2026-02-02 00:00:26 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文档汇总2026年1月威胁情报，监测到银狐木马及钓鱼仿冒活动最为活跃，占比超40%。CloudAtlas、Lazarus等APT组织利用DLL侧加载、IDE配置缺陷等手法实施定向攻击。报告提供了详细的IOC清单，建议安全团队将相关哈希与网络地址接入防御系统，重点监控供应链投毒及社工攻击。 综合评分： 88 文章分类： 威胁情报,恶意软件,应急响应

cover_image

26年1月威胁情报IOC汇总

原创

小东小东

小东安全日记

2026年2月1日 19:13 浙江

📋 总结

本月监测和收集到银狐木马、钓鱼仿冒持续活跃，Cloud Atlas、Lazarus、Patchwork、伪猎者、摩诃草、毒云藤、海莲花(Ocean Lotus)、肚脑虫(Donot)、蔓灵花(Bitter)、透明部落、魔罗桫等多个APT组织发动定向攻击，攻击手法涉及IDE配置缺陷利用、DLL侧加载、压缩包篡改等。

📊 威胁统计

| 类型 | 数量 | 占比 | | — | — | — | | 银狐 | 149 | 30.6% | | APT | 89 | 18.3% | | 木马 | 73 | 15.0% | | 黑猫 | 57 | 11.7% | | 钓鱼仿冒 | 56 | 11.5% | | 黑产团伙 | 20 | 4.1% | | APT37 | 14 | 2.9% | | PUA | 13 | 2.7% | | Gh0stRAT木马 | 4 | 0.8% | | 代理工具 | 3 | 0.6% | | Xagent木马 | 3 | 0.6% | | 恶意软件 | 3 | 0.6% | | 远控木马 | 1 | 0.2% | | 蠕虫 | 1 | 0.2% | | 蠕虫病毒 | 1 | 0.2% |

