(2x) #银狐 #FakeApp #汽水音乐

LingGao

Dear all,

(2x) #银狐 #FakeApp #汽水音乐
VirusTotal 均首传

Ling Gao 通过 QQ 闪传分享了【汽水音乐.zip】
链接：https://qfile.qq.com/q/x2os9XEwYC
infected

1. qishuiyinyue_x64.exe
SHA256: f57d9e5f927737880161b692ad6227f9b3e463632e6f819032f0888c840f790a
VT 6: virustotal.com/gui/file/f57d9e5f927737880161b692ad6227f9b3e463632e6f819032f0888c840f790a

(从 hxxps://www[.]qishuiapp[.]com[.]cn -> hxxps://alibaba-cloud-azhi-oss[.]com/down[.]php/2b35c9488425728b2771f6950683740c[.]zip 下载)

---

2. Sodaqishui_514.msi
SHA256: c1d1d488ed4d0a69213c5c2c1d04dafe14dc2a95107523f6facb3a050745fa9f
VT 8: virustotal.com/gui/file/c1d1d488ed4d0a69213c5c2c1d04dafe14dc2a95107523f6facb3a050745fa9f

(从 hxxps://qi-qishuimusic[.]com[.]cn -> hxxps://uiejnnd[.]huzero[.]com/yinyueqishui14[.]1A[.]zip 下载)

谢谢！

fdsax

bd双击2x

jxfaiu

双击

嘿嘿不能说

1. D:\测试\汽水音乐\Sodaqishui_514.msi        木马程序(Trojan.Generic)        已删除
   
2. 
   
3. 2026-04-20 09:36:48     感染型病毒(Win32/Heur.Generic.HxQB0WkA)MD5:f63923e9971dfaa73d02a2891d8c9661已删除此文件，如果您发现误删，可从隔离区恢复此文件。        d:\测试\汽水音乐\qishuiyinyue_x64.exe

复制代码

MrDeep

Sodaqishui_514.msi
a variant of Win64/Kryptik_AGen.AII

WGC_ZY

ESSP：
可疑x1、检测x1
C:\Users\Zhang\Downloads\汽水音乐\Sodaqishui_514.msi » MSI » media1.cab » CAB » F_Exe1 » INNO » {app}\9wbuTJ\BfqfmJ9.e7 - a variant of Win64/Kryptik_AGen.AII trojan - deleted

aikafans

fsp

qishuiyinyue_x64.exe
HEUR/APC.Misc

Sodaqishui_514.msi
DR/AVI.Agent.wjngg

scottxzt

Trojan:Win32/Kepavll!rfn
containerfile: F:\汽水音乐\Sodaqishui_514.msi
另一个红色·对话框·很少见，不运行了

c199529

腾讯电脑管家18

---------------------
2026-4-23 06:09:05 MD5:9a124bcb83c8c8adf74038ee838c8284
汽水音乐\qishuiyinyue_x64.exe [Win32.Trojan.Loader.Ncnw]
2026-4-23 06:09:05 MD5:a4779f7225031276231871a5baeac3ba
汽水音乐\Sodaqishui_514.msi [Win64.Trojan.Agent.Vylw]
---------------------