(2x) #银狐 #FakeApp #汽水音乐

LingGao

Dear all,

(2x) #银狐 #FakeApp #汽水音乐
VirusTotal 均首传

Ling Gao 通过 QQ 闪传分享了【汽水音乐.zip】
链接：https://qfile.qq.com/q/x2os9XEwYC
infected

1. qishuiyinyue_x64.exe
SHA256: f57d9e5f927737880161b692ad6227f9b3e463632e6f819032f0888c840f790a
VT 6: virustotal.com/gui/file/f57d9e5f927737880161b692ad6227f9b3e463632e6f819032f0888c840f790a

(从 hxxps://www[.]qishuiapp[.]com[.]cn -> hxxps://alibaba-cloud-azhi-oss[.]com/down[.]php/2b35c9488425728b2771f6950683740c[.]zip 下载)

---

2. Sodaqishui_514.msi
SHA256: c1d1d488ed4d0a69213c5c2c1d04dafe14dc2a95107523f6facb3a050745fa9f
VT 8: virustotal.com/gui/file/c1d1d488ed4d0a69213c5c2c1d04dafe14dc2a95107523f6facb3a050745fa9f

(从 hxxps://qi-qishuimusic[.]com[.]cn -> hxxps://uiejnnd[.]huzero[.]com/yinyueqishui14[.]1A[.]zip 下载)

谢谢！

fdsax

bd双击2x

jxfaiu

双击

嘿嘿不能说

1. D:\测试\汽水音乐\Sodaqishui_514.msi        木马程序(Trojan.Generic)        已删除
   
2. 
   
3. 2026-04-20 09:36:48     感染型病毒(Win32/Heur.Generic.HxQB0WkA)MD5:f63923e9971dfaa73d02a2891d8c9661已删除此文件，如果您发现误删，可从隔离区恢复此文件。        d:\测试\汽水音乐\qishuiyinyue_x64.exe

复制代码

MrDeep

Sodaqishui_514.msi
a variant of Win64/Kryptik_AGen.AII