📋 完整IOC列表

银狐 (149条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | Hash | 3092916c4b114dfde2ee7face03bec67aea1fdceb88a1a73bfdd8d6b271b24e5 | 2026/01/30 | – | | 域名 | yuxuanow.com | 2026/01/30 | – | | IP | 202.95.16.13 | 2026/01/30 | – | | Hash | 615a895ea5107936825c9de161a20dc19727c007a3e7c539a289d450329c5182 | 2026/01/30 | – | | 域名 | cinskw.net | 2026/01/29 | – | | 域名 | cstoon.com | 2026/01/29 | – | | 域名 | xiuyiu.net | 2026/01/29 | – | | Hash | baa021c47e5373975e0df18fb337c81e5733cbf4cc84a3f97d968e3cc6740928 | 2026/01/22 | – | | Hash | 1da9bd30887b269531d43c5b46d67c432594ff5c2a25ade270ac812370817ce9 | 2026/01/22 | – | | Hash | 7cbd575c86798af0f0a14a93d2d82bb37339bf6211ea348a3d0ced85fb77ea37 | 2026/01/22 | – | | Hash | ad8b4ad77ff3997691ee9b7596f0767e16e7a57df06a3364206451366e5bf9a1 | 2026/01/22 | – | | Hash | 1c60209905110559d0371a9ec6bb9aad084914f054e341a98c06559ccd724f2f | 2026/01/22 | – | | Hash | 4126d14595d68a8c9f3daa93d3b2f608ef6dc104aafa544941aca6d249b57371 | 2026/01/22 | – | | Hash | c1097eb29475fc24ca1663b09475ed139752945db3c595648cddcac35042490b | 2026/01/22 | – | | IP | 143.92.57.157 | 2026/01/22 | – | | 域名 | xiaoshihou8.top | 2026/01/22 | – | | IP | 202.79.171.236 | 2026/01/22 | – | | 域名 | jd16881988.com | 2026/01/22 | – | | IP | 137.220.135.15 | 2026/01/22 | – | | 域名 | jd1688819888.com | 2026/01/21 | – | | 域名 | xvnfgq.cn | 2026/01/19 | 银狐 | | IP | 206.238.115.137 | 2026/01/19 | 银狐 | | Hash | beddec0656305b63355b6276de6ffc0cadddb312565fb239affbd779e4aefbb3 | 2026/01/19 | 银狐 | | Hash | 24c8a2967c2bd015c0799c88ef74548e197d7f33cbe5ae5a487a3da735caac77 | 2026/01/19 | 银狐 | | 域名 | ding7tian1.com | 2026/01/19 | – | | Hash | 8505aedf4764edda30334488333a609002d2d8b613adda1b215b275515fd003f | 2026/01/19 | 银狐 | | IP | 185.203.39.50 | 2026/01/19 | 银狐 | | Hash | a28ff52d8ea0ae502927739fd45c3dd9de1cf881530a18e0f59fe15fa4c683f4 | 2026/01/15 | 银狐 | | Hash | 968a6bf19ea07c31dd115f1760813cff09d0d864d2a6c8ddbcce6ed50fc7a297 | 2026/01/15 | 银狐 | | 域名 | qaqbba.com | 2026/01/15 | 银狐 | | 域名 | shunfeng168.vip | 2026/01/15 | 银狐 | | IP | 47.242.90.146 | 2026/01/15 | 银狐 | | Hash | 0948dd8a647cb1819a39db0d60990c331b477b5493cf1ea87ac3b35f11e98b6c | 2026/01/15 | 银狐 | | Hash | 495fc5cfd86ab34025d2987b8c0e82dce074aef6a3717a12d3dd023a21dfecd8 | 2026/01/15 | 银狐 | | Hash | a66d1ca87b08053218c209fd91c0b82b3e0489663dca4c9086c533e3798e2285 | 2026/01/15 | 银狐 | | 域名 | wuudkisb.top | 2026/01/14 | 银狐 | | IP | 43.248.173.112 | 2026/01/14 | 银狐 | | 域名 | mlcrosoft.asia | 2026/01/14 | 银狐 | | IP | 206.119.174.81 | 2026/01/14 | 银狐 | | IP | 206.119.174.15 | 2026/01/14 | 银狐 | | Hash | 7b09286ca1e11a186cfc71a5ad3e3342954606f9ec0445fd4bbcce9bc58d4cb8 | 2026/01/14 | 银狐 | | Hash | 854b8e239320a2744e7d128e27c03ef0f1f61cb8d585f0f1a13e5cf4e4d4b3d6 | 2026/01/14 | 银狐 | | Hash | 31062e946168736cc932beb036670e0d5b54b63cbbc6e61ef7a26a343e13f0f1 | 2026/01/14 | 银狐 | | Hash | c46dd7575eda91903be241f6db8967683b8b3d270b743ad905ee43194b7de6cc | 2026/01/14 | 银狐 | | Hash | 77ea62ff74a66f61a511eb6b6edac20be9822fa9cc1e7354a8cd6379c7b9d2d2 | 2026/01/12 | Dll劫持 | | Hash | fa388a6cdd28ad5dd83acd674483828251f21cbefaa801e839ba39af24a6ac19 | 2026/01/12 | Dll劫持 | | Hash | f74017b406e993bea5212615febe23198b09ecd73ab79411a9f6571ba1f94cfa | 2026/01/12 | Dll劫持 | | Hash | 068e49e734c2c7be4fb3f01a40bb8beb2d5f4677872fabbced7741245a7ea97c | 2026/01/12 | Dll劫持 | | 域名 | ggwk.cc | 2026/01/12 | Dll劫持 | | 域名 | b.yuxuanow.top | 2026/01/12 | Dll劫持 | | IP | 45.207.231.94 | 2026/01/12 | Dll劫持 | | IP | 103.20.195.147 | 2026/01/12 | Dll劫持 | | IP | 45.207.231.107 | 2026/01/12 | Dll劫持 | | IP | 8.217.9.165 | 2026/01/12 | Dll劫持 | | IP | 160.124.9.103 | 2026/01/12 | Dll劫持 | | IP | 47.239.225.43 | 2026/01/12 | Dll劫持 | | IP | 43.100.22.158 | 2026/01/12 | Dll劫持 | | IP | 43.100.123.207 | 2026/01/12 | Dll劫持 | | IP | 43.100.63.145 | 2026/01/12 | Dll劫持 | | 域名 | itdd.club | 2026/01/12 | Dll劫持 | | 域名 | xzghjec.com | 2026/01/12 | Dll劫持 | | 域名 | gov-a.work | 2026/01/12 | Dll劫持 | | 域名 | gov-a.fit | 2026/01/12 | Dll劫持 | | 域名 | gvo-b.club | 2026/01/12 | Dll劫持 | | 域名 | gov-c.club | 2026/01/12 | Dll劫持 | | 域名 | gov-a.club | 2026/01/12 | Dll劫持 | | 域名 | govk.club | 2026/01/12 | Dll劫持 | | 域名 | dingtalki.cn | 2026/01/12 | Dll劫持 | | 域名 | hhiioo.cn | 2026/01/12 | Dll劫持 | | 域名 | kkyui.club | 2026/01/12 | Dll劫持 | | 域名 | hhimm.work | 2026/01/12 | Dll劫持 | | 域名 | swjc2025bjkb.cn | 2026/01/12 | Dll劫持 | | 域名 | 2025swmm.cn | 2026/01/12 | Dll劫持 | | 域名 | hhiioo.work | 2026/01/12 | Dll劫持 | | 域名 | pub-22111837e3d94d28a52361ee32c5e5fa.r2.dev | 2026/01/10 | 仿冒 | | Hash | cea665f6886f35507850aa129ecee633882604d5f6e5d3c5657d580d26796726 | 2026/01/10 | 仿冒 | | Hash | 4ced2f202c1e73fc34dc61f9e0f2f37e1741ed4f66a253757ad7368820bccb69 | 2026/01/10 | 仿冒 | | Hash | 720b4bda3a3e548e03a35d019fe03cc57620751371fbeb09c9213bcc737f44c2 | 2026/01/10 | 仿冒 | | Hash | 50080f6cb1f13915fd8acbb2c4d8b55bdc019cd16a2449e5c0cb701e160a0c4a | 2026/01/10 | 仿冒 | | Hash | d99af783a4baf6e0009c98daa02c8553491b84a101d6494027ecc0495c388e0f | 2026/01/10 | 仿冒 | | 域名 | shdd0758.com | 2026/01/10 | 仿冒 | | IP | 95.40.120.43 | 2026/01/10 | 仿冒 | | IP | 202.95.11.85 | 2026/01/08 | 仿冒 | | Hash | 0f373f7becde3e9000a547b97f2736e4d45f8421d825939b701f8395341fa062 | 2026/01/08 | 仿冒 | | Hash | 7199a3e0675770652950f93e195097a56536b05145f10291043780f12ab66515 | 2026/01/08 | 仿冒 | | Hash | b73a3ab21ec8a4e0faf9b9c8b48c2ddc2821652a594a3ee38d84306f28537f4d | 2026/01/08 | 仿冒 | | Hash | 44202da4e34864a762e4c1488934029f56de2b7cfcc542d29cd3035197803497 | 2026/01/08 | 仿冒 | | Hash | 01657ffb57395af1ab36e394eecaa593ef93da0e16cf58c4a5c725cf49c21898 | 2026/01/08 | 仿冒 | | Hash | A508358A0786DDF2AD9496BB9374D54E71C5044DF9C10FE686D43FC70484E54C | 2025/12/31 | – | | Hash | d8985e9de781d879e51f15a155e389a9f798b4cfc1e4cedc4edf6e07c89e326c | 2025/12/31 | – | | Hash | 124E8F7CA958FD8CB2A3BAF91681513F93F73D9CFA4EFEA6F4A1F165D8CBC8D9 | 2025/12/31 | – | | Hash | 32c49ba3ca279a42cec4724267ac58fd165eec7e2786df3cda3c3c73816510d0 | 2025/12/31 | – | | Hash | 08b6b6648c87213de7de4454b5d9093360c1c4bfb5632daa2fc7f1b83a02be9f | 2025/12/31 | – | | Hash | 7852e800743de092a28a2c49c3e10f26e94224090f4a13855c03bc5a429d4f7b | 2025/12/31 | – | | IP | 154.12.87.24 | 2025/12/31 | – | | 域名 | shunfeng168.vip | 2025/12/27 | 银狐 | | IP | 137.220.156.162 | 2025/12/27 | 银狐 | | IP | 137.220.155.13 | 2025/12/27 | 银狐 | | IP | 47.238.158.120 | 2025/12/27 | 银狐 | | Hash | 17f8ba9129e1c150bdcfe9b06d85e6c7fa63aaf4e00ea6ea89ef72d3653a3f56 | 2025/12/27 | 银狐 | | Hash | 5697373f74a12a48ff2077c1ade877aee5818b5110556f4a0b8bce1fe9505111 | 2025/12/27 | 银狐 | | Hash | 2c11ff0fcb3941a919abe101644726b5b4cc4819a019b09e78a971f38633ea8d | 2025/12/27 | 银狐 | | 域名 | ime.hk | 2025/12/25 | 银狐 | | IP | 161.248.14.228 | 2025/12/25 | 银狐 | | IP | 108.187.7.200 | 2025/12/24 | 仿冒 | | 域名 | ffsmoc.com | 2025/12/23 | 仿冒 | | 域名 | mlcrosoft.asia | 2025/12/23 | 仿冒 | | IP | 38.181.2.47 | 2025/12/23 | 仿冒 | | IP | 143.92.43.130 | 2025/12/23 | 仿冒 | | IP | 38.181.2.47 | 2025/12/23 | 仿冒 | | Hash | de6744d04de996e4c053ab86e8015c86b4df15cb575dd412a58014590f2bbcf6 | 2025/12/23 | 仿冒 | | Hash | 51ae8d9734b383db6279307acb52b7cc26a7b5090b92650729a6ff73dc0bd817 | 2025/12/23 | 仿冒 | | Hash | 4737addcf7dc9b6c72bc23a2b9ecbf2236601c17c597ecd0517cb57d56f3f00d | 2025/12/23 | 仿冒 | | 域名 | wps2.com | 2025/12/22 | 仿冒 | | 域名 | xxs.xsxssiss.icu | 2025/12/22 | 银狐 | | 域名 | asj658g.cyou | 2025/12/19 | – | | Hash | 69e7e2f452f882b878ae3115a3b90e873d35c7a432a42a14e7cae75748560c92 | 2025/12/16 | – | | Hash | 65521ba6bd6a67a03f57bdb59671cb66ac0cf5ecb896fddb2c31e8af33eb11d9 | 2025/12/16 | – | | 域名 | gongjisbsbsb.icu | 2025/12/16 | – | | IP | 27.124.20.159 | 2025/12/16 | – | | Hash | skmskka.com | 2025/12/12 | – | | IP | 31.57.10.243 | 2025/12/12 | – | | IP | 149.88.81.151 | 2025/12/12 | – | | Hash | d343afcc667e00800836d48327701106b1266e122ae0e41e799d49fb8ba655cf | 2025/12/12 | – | | Hash | da2c58308e860e57df4c46465fd1cfc68d41e8699b4871e9a9be3c434283d50b | 2025/12/12 | – | | Hash | 5302eed822932341d9f9b6378924c39d37095db45205c4659e9d887dcb272126 | 2025/12/12 | – | | Hash | 74db9032c2a517ca187cf1b50f0f9e3fb43f0065854c7546c78624c88b276a78 | 2025/12/12 | – | | 域名 | eiuriu.net | 2025/12/11 | – | | 域名 | https://snipaste-x.com/Snipaste-2.10.8-x64.zip | 2025/12/10 | – | | 域名 | fyklna.ime.hk | 2025/12/10 | – | | Hash | 855ef4fa86768572913dd413939f4ca0d839368a49ab7556e31efb22f824a3cd | 2025/12/10 | – | | Hash | 9683c036f27ad260abdb261cde35bfff2d6c067f8d2c3d2e4892b8d4cc6ebf4a | 2025/12/10 | – | | Hash | b15e63310e724d32899eac7239f4ef349e72f3739b13fc215b38503d07c2c7c1 | 2025/12/10 | – | | Hash | 48bf3019407cc98ee7dd94be65ef72879cd9e1b69b9906498d7308ffc4cff590 | 2025/12/10 | – | | URL | https://nexteerautomotive-my.sharepoint.com/personal/yangyang_meng_nexteer_com/_layouts/15/download.aspx?UniqueId=d753cc65%2D2a4d%2D469f%2D8ed0%2D0d08cfe7a404 | 2025/12/10 | – | | IP | 47.83.157.247 | 2025/12/10 | – | | URL | https://ossalizx.oss-cn-hongkong.aliyuncs.com/Chome-stallerwin.zip | 2025/12/07 | – | | 域名 | ce-google.com.cn | 2025/12/07 | – | | 域名 | o8u.xyz | 2025/12/07 | – | | Hash | 1e77e88ac05d9cf0c549dca2dae10f165e628cac05b52f2991fb6d1ac92d5b2a | 2025/12/07 | – | | Hash | 091b86a8b1b2f14277c05da5115ce6ac615420fbb82a83007a7b4a4d58886c08 | 2025/12/07 | – | | 域名 | qqaacab.top | 2025/12/04 | – | | IP | 143.92.58.138 | 2025/12/04 | – | | 域名 | https://app.vmdown.top/q6g4q3v/oss-ap-southeast-1/0/sog-pinyin.rar?url=red.up3me.cc | 2025/12/04 | – | | Hash | 745b1b861f0841b0f655981efa8752f983b3522d941c04ee660bc1827cb67af4 | 2025/12/04 | – | | Hash | 5fab59d3aa7b593683d55a1da38b5092b21554c3e1db5cb644cf325949699349 | 2025/12/04 | – | | Hash | 9e7d1cd6eb4317adb99bf9b69f461b09e294d7593b55c9e08d35eacdf7c9227e | 2025/12/04 | – | | 域名 | yyyndym.icu | 2025/12/01 | – | | IP | 118.107.43.202 | 2025/12/01 | – |

