不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/05/16
※2024/05/16 更新
マルウェア感染させると考えられるURLを検知（2024/05/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://jobs-servers[.]com/oorigg/univ[.]exe hxxp://doggie-services[.]com/oorigg/univ[.]exe hxxp://doggie-services[.]com/batushka/univ[.]exe hxxp://jobs-servers[.]com/batushka/univ[.]exe hxxp://miles-and-more-kreditkartes[.]com/oorigg/univ[.]exe |
GCleaner |
| URL | hxxp://266026cm[.]n9shteam3[.]top/geoDefaultsqllinuxgeneratorTesttrackDownloadsTemporary[.]php hxxp://jewokfweteto[.]skibiteamx[.]top/ProcessorDbtraffictrackdatalife[.]php hxxp://softworker[.]top/updateServerasyncTestdle[.]php hxxp://339380cm[.]n9shteam3[.]top/EternalImageRequestcpudefaultdbLinux[.]php |
DCRat |
| URL | hxxp://107[.]174[.]20[.]217/IjZxFT64[.]bin hxxp://107[.]174[.]20[.]217/ZkKIyzTq148[.]bin hxxp://162[.]245[.]190[.]151/uKIxwcyJdzpUB224[.]bin hxxp://146[.]70[.]79[.]44/DBpDL164[.]bin hxxp://64[.]188[.]27[.]210/XqKzVkST69[.]bin hxxp://185[.]222[.]58[.]62/yhefA244[.]bin hxxp://64[.]188[.]21[.]131/NqEjJf75[.]bin |
CloudEyE |
| URL | hxxp://192[.]3[.]239[.]30/25095/spoolsv[.]exe hxxp://192[.]3[.]239[.]30/xampp/cgoo/cgo/beautifulflowerwhenraiseinthevallytobeautiuflflowerraiseinthesunwithgreatthingstohappenedverycuterflowerraising___onsunrasiehappeningaround[.]doc hxxps://api[.]telegram[.]org/bot7138223592:AAGaNuEkiprPYfXz5P6AvY3zYkFOMOtNsXE/ |
Agent Tesla |
| URL | hxxp://5[.]42[.]96[.]7/lend/Kaxhwswfup[.]exe | SystemBC |
| URL | hxxp://5[.]42[.]96[.]7/lend/Windows[.]exe | Warzone RAT |
| URL | hxxp://mpgfth[.]xyz/blog/img1[.]jpg | Lumma Stealer |
| URL | hxxps://graupery[.]com[.]uy/BigProject[.]exe | RedLine Stealer |
| URL | hxxp://45[.]137[.]207[.]137/cbrbinaries/cbr[.]mips hxxp://45[.]137[.]207[.]137/cbr[.]mips hxxp://45[.]137[.]207[.]137/cbrbinaries/cbr[.]spc hxxp://45[.]137[.]207[.]137/cbrbinaries/cbr[.]mpsl hxxp://45[.]137[.]207[.]137/cbr[.]ppc hxxp://45[.]137[.]207[.]137/cbr[.]sh4 hxxp://45[.]137[.]207[.]137/cbrbinaries/cbr[.]sh4 hxxp://45[.]137[.]207[.]137/cbrbinaries/cbr[.]ppc hxxp://45[.]137[.]207[.]137/cbr[.]spc hxxp://45[.]137[.]207[.]137/cbr[.]mpsl |
Bashlite |
| URL | hxxps://60[.]204[.]133[.]143/activity hxxps://152[.]136[.]174[.]196/activity hxxp://176[.]32[.]35[.]104:82/load hxxp://176[.]32[.]35[.]104:8090/updates[.]rss hxxp://176[.]32[.]35[.]104:81/pixel hxxp://107[.]175[.]158[.]78/dot[.]gif hxxps://43[.]153[.]222[.]28:4545/updates[.]rss hxxp://43[.]153[.]222[.]28:433/dpixel hxxps://47[.]116[.]33[.]203/dot[.]gif hxxp://81[.]71[.]127[.]160:8888/cx hxxp://147[.]78[.]47[.]184:8092/ga[.]js hxxp://148[.]135[.]72[.]115:88/pixel hxxps://49[.]234[.]58[.]158/vendorReact[.]dc6a29[.]chunk[.]js hxxp://139[.]9[.]149[.]143:81/jquery-3[.]2[.]1[.]min[.]js hxxp://213[.]109[.]202[.]188/ptj hxxps://5[.]161[.]187[.]89/dot[.]gif hxxp://1[.]12[.]55[.]117/af/fgJds2U hxxps://1[.]12[.]55[.]117/af/fgJds2U hxxp://139[.]224[.]0[.]158:8069/fwlink hxxp://8[.]134[.]102[.]18:8081/pixel[.]gif hxxp://47[.]92[.]75[.]135/dot[.]gif hxxp://8[.]134[.]102[.]18:8282/ptj hxxp://154[.]12[.]31[.]24/match hxxps://113[.]142[.]27[.]102/feedapi/v1/newsserver/api/getpassword hxxps://111[.]63[.]149[.]104/analytics/v1_upload hxxps://61[.]240[.]220[.]53/feedapi/v1/newsserver/api/getusername hxxps://42[.]177[.]83[.]109/rewardsapp/ncfooter hxxps://113[.]194[.]50[.]172/analytics/v1_upload hxxp://107[.]172[.]61[.]115/j[.]ad hxxp://124[.]223[.]163[.]235/activity