B14409057F0606F9082B5A8BEF13C)(md5对抗)
- ffff.lop (hash:91D7406CF794F1A2566C4CFD8A1A92EA)(md5对抗)
- ffff.pol (hash:35162C68560C91D773E4783929F2C9AC)(md5对抗)
附录相关IOC
287e159f1e869a55f415cecce35a4675be624ba8ae701c23f8370c1445070d97 |
f65b1e283df0a8652a51699e09ffbb0fe5ca924e5fe90318901d0374ec4d73f7 |
5cfebd38c9ae4488feab76db086d8a6496fd47350c43fdd480475af76d164070 |
506a9d93ff78b1e530d496617a522a891cc4d9ef5d34d1a6932352eb1e14347e |
03b262c7c88bf22a3d59523e05d5fea2bd8c191bf45533afe9fef50e99699583 |
46996b966610fd123d88c05b300c5f2141d46fffe572c705de5ee9b09501483c |
90cc47603b0682f92d9a23d49bf850ac82c2b2d08e2f960ef48ead356a1dc504 |
bd3918c4c724e163f7cdc07b8027cdeb6e328494d2eed22027bc83ed1aa47b5a |
6867866a5d933ad5c77274c31c7066b464e168e93208c1233737a200ae1c9011 |
33c5122eadc5e26e6142c169dd553eafff1a0815b8111737b3cb303949b81bac |
9c0da28034144d081d0ca1f05549bd2ce267b53d33d1b3de7f17434fea418142 |
b61b36b087d3d15aa21f7d597c3563ebb33a2d00cf2f6c95698673be2205aee4 |
97a79c9e33047d0b9b228b688f086a17b6cbda8913c179f5069950873bec38ea |
5f15853e591cc1211e1ee5c911f26fe3eab85cddfb226e0f9d6204490d799d7c |
ae52cd7e5684630ea2cbf0298b5fabdb03ccc60f6e0783f682af6e39ef23a0c3 |
969db6300712fe813d96dda6c455a973c64a87d53b54376296ad6303dafdc61e |
dc5e0002f84966fe05e4bdf36911c56f7b1a0b296ff3f658a0dd26e3e716a14a |
d87861e5d3acb4c5a054e0141e9e037a9edacfa5a18be0db93fdeeead307588e |
be2d4297d4acbeae315008d4c1ac5de734d77f36f46b2d926dfd52b281a082ff |
9cc9a55b7973ffeadc5c0a37ce8bef425c40a8cd452d8dc62fea4d0ed2f56065 |
5ddfb1307d75d9d50673f2edd3dc2586911ec41861f307a50a9936cf1ec20e26 |
d28ab6fe7bb0212953bf8a59e98391e3672efb2fcf102173e6e650ca558a269e |
3aae6adb3d524bda8766b16039c97cdad58062077abfe63a2fb14f1c38e40066 |
71187d42357788eef197652e3cd8bce6589beee5184d9ab86e122680232dfd76 |
8e30d05a5937d43c2354b100b9add70f99ebfd0f3d14efb9a934c2ef57cf4cdc |
0ffbf71dc661d287c2a58cb1f96170df32308a18d7840a8a4e0afe46720b4f79 |
bf119261019ca2e7ae39a3ca1f6e00de34b840cd9375dad3b77b2681b7225799 |
76b1d50b3ce96d1c049e975abe0d57422223ea345895adcfcd9aa0164e7bae04 |
https://lldwt-oss.oss-cn-beijing.aliyuncs[.]com/b.dat |
https://lldwt-oss.oss-cn-beijing.aliyuncs[.]com/1.png |
https://lldwt-oss.oss-cn-beijing.aliyuncs[.]com/2.png |
https://lldwt-oss.oss-cn-beijing.aliyuncs[.]com/3.png |
https://lldwt-oss.oss-cn-beijing.aliyuncs[.]com/4.png |
https://ced2-oss.oss-cn-shanghai.aliyuncs[.]com/default.dat |
https://ced2-oss.oss-cn-shanghai.aliyuncs[.]com/DMR_10.jpg |
https://ced2-oss.oss-cn-shanghai.aliyuncs[.]com/DMR_15.jpg |
https://ced2-oss.oss-cn-shanghai.aliyuncs[.]com/DMR_20.jpg |
https://ced2-oss.oss-cn-shanghai.aliyuncs[.]com/DMR_25.jpg |
https://oss-ww.oss-cn-hangzhou.aliyuncs[.]com/xsu-icon1.png |
https://oss-ww.oss-cn-hangzhou.aliyuncs[.]com/xsu-icon2.png |
https://oss-ww.oss-cn-hangzhou.aliyuncs[.]com/xsu-icon3.png |
https://oss-ww.oss-cn-hangzhou.aliyuncs[.]com/webkit.531.36.png |
squxdw.net |
vlstjq.net |
uywtex.net |
squxdw.net |
squckw.net |
uywtex.net |
23.234.37[.]182 |
122.10.18[.]42 |
206.238.114[.]116 |
45.195.57[.]10 |
23.234.37[.]182 |
122.10.26[.]236 |
产品体验