安全卫士一周威胁预警

本文将盘点这两周出现的新的活跃木马家族以及一些已知的木马家族在这两周的更新情况并附上IOC。分析的木马家族包括针对服务器的挖矿木马家族以及通过Office漏洞利用完成攻击的银行木马家族。（注：本文中的IOC仅涉及这两周（6.4-6.15）出现的新木马家族相关的域名、ip信息以及已知木马家族在这两周活动时使用的新域名、ip信息，历史IOC信息请查阅本系列前几篇报告。）

• 服务器挖矿木马家族

• WannaMine使用几个新的载荷。WannaMine在这两周使用了几个新的载荷，新载荷托管地址与上周文章中提到的托管地址相同。具体IOC如下所示：

IOC
hxxp://185.128.43.62/oseoptrick.ps1
hxxp://185.128.43.62/eop.ps1
 

• ArcGISMiner挖矿木马每隔两星期发起一次扫描入侵攻击，影响近千提供位置服务的Web应用。这个来自国内的挖矿木马自五月份以来，每间隔两星期对一些提供位置服务的Web应用进行攻击，包括Arcgis Server、Exlive等。攻击者利用包括tomcat、Jboos在内的多种不同平台的远程代码执行漏洞攻击对这些Web应用进行攻击，植入挖矿木马获利。

IOC
hxxp://121.41.33.131:8000/aa
hxxp://121.41.33.131:8000/ff
 

• 其他挖矿木马家族IOC如下所示。

IOC
hxxp://132.148.150.15:8080/miner.exe
hxxp://supervrr.com/js/host.xsl
hxxp://supervrr.com/js/win.exe
hxxp://45.77.246.110/fr.xsl
hxxp://45.77.246.110/host.xsl
hxxp://54.39.10.62:3000/init.exe
hxxp://msupdate.info/test.txt
hxxp://msupdate.info/uni/md5/cspsvc.ps1.md5
hxxp://msupdate.info/uni/md5/explorerx64.exe.md5
hxxp://msupdate.info/uni/cspsvc.ps1
hxxp://211.149.176.110:8080/javav.exe
hxxp://218.203.155.20:280/javav.exe
hxxp://218.203.155.20:280/exp.exe
hxxp://218.203.155.20:280/superminer.exe
hxxp://218.203.155.20:280/exploitkit.exe
hxxps://transfer.sh/8GyZl/t.ps1
hxxp://3389.space/nw/vm.exe
hxxp://107.181.174.232/win/checking.ps1
hxxp://107.181.174.232/win/update.hta
hxxp://103.1.154.237/tianshi/ts64
 
