以下情报均来源于网络，请各位读者注意分辨真实性
网络钓鱼样本
【重保实时情报】微步情报局已捕获下列样本，请防守方重点关注：
钓鱼样本主题："江门网络安全排查.exe.zip"
SHA256:7734b9ee49d1bab65193581dfdfbd90516ffd9c308b45f7dbca1f46c433d975eMD5:071e9830865859889b9d4ab006cd15feSHA1:e7bcb7ede553eb22c57a4ad1c5d7d7714d743573
钓鱼样本主题："中金金融认证中心证书软件.zip"
SHA256:ae797726db03f2fe7cc498275147f331ceab905936b26abb5d1bfeaf90a02624MD5:acdb6ebb5ff0526961e43a70416b2d21SHA1:457b572ed151bfdc6bead0f905723172a8b16812
钓鱼样本主题："单位职称人员情况统计表.exe"
MD5：6bc64ce49a6b27a91466353af78f977eSHA256：7cee9a39a2f28db35f55257b24c3aebbff8597bfd7fa72057d54d4316a5464b9发布C2：service-1kp2cmqp-1318310514.sh.apigw.tencentcs.com分析结论：CobaltStrike木马
钓鱼样本：“**衡出轨事实.zip”
MD5：7deb36e4120a83b237f1d4424da21775SHA256：e522fa4bbd3368bcfa27068a39e91e4d54128f784a47d9536a9cfdb6d4771e82发布C2：123.207.50.117:80
分析结论：木马下载器
钓鱼样本：“安全插件.exe”![【威胁情报】Hvv期间恶意IP及钓鱼样本]( "【威胁情报】Hvv期间恶意IP及钓鱼样本")
MD5：7bffcee90e76ff7bc24da2ea33ca526dSHA256：99fbce03fe5d20be405d6d42a289df53939fa9331e44794044de1af414486350发布C2：service-2fhc3nsz-1319935181.bj.apigw.tencentcs.com样本特点：自定义算法和Base64解密计算shellcode分析结论：CobaltStrike木马
Hvv期间恶意ip列表
| 微步标记IP | 深信服威胁情报检测IP | 某监测平台 |
| 171.125.40.113 | 8.134.89.107 | 82.157.173.159 |
| 218.69.226.20 | 59.110.141.210 | 82.157.17.183 |
| 124.223.88.16 | 47.97.17.164 | 82.157.147.131 |
| 183.27.124.95 | 47.117.171.230 | 82.156.55.208 |
| 39.104.22.163 | 43.163.240.112 | 82.156.28.224 |
| 182.114.24.127 | 39.107.252.143 | 82.156.188.211 |
| 101.200.127.65 | 39.105.185.43 | 82.156.157.156 |
| 182.92.67.215 | 222.67.105.24 | 81.70.3.30 |
| 39.73.113.200 | 183.225.19.82 | 81.70.253.205 |
| 119.62.162.11 | 183.222.202.212 | 81.70.135.239 |
| 124.222.226.13 | 183.21.111.165 | 81.69.96.149 |
| 112.248.244.57 | 179.43.190.98 | 81.69.242.80 |
| 101.43.131.124 | 121.43.109.71 | 81.69.18.115 |
| 223.74.158.84 | 120.239.22.105 | 81.68.249.97 |
| 61.171.119.106 | 120.207.145.91 | 81.68.248.129 |
| 122.140.203.113 | 119.39.61.1 | 81.68.186.243 |
| 8.130.114.73 | 116.16.138.237 | 81.68.116.198 |
| 115.60.49.192 | 111.49.124.181 | 8.218.203.72 |
| 42.225.48.25 | 104.168.135.212 | 8.218.129.91 |
| 222.141.113.126 | 101.200.217.131 | 8.212.49.116 |
| 1.13.9.165 | 1.204.116.58 | 8.210.2.157 |
| 123.235.145.137 | 221.237.36.52 | 8.140.50.236 |
| 123.118.11.71 | 113.26.236.198 | 8.140.37.238 |
| 103.252.118.75 | 113.26.215.109 | 8.140.12.158 |
| 39.100.68.7 | 49.247.25.198 | 8.136.201.3 |
| 61.181.206.56 | 42.81.134.193 | 8.135.97.155 |
| 180.97.189.156 | 162.243.146.49 | 8.135.112.178 |
| 39.100.33.106 | 42.176.26.215 | 8.134.96.195 |
| 39.100.67.4 | 45.156.128.2 | 8.134.69.202 |
| 162.14.108.149 | 45.156.128.7 | 8.134.209.29 |
| 124.225.80.200 | 82.207.8.202 | 8.134.122.165 |
| 124.131.32.11 | 175.203.61.33 | 8.131.118.10 |
| 115.57.30.175 | 27.124.11.235 | 8.130.84.57 |