钓鱼仿冒 (56条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | clash-github.com | 2026/01/30 | – | | 域名 | chromee-google.com.cn | 2026/01/30 | – | | 域名 | clash-verge-rev.org | 2026/01/30 | – | | 域名 | wps-wpswps.com.cn | 2026/01/30 | – | | 域名 | gmaillpc.com | 2026/01/30 | – | | 域名 | potatohat.com | 2026/01/30 | – | | 域名 | i4.com.vn | 2026/01/28 | – | | 域名 | i-wps.com.cn | 2026/01/23 | – | | 域名 | shurufa-sogou.com | 2026/01/23 | – | | 域名 | app-snipaste.com.cn | 2026/01/23 | – | | 域名 | huorongpc.com | 2026/01/23 | – | | 域名 | todesk.im | 2026/01/23 | – | | 域名 | get-google.com.cn | 2026/01/19 | 仿冒 | | 域名 | noteipad.com | 2026/01/16 | – | | 域名 | gugeggua.top | 2026/01/15 | 银狐 | | 域名 | a-google.com.cn | 2026/01/15 | 银狐 | | 域名 | boolchrome.top | 2026/01/14 | 银狐 | | 域名 | oraycc.com | 2026/01/10 | 仿冒 | | 域名 | xiazaiabcd2.cyou | 2026/01/10 | 仿冒 | | IP | 103.142.103.78 | 2026/01/09 | – | | 域名 | pc-sougous.com | 2026/01/09 | – | | 域名 | input-sogo.com.cn | 2026/01/09 | – | | 域名 | sogoushurufa-sogou.com.cn | 2026/01/09 | – | | 域名 | shurufa-sougou.org | 2026/01/09 | – | | 域名 | iszs.org | 2026/01/09 | – | | 域名 | www.google-chroma.com.cn | 2026/01/09 | – | | 域名 | www.w3-google.com.cn | 2026/01/09 | – | | 域名 | www.pczh-google.com.cn | 2026/01/09 | – | | 域名 | clashverg.com | 2026/01/09 | – | | 域名 | www.clashverg.com | 2026/01/09 | – | | 域名 | snipasteapp.com | 2026/01/09 | – | | 域名 | www.aisizhushou.com | 2026/01/09 | – | | 域名 | finalshell-ssh.com | 2026/01/09 | – | | 域名 | fanyi-youdao.com.cn | 2026/01/09 | – | | 域名 | www.orayc.com | 2026/01/09 | – | | 域名 | qishui-music.com | 2026/01/09 | – | | 域名 | sogoushurufa.org | 2026/01/09 | – | | 域名 | www.to-desk.com.cn | 2026/01/09 | – | | 域名 | potplayer.pro | 2026/01/09 | – | | 域名 | www.wps.cyou | 2026/01/09 | – | | 域名 | pmtky.cn | 2026/01/09 | – | | 域名 | officelilne.oss-cn-hongkong.aliyuncs.com | 2026/01/08 | 仿冒 | | 域名 | orayy.com | 2026/01/08 | 仿冒 | | 域名 | pinyin-sogou.com.cn | 2026/01/07 | – | | 域名 | www.win-sogou.com | 2026/01/07 | 仿冒 | | 域名 | sougoupinyin-cn.com | 2026/01/07 | – | | 域名 | sougoupinyin-cn.com | 2026/01/07 | – | | 域名 | deepseek-zh.com | 2026/01/05 | – | | 域名 | ceemz.cn | 2026/01/04 | – | | IP | 149.30.255.55 | 2026/01/04 | – | | 域名 | wfee.fealwoab.top | 2025/12/24 | 仿冒 | | 域名 | org038.oss-cn-hongkong.aliyuncs.com | 2025/12/24 | 仿冒 | | 域名 | zh4-chrome.com.cn | 2025/12/22 | 仿冒 | | 域名 | pinyin-sogou.com.cn | 2025/12/18 | 仿冒 | | 域名 | win-sogou.com | 2025/12/18 | 仿冒 | | 域名 | sougoupinyin-cn.com | 2025/12/18 | 仿冒 |