 
2.Office漏洞利用相关的银行木马家族
LokiBot
hxxp://nexteracom.ml/ojay/scan_094002.exe
hxxp://hussaintrust.com.pk/ht/mal.exe
hxxp://rnicrosoft.cf/2.exe
hxxp://servicelearning.thu.edu.tw/sop.exe
hxxp://internationalcon.com/ar/jakuzo/fynoy/ste.exe
hxxp://31.220.40.22/~blackdia/enesfolder/555555555.exe
hxxp://darice.in/neu1.exe
hxxps://roshnicollectionbyasy.com/jack/build_output5d6ff60.msi
hxxp://cortlnachina.com/dada_253782.exe
hxxp://indostraits.co.id/dave.exe
hxxp://darice.in/neu1.exe
hxxp://servicelearning.thu.edu.tw/zeya.exe
hxxp://servicelearning.thu.edu.tw/tekex.exe
hxxps://roshnicollectionbyasy.com/jack/build_output5d6ff60.msi
hxxp://cortlnachina.com/dada_253782.exe
hxxp://hussaintrust.com.pk/ht/mal.exe
hxxp://cortlnachina.com/7788.exe
hxxp://servicelearning.thu.edu.tw/ebu.exe
hxxp://hdtgs.ga/game/scuscu.exe
hxxp://cortlnachina.com/dada_253782.exe
hxxp://internationalcon.com/ar/jakuzo/fynoy/ste.exe
hxxp://uploadtops.is/1//f/tlydlre
hxxp://bertzeserf.co.vu/j/jh2.exe
hxxp://partsmaxus.com/itunut.exe
hxxp://indostraits.co.id/moroco.exe
hxxp://e-ylhua.com/maski_dada.msi
hxxp://uploadtops.is/1//f/a7emkle
hxxp://uploadtops.is/1//f/sxav7n8
hxxp://hussaintrust.com.pk/ht/mal.exe
hxxp://84.38.129.111/system/doro.exe
hxxp://indostraits.co.id/palll.exe
hxxp://e-ylhua.com/maski_dada.msi
hxxp://31.220.40.22/~blackdia/enesfolder/555555555.exe
hxxp://servicelearning.thu.edu.tw/zeya.exe
hxxp://hussaintrust.com.pk/ht/mal.exe
hxxp://elizvanroos.info/ug/ucg.exe
hxxp://majesticraft.com/me/015543672432450.exe
hxxp://uploadtops.is/1//f/sxav7n8
hxxp://earthart.org/ve.msi
hxxp://uploadtops.is/1//f/sxav7n8
hxxp://meta-mim.in/dan.exe
hxxp://hussaintrust.com.pk/ht/mit.exe
hxxp://internationalcon.com/ar/jakuzo/fynoy/olumain/sam.exe
hxxps://roshnicollectionbyasy.com/jack/build_output5d6ff60.msi
hxxp://indostraits.co.id/rental.exe
hxxp://e-ylhua.com/maski_dada.msi
hxxp://indostraits.co.id/rental.exe
hxxp://uploadtops.is/1//f/sxav7n8
hxxp://chironquest.com/sk/inc/declan_loki.exe
hxxp://i-razum.ru/det/pox.exe
hxxp://servicelearning.thu.edu.tw/tekex.exe
hxxp://irishlebanese.com/wp-admin/images/eight/saguy.exe
hxxp://indostraits.co.id/work.exe
hxxp://uploadtops.is/1//f/xkiqiwo
hxxp://internationalcon.com/ar/jakuzo/fynoy/ste.exe
hxxp://e-ylhua.com/maski_dada.msi
hxxp://uploadtops.is/1//f/sxav7n8
hxxp://cortlnachina.com/dada_253782.exe
hxxp://cortlnachina.com/7788.exe
hxxp://picluib-jp.co/sop.exe
hxxp://uploadtops.is/1//f/sxav7n8
hxxp://bertzeserf.co.vu/j/jh2.exe
hxxp://wetransfers.tk/bp/dee.exe
hxxp://irishlebanese.com/wp-admin/images/eight/dew008.exe
hxxp://topserveltd.co.ke/vb.exe
hxxp://internationalcon.com/ar/jakuzo/fynoy/ste.exe
hxxp://2toporaru.432.com1.ru/soft.msi
hxxp://e-ylhua.com/maski_dada.msi
hxxp://uploadtops.is/1//f/tlydlre
hxxp://psatafoods.com/oc/po33344.exe
hxxp://rnicrosoft.cf/1.exe
hxxp://hussaintrust.com.pk/ht/mit.exe
hxxp://internationalcon.com/ar/home/eat.exe
hxxp://hussaintrust.com.pk/ht/mal.exe
hxxp://hdtgs.ga/cash/teddie.exe
hxxp://indostraits.co.id/awer.exe
hxxp://www.lnsect-net.com/2223.exe
hxxp://internationalcon.com/ar/jakuzo/flo.exe
hxxp://uploadtops.is/1//f/3msyzpa
hxxp://salesxpert.ml/exp/ken.exe
hxxp://olorioko.ga/bin/olori.exe
hxxp://chironquest.com/sk/inc/whee_loki.exe
hxxp://cortlnachina.com/7788.exe
hxxp://internationalcon.com/ar/home/eat.exe
hxxp://cortlnachina.com/dada_253782.exe
hxxp://wetransfers.tk/bp/dee.exe
hxxp://majesticraft.com/ema/payment
hxxp://uploadtops.is/1//f/xkiqiwo
hxxp://meta-mim.in/dan.exe
hxxp://31.220.40.22/~lahtipre/rex.123
hxxps://andinihijab.com/jack/build_output2ca5360.msi
hxxp://steamer10theatre.org/wp-includes/text/xilo.exe
hxxp://internationalcon.com/ar/jakuzo/fynoy/ste.exe
hxxp://hussaintrust.com.pk/ht/mit.exe
hxxp://cortlnachina.com/dada_253782.exe
hxxp://cortlnachina.com/7788.exe
hxxps://andinihijab.com/jack/build_output2ca5360.msi
 