| 42.3.201.56 | 91.92.187.186 | 8.130.25.9 |
| 223.16.170.241 | 110.180.157.123 | 8.130.18.110 |
| 39.104.203.86 | 117.161.75.116 | 8.130.106.206 |
| 47.92.249.211 | 117.161.75.117 | 8.129.237.254 |
| 114.132.55.109 | 179.83.205.125 | 62.234.13.73 |
| 222.137.112.11 | 146.185.159.124 | 61.147.209.31 |
| 18.162.213.61 | 1.69.60.248 | 61.134.170.202 |
| 122.230.40.42 | 124.45.61.93 | 60.220.185.61 |
| 156.255.214.146 | 132.255.190.103 | 60.220.185.22 |
| 118.195.135.88 | 87.236.176.108 | 60.205.190.232 |
| 36.139.90.88 | 117.211.75.97 | 60.190.226.179 |
| 36.27.112.227 | 124.234.203.63 | 60.174.192.240 |
| 39.144.230.42 | 117.63.115.118 | 60.167.71.8 |
| 47.92.193.104 | 182.61.38.57 | 59.110.46.22 |
| 218.83.6.211 | 43.138.63.240 | 59.110.235.230 |
| 115.227.53.220 | 110.187.136.1 | 59.110.233.102 |
| 39.105.189.100 | 192.241.206.34 | 59.110.172.50 |
| 114.253.103.147 | 81.70.93.188 | 58.87.99.181 |
| 47.92.204.74 | 189.182.242.184 | 58.222.106.106 |
| 39.100.68.20 | 182.92.214.120 | 49.89.220.208 |
| 220.201.59.247 | 139.196.94.55 | 49.234.41.63 |
| 49.234.66.241 | 43.138.5.218 | 49.234.22.80 |
| 175.21.92.229 | 116.55.180.208 | 49.233.62.180 |
| 122.142.195.43 | 86.57.183.121 | 49.232.90.103 |
| 119.162.122.131 | 170.106.141.190 | 49.232.88.187 |
| 183.157.44.76 | 87.236.176.104 | 49.232.67.116 |
| 49.232.193.91 | 43.134.172.119 | 47.99.57.95 |
| 113.252.145.146 | 41.207.250.246 | 47.99.151.68 |
| 180.125.235.203 | 183.136.190.48 | 47.99.147.223 |
| 43.137.9.153 | 45.43.33.218 | 47.99.105.250 |
| 61.52.4.110 | 134.65.22.223 | 47.98.249.254 |
| 182.114.252.239 | 201.20.56.106 | 47.98.170.47 |
| 125.44.218.0 | 191.101.174.64 | 47.98.141.252 |
| 111.201.175.230 | 170.246.12.41 | 47.98.113.242 |
| 182.92.69.156 | 114.239.78.17 | 47.97.40.145 |
| 180.97.189.166 | 60.22.254.160 | 47.97.222.10 |
| 106.57.165.109 | 167.99.209.184 | 47.97.217.140 |
| 119.139.137.132 | 67.21.53.157 | 47.94.244.125 |
| 221.1.226.158 | 192.241.223.29 | 47.94.215.220 |
| 182.121.53.223 | 1.70.127.72 | 47.94.200.41 |
| 106.110.134.126 | 117.187.173.96 | 47.94.107.27 |
| 42.176.169.245 | 117.187.173.97 | 47.93.99.200 |
| 39.104.205.76 | 45.156.129.12 | 47.93.63.179 |
| 42.3.201.202 | 117.187.173.91 | 47.93.51.191 |
| 39.100.69.32 | 175.27.188.133 | 47.93.244.45 |
| 119.45.197.199 | 121.128.142.27 | 47.93.102.149 |
| 183.131.84.113 | 120.233.126.7 | 47.92.92.110 |
| 27.215.214.196 | 92.63.196.78 | 47.92.229.165 |
| 222.163.77.17 | 42.177.122.28 | 47.244.167.171 |
| 39.98.71.2 | 121.4.130.229 | 47.242.78.26 |
| 106.55.107.106 | 91.213.99.15 | 47.242.41.223 |
| 180.123.198.188 | 222.135.118.123 | 47.242.241.35 |
| 119.45.116.236 | 92.63.196.76 | 47.242.203.102 |
| 115.55.5.252 | 186.4.131.245 | 47.120.2.120 |