APT (89条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | semidetab.org | 2026/01/29 | Patchwork | | 域名 | marketru.net | 2026/01/27 | Cloud Atlas | | 域名 | flashsupport.org | 2026/01/27 | Cloud Atlas | | 域名 | cityru-travel.org | 2026/01/27 | Cloud Atlas | | 域名 | statusupport.org | 2026/01/27 | Cloud Atlas | | 域名 | updatechecker.org | 2026/01/27 | Cloud Atlas | | 域名 | rostvgroup.com | 2026/01/27 | Cloud Atlas | | 域名 | russiatimes.info | 2026/01/27 | Cloud Atlas | | 域名 | billet-ru.net | 2026/01/27 | Cloud Atlas | | 域名 | gimnazija.org | 2026/01/27 | Cloud Atlas | | 域名 | transferpolicy.org | 2026/01/27 | Cloud Atlas | | 域名 | mskreg.net | 2026/01/27 | Cloud Atlas | | 域名 | multipackage.net | 2026/01/27 | Cloud Atlas | | 域名 | securemodem.com | 2026/01/27 | Cloud Atlas | | 域名 | rzhd.org | 2026/01/27 | Cloud Atlas | | 域名 | telehraf.com | 2026/01/27 | Cloud Atlas | | 域名 | solid-logit.com | 2026/01/27 | Cloud Atlas | | 域名 | technoguides.org | 2026/01/27 | Cloud Atlas | | 域名 | perfectfinder.net | 2026/01/27 | Cloud Atlas | | 域名 | updf-download.xyz | 2026/01/27 | CNC | | IP | 83.243.121.150 | 2026/01/27 | CNC | | 域名 | cloudhauwei.com | 2026/01/27 | CNC | | IP | 194.15.216.206 | 2026/01/27 | CNC | | IP | 89.150.40.14 | 2026/01/27 | CNC | | 域名 | guardyun.com | 2026/01/27 | CNC | | IP | 188.190.4.40 | 2026/01/27 | CNC | | 域名 | appyuncn.com | 2026/01/27 | CNC | | 域名 | mailcloud163.com | 2026/01/27 | CNC | | IP | 213.111.177.145 | 2026/01/27 | CNC | | 域名 | 360totalcloud.com | 2026/01/27 | CNC | | IP | 46.183.186.25 | 2026/01/27 | CNC | | 域名 | cloudmail163.com | 2026/01/27 | CNC | | IP | 146.70.135.150 | 2026/01/27 | CNC | | 域名 | corernailcloud.com | 2026/01/27 | CNC | | 域名 | corernail.net | 2026/01/27 | CNC | | IP | 185.106.102.68 | 2026/01/27 | CNC | | 域名 | updater-browser.com | 2026/01/27 | – | | IP | 139.180.222.70 | 2026/01/27 | 毒云藤 | | IP | 66.42.48.189 | 2026/01/27 | 毒云藤 | | 域名 | getsupdated.info | 2026/01/27 | 肚脑虫 | | IP | 193.149.190.162 | 2026/01/27 | 肚脑虫 | | 域名 | prosergate.info | 2026/01/27 | 肚脑虫 | | 域名 | upflowinfo.info | 2026/01/27 | 肚脑虫 | | 域名 | nextservz.info | 2026/01/27 | 肚脑虫 | | 域名 | mainservz.info | 2026/01/27 | 肚脑虫 | | IP | 149.248.79.160 | 2026/01/27 | 肚脑虫 | | IP | 45.76.177.25 | 2026/01/27 | 肚脑虫 | | IP | 193.149.187.185 | 2026/01/27 | 肚脑虫 | | 域名 | budzyserv.info | 2026/01/27 | 肚脑虫 | | IP | 149.248.77.111 | 2026/01/27 | 肚脑虫 | | 域名 | hubservicez.info | 2026/01/27 | 肚脑虫 | | IP | 216.245.184.8 | 2026/01/27 | 肚脑虫 | | IP | 193.149.190.11 | 2026/01/27 | 肚脑虫 | | IP | 193.149.180.79 | 2026/01/27 | 肚脑虫 | | 域名 | boostgridz.info | 2026/01/27 | 肚脑虫 | | 域名 | servicewebz.info | 2026/01/27 | 肚脑虫 | | IP | 193.149.180.165 | 2026/01/27 | 肚脑虫 | | 域名 | servzupdate.info | 2026/01/27 | 肚脑虫 | | IP | 206.71.148.204 | 2026/01/27 | 肚脑虫 | | 域名 | surfspotz.info | 2026/01/27 | 肚脑虫 | | IP | 149.248.78.84 | 2026/01/27 | 肚脑虫 | | IP | 151.243.12.62 | 2026/01/27 | 海莲花 | | IP | 212.192.6.96 | 2026/01/27 | 海莲花 | | 域名 | stellacustomscreens.com | 2026/01/27 | 蔓灵花 | | 域名 | florabrocuisine.com | 2026/01/27 | 蔓灵花 | | 域名 | oscarskatingcoach.com | 2026/01/27 | 蔓灵花 | | 域名 | joelgardensc.com | 2026/01/27 | 蔓灵花 | | 域名 | myworkdrivemanager.org | 2026/01/27 | 摩诃草 | | 域名 | exessupdate.info | 2026/01/27 | 摩诃草 | | 域名 | regupdates.info | 2026/01/27 | 摩诃草 | | 域名 | nodyard.org | 2026/01/27 | 摩诃草 | | IP | 192.166.82.82 | 2026/01/27 | 摩诃草 | | 域名 | motiquote.info | 2026/01/27 | 摩诃草 | | 域名 | neteaseforms.com | 2026/01/27 | 魔罗桫 | | IP | 149.3.170.72 | 2026/01/27 | 透明部落 | | IP | 2.56.10.86 | 2026/01/27 | 透明部落 | | IP | 2.56.10.121 | 2026/01/27 | 透明部落 | | IP | 146.19.173.32 | 2026/01/27 | 透明部落 | | IP | 46.183.27.134 | 2026/01/27 | 伪猎者 | | IP | 167.88.165.214 | 2026/01/21 | Lazarus | | IP | 167.88.165.222 | 2026/01/21 | – | | IP | 172.86.116.178 | 2026/01/21 | – | | IP | 172.86.117.52 | 2026/01/21 | – | | IP | 172.86.73.46 | 2026/01/21 | – | | IP | 172.86.88.188 | 2026/01/21 | – | | 域名 | eth-mainnet-alchemy.com | 2026/01/21 | – | | 域名 | mail.koshy.cyou | 2026/01/21 | – | | 域名 | chainlink-api-v3.com | 2026/01/21 | – | | 域名 | chainlink-api-v3.cloud | 2026/01/21 | – |