Pony
hxxp://inova-tech.net/x1/m.exe
hxxp://llumar.moscow/administrator/jbl/_output83ca99f.exe
hxxp://olorioko.ga/bin/kenny.exe
hxxp://23.249.161.109/wrd/mamez.exe
hxxp://energy.rs/09.scr
hxxp://energy.rs/79.scr
hxxp://energy.rs/40.scr
hxxp://internationalcon.com/assets/fonts/foc.msi
hxxp://indostraits.co.id/amen.exe
hxxp://energy.rs/65.scr
hxxp://energy.rs/79.scr
hxxp://shzwnsarin.com/inc/moc.exe
hxxp://wetransfers.tk/bp/nwa.exe
hxxp://indostraits.co.id/good.exe
hxxp://wetransfers.tk/bp/col.exe
hxxp://inova-tech.net/x1/m.exe
hxxp://energy.rs/79.scr
hxxp://internationalcon.com/assets/fonts/foc.msi
hxxp://wetransfers.tk/bp/col.exe
hxxp://energy.rs/09.scr
hxxp://indostraits.co.id/amen.exe
hxxp://parkinglotgame.xyz/feshbhfubguebgegbyhoubgsbgosgt/dt.exe
hxxp://energy.rs/40.scr
hxxp://olorioko.ga/bin/kenny.exe
hxxp://grafoinvest.rs/11.scr
hxxp://indostraits.co.id/help.exe
hxxp://indostraits.co.id/book.exe
hxxp://glendyli.myhostpoint.ch/ling/jimmi.exe
hxxp://23.249.161.38/filet018.exe
hxxp://energy.rs/65.scr
hxxp://0kulen.com/cgnbin/cdz.exe
hxxp://indostraits.co.id/soppp.exe
hxxp://energy.rs/79.scr
hxxp://llumar.moscow/administrator/jbl/_output83ca99f.exe
hxxp://wetransfers.tk/bp/col.exe
hxxp://jiren.ru/chief/doboy.scr
hxxp://indostraits.co.id/amen.exe
hxxp://inova-tech.net/x1/m.exe
hxxp://jiren.ru/chief/chief.scr
hxxp://ecodot.net/modules/contextual/images/two/ukbros001.exe
hxxp://internationalcon.com/assets/fonts/foc.msi
hxxp://23.249.161.109/wrd/mamez.exe
hxxp://olorioko.ga/bin/kenny.exe
hxxp://inova-tech.net/x5/m.exe
hxxp://indostraits.co.id/formmm.exe
 
AgentTesla
hxxp://soficom.ma/offre3/papiserver.exe
hxxp://soficom.ma/offre3/papiserver.exe
hxxp://23.249.161.109/wrd/jhn.exe
hxxp://cafeelcafee.com/cbg/coz.exe
hxxp://nascenthotels.com/zu/sae.scr
hxxp://sunusa.in//img/mine10/gervinho.exe
hxxp://denmarkheating.net/buttons/naz/nazxnan.exe
hxxp://soficom.ma/offre3/papiserver.exe
hxxp://uploadtops.is/1//f/yuppfnh
hxxp://chemicalsrsa.com/poz/zaq.exe
hxxp://chemicalsrsa.com/cods/ssl.exe
hxxp://nascenthotels.com/zu/sae.scr
hxxp://sunusa.in//img/mine10/phyno.exe
hxxp://nascenthotels.com/zu/sae.scr
hxxp://chemicalsrsa.com/poz/zaq.exe
hxxp://sunusa.in//img/mine10/gervinho.exe
hxxp://soficom.ma/offre3/papiserver.exe
hxxp://emiratefalcon.com/deo/iom.exe
hxxp://byqgab.com/bincgi/mdas.exe
hxxp://23.249.161.109/wrd/jhn.exe
hxxp://chemicalsrsa.com/poz/zaq.exe
hxxp://uploadtops.is/1//f/yuppfnh
 
Hawkeye
hxxp://topserveltd.co.ke/uc.exe
hxxp://uploadtops.is/1//f/kyxkawo
hxxp://uploadtops.is/1//f/0vfsn7d
hxxp://uploadtops.is/1//f/kyxkawo
 
FormBook
hxxp://23.249.161.109/wrd/jooo.exe
hxxp://185.24.233.141/1.exe
hxxp://84.38.129.111/doro2/mamez.exe
hxxp://www.kwikri.com/.well-known/56.exe
hxxp://irishlebanese.com/wp-admin/images/six/was001.exe
hxxp://albazrazgroup.com/aco/sev.exe
hxxp://irishlebanese.com/wp-admin/images/six/was001.exe
hxxp://ethereumcashpr0.com/custom/dove.exe
hxxp://23.249.161.109/wrd/jooo.exe
hxxp://uploadtops.is/1//f/clzmc7n
hxxp://www.kwikri.com/.well-known/5sun.exe
hxxp://alliancerfinanceservices.com/fgdxg/sec.exe
hxxp://uploadtops.is/1//f/tpgrhh7
hxxp://elizvanroos.info/home/winchat.exe
hxxp://23.249.161.109/wrd/jooo.exe
hxxp://nveeusa.com/formnew/datedlll.exe
hxxp://www.kwikri.com/.well-known/56.exe
hxxp://84.38.129.111/system2/jooo.exe
hxxp://alliancerfinanceservices.com/fgdxg/sec.exe
hxxp://ethereumcashpr0.com/custom/dove.exe
hxxp://84.38.129.111/system2/jooo.exe
 
Nanocore
hxxp://denmarkheating.net/chillers/ocxa/dngab.exe
hxxp://vala.5gbfree.com/chr.exe
hxxp://vala.5gbfree.com/jer.exe
 
RemcosRAT
hxxp://23.249.161.38/ezege018.exe
hxxp://23.249.161.84/doc/screen.exe
hxxp://keinzgroup.com/order43.exe
 
NetWire
hxxp://tatnefts.su/doc/payment.exe
hxxp://gulzarhomestay.com/images/windows.exe