| 49.81.101.133 | 46.101.127.204 | 47.120.10.96 |
| 106.58.246.138 | 43.154.211.73 | 47.116.73.197 |
| 36.63.124.161 | 103.153.136.74 | 47.115.50.66 |
| 39.98.253.124 | 124.220.186.134 | 47.115.219.93 |
| 47.92.222.215 | 93.51.73.137 | 47.115.218.187 |
| 42.236.134.110 | 101.43.146.142 | 47.115.215.26 |
| 43.154.112.206 | 220.150.104.8 | 47.115.214.195 |
| 59.102.208.165 | 203.113.38.226 | 47.113.224.225 |
| 125.43.255.15 | 14.18.87.25 | 47.113.204.28 |
| 39.104.200.229 | 43.156.34.205 | 47.113.204.127 |
| 182.121.198.156 | 152.32.252.80 | 47.112.227.200 |
| 101.200.121.243 | 91.189.183.213 | 47.109.79.81 |
| 111.201.175.156 | 118.121.205.107 | 47.109.70.144 |
| 182.92.171.153 | 220.192.237.201 | 47.108.183.77 |
| 122.236.181.232 | 1.228.220.146 | 47.108.183.70 |
| 61.171.102.52 | 114.239.152.254 | 47.108.106.199 |
| 118.169.5.145 | 119.91.64.175 | 47.107.87.41 |
| 27.204.242.65 | 110.183.58.198 | 47.107.33.26 |
| 120.235.113.26 | 8.129.91.13 | 47.106.201.134 |
| 123.57.69.175 | 142.93.14.104 | 47.106.161.16 |
| 111.74.70.246 | 190.112.51.194 | 47.106.123.86 |
| 118.195.252.229 | 47.101.154.177 | 47.106.117.218 |
| 112.248.113.169 | 47.100.216.16 | 47.104.73.41 |
| 58.153.134.157 | 185.216.140.186 | 47.104.239.124 |
| 111.67.58.35 | 40.77.167.207 | 47.103.106.214 |
| 82.156.151.104 | 121.227.82.242 | 47.102.209.7 |
| 61.52.1.187 | 49.89.163.21 | 47.102.156.247 |
| 118.195.163.139 | 124.235.240.75 | 47.101.204.23 |
| 47.99.153.172 | 43.156.47.53 | 47.101.201.38 |
| 39.107.123.197 | 121.254.147.246 | 47.100.69.250 |
| 180.97.189.153 | 123.185.149.26 | 47.100.170.9 |
| 47.92.199.215 | 180.71.47.198 | 42.194.229.159 |
| 42.240.129.52 | 64.62.197.107 | 42.193.98.44 |
| 39.100.65.171 | 35.226.126.79 | 42.193.37.101 |
| 39.100.67.168 | 76.221.143.220 | 42.193.252.92 |
| 223.16.215.117 | 64.62.197.102 | 42.193.178.194 |
| 122.230.40.5 | 64.62.197.103 | 42.193.17.124 |
| 216.250.105.71 | 165.227.47.218 | 42.193.101.234 |
| 14.107.156.175 | 64.62.197.101 | 42.178.192.234 |
| 47.94.149.115 | 220.124.195.191 | 42.123.110.8 |
| 124.77.13.122 | 119.115.146.184 | 39.99.242.16 |
| 61.235.208.48 | 120.24.12.88 | 39.98.157.4 |
| 47.99.142.98 | 87.236.176.216 | 39.96.117.96 |
| 122.245.14.221 | 189.112.0.11 | 39.108.224.10 |
| 39.100.69.43 | 64.227.128.104 | 39.108.166.28 |
| 39.104.205.209 | 106.75.179.193 | 39.107.97.138 |
| 115.59.8.40 | 49.65.210.110 | 39.107.72.3 |
| 1.64.181.32 | 223.13.62.15 | 39.107.32.219 |
| 111.192.103.164 | 74.82.47.3 | 39.107.250.164 |
| 114.132.168.36 | 51.161.11.85 | 39.107.242.130 |
| 58.153.199.1 | 112.113.130.246 | 39.107.233.188 |
| 101.132.223.4 | 185.165.190.34 | 39.107.107.24 |
原文始发于微信公众号（Poker安全）：【威胁情报】Hvv期间恶意IP及钓鱼样本
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论