APT37 (14条)

木马 (73条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | Hash | 5cabb58ab119cdbe38ac2a9c3c223aa3282aefe8e2f0ac0f3fa840f11670f217 | 2026/01/15 | 银狐 | | Hash | 91a0997d7729ed8d091a789394eda1ecc0f923a8d21a6230dae98d9a8ed1f0d7 | 2026/01/15 | 银狐 | | Hash | 6bf935a0630ccf6423cc89815aceba70f0cb0fffa527d8034603c10943f4dd50 | 2026/01/15 | 银狐 | | Hash | 49d7746565729a367df0b041d12830ee3c9abc1be4a0fa6c1bb2c28bf260005b | 2026/01/15 | 银狐 | | Hash | 0a9f2c4acf18ee7bac1da63d9a5f98abb83fda5969df72433f014504c0d78af0 | 2026/01/15 | 银狐 | | Hash | d12479b6420bff547664c90946b634e525afb2a0238f9e80e188ed49083641bc | 2026/01/15 | 银狐 | | Hash | 6374ec4c6055a101aba3c4733a96e7ccf372572bb0864b24beebc42c07a604e3 | 2026/01/15 | 银狐 | | IP | 161.248.14.248 | 2026/01/13 | – | | 域名 | topfreeweb.net | 2026/01/09 | – | | Hash | 2ea09d7d4150d71387a079cfd07d35525a1a6ed60018c3090f9bec7ab2f7da7c | 2026/01/09 | – | | Hash | 5884d0fe52362d76ab11b087478f7c61ad19b631dec9cf95b873f2423aab0ccf | 2026/01/09 | – | | Hash | c4447bf250401af902136896f615c52e5e42edf12bf55fb7f458eb61722a589a | 2026/01/09 | – | | Hash | eb5313aaa9f987ce0fb2141657b4d66e40ee66f6ee822e5962625bd89f738315 | 2026/01/09 | – | | Hash | 0d785b0d16f006df1dbfdb294f8279c3cc2c2df1d2512f208e4d7e83eee56d86 | 2026/01/09 | – | | Hash | 5c1ae29667dd46dbff9d78777bd721fbb7eaf21a8b484c98dfcc3cfca022086a | 2026/01/09 | – | | Hash | b8553c0edd120d6207722a5e90989e2a1043f4d62de4035445e19d11e26edd8c | 2026/01/09 | – | | Hash | f966ace85d1944afbd3b2484e0a5bc2889b3bae70223c1984635932177c4c876 | 2026/01/09 | – | | Hash | b7fc1c5495e4758b1911e330e2a19c19f323dd088c6f45cb88d45c2b65fb0846 | 2026/01/09 | – | | Hash | 2109c34b9a6668b590143ad69ae6baa9f24759d6cc9efbc89f38832f9c120dec | 2026/01/09 | – | | Hash | 71961f8bea2982d6157be9a1d36b5397f7d34629bd52dea8d62432c359e31ad6 | 2026/01/07 | – | | Hash | d420d7581b3e7d219987ac30bbfb4d41b5e2e2211c4109087b1559e62931bc62 | 2026/01/07 | – | | Hash | a7bbff68720a38c2491bb0886a84331d765c6f6ed29f5658a73a7664f28765ae | 2026/01/07 | – | | Hash | 4b1f5dbfa5c785b4a703822b74209a458679c1f454887095b3f79d6fbc95dc14 | 2026/01/07 | – | | Hash | 56a94362289a5b7fc8c3fbee6f3b1a25fe7c9a20ebe2293858d40b9196d6f99d | 2026/01/07 | – | | Hash | a8cf3ba7709a4162280c5d5fe286effa96e4da4228c47db61a9dd2f691a13889 | 2026/01/07 | – | | Hash | 32ad163e33c4902b1b0c70f903608d94e3faa63adca1a1358c6e7728a82e761a | 2026/01/07 | – | | 域名 | sg-xj-1306567145.cos.ap-guangzhou.myqcloud.com | 2026/01/07 | – | | 域名 | mltab-1306567145.cos.ap-guangzhou.myqcloud.com | 2026/01/07 | – | | 域名 | fh67k.com | 2026/01/07 | – | | 域名 | eybyyffs.com | 2026/01/07 | – | | 域名 | gey87.com | 2026/01/07 | – | | 域名 | fk6u1.com | 2026/01/07 | – | | 域名 | hty73.com | 2026/01/07 | – | | 域名 | rh6yd.com | 2026/01/07 | – | | 域名 | djt86.com | 2026/01/07 | – | | 域名 | n3yj6.com | 2026/01/07 | – | | 域名 | 3d5d6.com | 2026/01/07 | – | | 域名 | k5jy8.com | 2026/01/07 | – | | 域名 | h7np2.com | 2026/01/07 | – | | 域名 | g8ht6.com | 2026/01/07 | – | | 域名 | e78y.com | 2026/01/07 | – | | 域名 | api.g6ht.com | 2026/01/07 | – | | 域名 | cjtab.com | 2026/01/07 | – | | 域名 | d.giw36.com | 2026/01/07 | – | | IP | 147.92.43.161 | 2026/01/04 | – | | Hash | a0210e318ece75e32e744b9e9aca98bb7930e7cfd39f37fe85f3ff6b53c669d9 | 2026/01/04 | – | | 域名 | emedjp.com | 2025/12/25 | – | | 域名 | emeditorde.com | 2025/12/25 | – | | 域名 | emedorg.com | 2025/12/25 | – | | 域名 | emeditorjapan.com | 2025/12/25 | – | | 域名 | emeditorjp.com | 2025/12/25 | – | | 域名 | cachingdrive.com | 2025/12/25 | – | | IP | 147.45.50.54 | 2025/12/25 | – | | IP | 5.101.82.118 | 2025/12/25 | – | | IP | 46.28.70.245 | 2025/12/25 | – | | 域名 | brt461jnbjvm52mw.biz | 2025/12/25 | – | | 域名 | 1a298k7iqspq52l4r9e.space | 2025/12/25 | – | | 域名 | z2ctmmm61dm0c3wfic.store | 2025/12/25 | – | | 域名 | afdwtyy38efzk.app | 2025/12/25 | – | | 域名 | 08qodmaloshm5zrwhww.xyz | 2025/12/25 | – | | 域名 | gs9uuz4h0510qhob.io | 2025/12/25 | – | | 域名 | 973jgnzjgnwupd1nu.space | 2025/12/25 | – | | 域名 | daj54smzpklt5kjq.space | 2025/12/25 | – | | 域名 | 8mfi71rtud8fov5.org | 2025/12/25 | – | | 域名 | 0xax86xdizce7kg9cpdk.online | 2025/12/25 | – | | 域名 | ttsdvv.oss-cn-hongkong.aliyuncs.com | 2025/12/09 | 仿冒 | | Hash | 00e63362daed7a7e9cb5e84017bc55ee918e8083c70ce96741e96bf035bf13f1 | 2025/12/09 | 仿冒 | | Hash | c2ac49fc590493ef55b4967059ccae3c7d3b5037d768bd4d1fc9f821cc916659 | 2025/12/09 | 仿冒 | | Hash | a6123e13e12a1a1d4c4a4eb034769bfe8e229c3a9877e0dd173b422e700a26ac | 2025/12/04 | – | | Hash | 06f52664023f15113c43ebb246cbe9cb2083b0283e694474bed731d8db85e864 | 2025/12/04 | – | | 域名 | sakjrjki1545.com | 2025/12/04 | – | | IP | 39.108.134.10 | 2025/12/01 | – | | Hash | 1afbda8220ba19ca84498f41b2b28350fce419c080082b3817dcfc4efc103b72 | 2025/12/01 | – |

黑猫 (57条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | telegramcn.com | 2026/01/16 | – | | Hash | cdf92c4151397f89ca1ffec4e938c78059d9197f29895d1a9b6157013ab1ecc7 | 2026/01/16 | 黑猫 | | Hash | d21a0f744f304b36d4d6c72216696fcf60184540d6bcef94101ffe933227d62e | 2026/01/16 | 黑猫 | | 域名 | sbido.com | 2026/01/15 | – | | 域名 | xumeno.com | 2026/01/15 | 黑猫 | | IP | 31.57.51.149 | 2026/01/15 | 黑猫 | | 域名 | notepadplusplus.cn | 2025/12/30 | 仿冒 | | 域名 | clash.net.cn | 2025/12/30 | 仿冒 | | 域名 | clash.ac.cn | 2025/12/30 | 仿冒 | | 域名 | cn-notepadplusplus.com | 2025/12/30 | 仿冒 | | 域名 | zh-clash.com | 2025/12/30 | 仿冒 | | 域名 | clashforwindows.org.cn | 2025/12/30 | – | | 域名 | github.zh-cns.top | 2025/12/30 | – | | 域名 | cdn-ccdown.com | 2025/12/30 | – | | 域名 | cn-obsidian.com | 2025/12/30 | – | | 域名 | cn-winscp.com | 2025/12/30 | – | | 域名 | jiaweo.com | 2025/12/30 | – | | 域名 | taokur.com | 2025/12/30 | – | | 域名 | jouloi.com | 2025/12/30 | – | | 域名 | duooi.com | 2025/12/30 | – | | 域名 | golomee.com | 2025/12/30 | – | | 域名 | titamic.com | 2025/12/30 | – | | 域名 | sadliu.com | 2025/12/30 | – | | 域名 | olabb.com | 2025/12/30 | – | | 域名 | vlumu.com | 2025/12/30 | – | | 域名 | jokewick.com | 2025/12/30 | – | | 域名 | alonesad.com | 2025/12/30 | – | | 域名 | lovemeb.com | 2025/12/30 | – | | 域名 | theaigaming.com | 2025/12/30 | – | | 域名 | hiluxo.com | 2025/12/30 | – | | 域名 | sbido.com | 2025/12/30 | – | | 域名 | kimhate.com | 2025/12/30 | – | | IP | 223.26.63.103 | 2025/12/30 | – | | IP | 27.50.63.118 | 2025/12/30 | – | | IP | 27.50.54.144 | 2025/12/30 | – | | IP | 137.220.252.82 | 2025/12/30 | – | | IP | 206.119.64.108 | 2025/12/30 | – | | IP | 38.55.16.61 | 2025/12/30 | – | | IP | 154.213.190.46 | 2025/12/30 | – | | Hash | b94c54290015ed751c84d0a9bfa6e63481c72c0d7528b4b65a2816f72ea5c994 | 2025/12/30 | – | | Hash | 46c9e9e2003f92ea1aa06984b02d4827deae71631c5ecf2bed5e4f7f8d5d16c8 | 2025/12/30 | – | | Hash | 087ce894e139f281bd9ebd4b78d4451e458357cef38807e5b4b98ef3ba2fd35c | 2025/12/30 | – | | Hash | 9868a6e020f35b8e55f6e2366feea72e617648ab7ebad1972d093642f3058f70 | 2025/12/30 | – | | Hash | 3fe9868b56cfbb4de67f65afece0ac95a16267e44d2f555c25263fd641ed7374 | 2025/12/30 | – | | Hash | 267f5bcedb5b1ebaa855b9b041351892868d0b4a9153517178ef02a55a6f17bd | 2025/12/30 | – | | Hash | 8c6e135ea743c82d6f36facd293f5ddc01973ab0c5c52f42ed70e2885e838c4c | 2025/12/30 | – | | Hash | b0fcdb33e486ddbc0553f201cf6b9255ec22a12cb85dc9d12ebceb9c7308e51d | 2025/12/30 | – | | Hash | aa8e535d8576f0471a98865eb44e5e5ae3c3a279f15807e9a8317adb80bf8c9d | 2025/12/30 | – | | Hash | 46c9e9e2003f92ea1aa06984b02d4827deae71631c5ecf2bed5e4f7f8d5d16c8 | 2025/12/30 | – | | Hash | 01f3961d755a86307bd2f22b3ade00e80e2db3028ff6e385683ad9b5d08277b9 | 2025/12/24 | 仿冒 | | 域名 | simmem.com | 2025/12/24 | 仿冒 | | IP | 223.26.63.103 | 2025/12/24 | 仿冒 | | 域名 | clash.ac.cn | 2025/12/06 | – | | 域名 | simmem.com | 2025/12/01 | – | | IP | 27.50.63.118 | 2025/12/01 | – | | Hash | b75ad8f58bf0a308b5236738955911580bbba08b795691caa3f74610b793a63b | 2025/12/01 | – | | 域名 | zhcn.down-cdn.com | 2025/12/01 | – |

黑产团伙 (20条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | xinjiapox.oss-ap-southeast-1.aliyuncs.com | 2026/01/22 | – | | 域名 | hoyenoy.com | 2026/01/19 | – | | 域名 | 0z1zxmvo.com | 2026/01/13 | – | | 域名 | mlcrosoft.my | 2026/01/13 | – | | 域名 | dows.v3-quickq.com | 2026/01/09 | – | | 域名 | cxhetiry.msgcj.cn | 2026/01/08 | – | | 域名 | jkemdr.hoyenoy.com | 2025/12/23 | 仿冒 | | IP | 134.122.162.126 | 2025/12/23 | 仿冒 | | Hash | f88aca8ca0602896ad5e094d567d19ba6b6e4cd8e6b4b648e8e552b6c39c086e | 2025/12/23 | 仿冒 | | Hash | 60604687da3fca1fb8ceb6f0e79b0fe4b2a19686c72237f77291da8708d907fa | 2025/12/23 | 仿冒 | | 域名 | subduedcurvy.yachts | 2025/12/22 | 仿冒 | | 域名 | js.amy-cdn.cyou | 2025/12/18 | 仿冒 | | 域名 | wjrdq5o.oss-ap-southeast-1.aliyuncs.com | 2025/12/16 | – | | Hash | 2b0b3c73a08057fb07d4ad5a61ea8352f1e53df04f8c95eec536c85dc914e644 | 2025/12/12 | – | | 域名 | dadan168.vip | 2025/12/12 | – | | IP | 18.138.221.246 | 2025/12/12 | – | | IP | 161.248.14.99 | 2025/12/12 | – | | Hash | 7416cceb70622b1a56ef95a35a0ea3399db8a9f8a00ef9c08ad3aeaa83c50f7d | 2025/12/12 | – | | Hash | 02337369123363cf8937d9d5c35e8de43ec21a7b79b5aeebeb8f170f6d7ae25d | 2025/12/12 | – | | Hash | 9c6c69d7672fe942acff0f9b8c377f3a2b2da2c22f36a27ef7b3aea4cbc08b46 | 2025/12/12 | – |

代理工具 (3条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | kuailei.info | 2026/01/23 | – | | IP | 91.195.240.12 | 2026/01/23 | – | | Hash | 5a63bd061eb1e02c2eb75fec1beb9c076183e1181cd6088a5d48e7922d68da35 | 2026/01/23 | – |

Xagent木马 (3条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | IP | 148.66.11.18 | 2025/12/29 | – | | Hash | 082c8396602fb5ba8b9e0f34c3c9fa5509c766136f4a505ba5481ea067f823ae | 2025/12/29 | – | | Hash | d6bccc1e3c3df9578d27142b4adbab69bf0fd38d89f823d06ecbda6a62cfc791 | 2025/12/29 | – |

Gh0stRAT木马 (4条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | IP | 154.91.66.19 | 2025/12/16 | – | | Hash | be8551dea5e3a81facf694cdbe2f3f398fa17e53ea5de1a257c10ed2fafdae95 | 2025/12/16 | – | | Hash | efaa90bf781c879269ceb635d0bd13db8d067eac05bb0c2ff032dd224a186a73 | 2025/12/16 | – | | Hash | 22dc82f9956ca128a6462a7c515c9e45b2b72fa783e1ec4918143d4691e1f498 | 2025/12/16 | – |

PUA (13条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | Hash | 6e03deb46e4d72bd126ba0bd0e6aee26a7206ccde08fa628008512cd84ddd9aa | 2025/12/16 | 仿冒 | | Hash | 074d6f3cbb86a303fd702f99a4a20b7f4dd0b38bcdb11cd55b39391d12d30429 | 2025/12/01 | – | | Hash | 7afa5997fbe06627ee927618804064da651f0462e7b83eae8e29ca8b8a5188cb | 2025/12/01 | – | | 签名 | 成都奇鲁科技有限公司 | 2025/12/01 | – | | Hash | 706336b8785f7013fdc7e7eb2cd909af8fe7b678f52cd956e50ba5f7bff2ae90 | 2025/12/01 | 仿冒 | | 签名 | 成都星汉云科科技有限公司 | 2025/12/01 | – | | Hash | 71a4c90c14232523f5cac6888039a748540ad71772330861d4c7ea12bc4dfccf | 2025/12/01 | – | | Hash | f6f54f4dcff87f0c58cdec43b5f5242480e47922d79dd3b8015fabf890170b92 | 2025/12/01 | – | | Hash | e6b790f4e1d0e7a4c53e62cc7f5331fe4c4f25802e398d2bc266a46b5849c5cf | 2025/12/01 | – | | Hash | fcbbd5444ec4af8cfef800b8351028fdb357aeea81d6b674b322d6feff137597 | 2025/12/01 | – | | Hash | 0636322f4c8418155287fc990d6c9f46f65f55fe8e48d79a723562af35ff87ad | 2025/12/01 | – | | Hash | 0c5997d8f617c4885d16cdfeb50034d3c972901410644ee01e6bdf0602da2642 | 2025/12/01 | – | | Hash | f19d3dda1904e95c81e5f319056757066844f082be8840d1b721afd1429c8dd2 | 2025/12/01 | – |

恶意软件 (3条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | themoviehometheather.com | 2025/12/26 | – | | Hash | ddf7b8bdc63d4e428fefdef9ed68b49a18b6a62fa86a0c9ee4c32031ad4d5524 | 2025/12/23 | 仿冒 | | Hash | 6dd235ba08e55b48a8f6d239b0d65f6e0aebb8c3c4e51e71f0f1ce7dc3d55e54 | 2025/12/23 | 仿冒 |

远控木马 (1条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | IP | 110.42.41.92 | 2026/01/29 | – |

蠕虫 (1条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | prjub.com | 2026/01/15 | – |

蠕虫病毒 (1条)

| 类型 | IOC | 日期 | 关联信息 | | — | — | — | — | | 域名 | xred.mooo.com | 2025/12/23 | – |

*本报告仅供安全研究和防御参考，请勿用于非法用途*

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：小东安全日记小东小东《26年1月威胁情报IOC汇总》