hxxp://42[.]192[.]67[.]154/updates[.]rss hxxp://43[.]128[.]43[.]17/load hxxps://172[.]245[.]79[.]26/updates[.]rss hxxp://107[.]172[.]60[.]23/ga[.]js hxxps://120[.]76[.]197[.]13/www/handle/doc hxxp://106[.]14[.]90[.]7/visit[.]js hxxp://47[.]99[.]151[.]38/cm hxxp://82[.]180[.]133[.]120/adsid/google/ui hxxps://support[.]meedicalabc[.]com/adsid/google/ui hxxp://94[.]156[.]68[.]92/load hxxp://91[.]92[.]245[.]161/dpixel hxxps://ace[.]cmicro[.]xyz/ca hxxps://service-5xpqvjqk-1320366142[.]gz[.]tencentapigw[.]com[.]cn/api/x hxxp://103[.]148[.]151[.]179:8081/api/v1/async/info hxxp://blmdiscount[.]com/Level/v3[.]82/1THWFWTJJ8 hxxps://blmdiscount[.]com/Level/v3[.]82/1THWFWTJJ8 |
Cobalt Strike |
| URL | hxxps://forgreatestgoal[.]site/bvxny6R6 hxxps://forgreatestgoal[.]site/8OtaBr/ |
ClearFake |
| URL | hxxp://asleman[.]org/2022/01/17/tattooing-from-home-laws-in-alberta-what-you-need-to-know hxxp://curecvc[.]com/oklahoma-street-legal-vehicle-requirements hxxps://catering-szafran[.]pl/manual[.]php hxxps://catalogodecosmetica[.]com/manual[.]php hxxps://calderconsultants[.]com/manual[.]php |
GootLoader |
| URL | hxxps://lamor[.]travelfuchsia[.]biz/ssl/crt[.]exe hxxp://dljdhsf[.]info/search/?q=67e28dd83859fa2b145ba44a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6289f812c0ec9d hxxp://ccudked[.]net/search/?q=67e28dd86d5ff17c1407ad1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa16c7ec95993d hxxp://ayucueo[.]ru/search/?q=67e28dd83f0bf1291606a9177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f171ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6289f918c4ec97 hxxp://ayucueo[.]ru/search/?q=67e28dd83f0bf1291606a9177c27d78406abdd88be4b12eab517aa5c96bd86ef9c844d895a8bbc896c58e713bc90c91836b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5e893933fce6d hxxp://bpgoijn[.]com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa16c6e6919e3a hxxp://bgtplfu[.]com/search/?q=67e28dd83d5fa62d1358fa4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6289f817c3eb94 hxxp://bghxyov[.]com/search/?q=67e28dd86d5cf57b120caf497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a371ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa16c7e996993b hxxp://bghxyov[.]com/search/?q=67e28dd86d5cf57b120caf497c27d78406abdd88be4b12eab517aa5c96bd86ec94834e885a8bbc896c58e713bc90c91936b5281fc235a925ed3e00d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909d3ccb6c9516 hxxp://cskawma[.]net/search/?q=67e28dd86e58fb2c465aad1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6289f812c6ec96 hxxp://cskawma[.]net/search/?q=67e28dd86e58fb2c465aad1d7c27d78406abdd88be4b12eab517aa5c96bd86e99d834b895a8bbc896c58e713bc90c91b36b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5e892993dce6c hxxp://cknncor[.]net/search/?q=67e28dd86c5cf27a4508ad177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa16c7ec93993b hxxp://cknncor[.]net/search/?q=67e28dd86c5cf27a4508ad177c27d78406abdd88be4b12eab517aa5c96bd86ec938344805a8bbc896c58e713bc90c91836b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909d3cce699516 hxxp://aquauop[.]ru/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6289f818c6ec94 hxxp://aquauop[.]ru/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86e992854d845a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5e892933dce6e hxxp://bptoiyb[.]com/search/?q=67e28dd83f5aa4794209ff1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa16c7e693993b hxxp://bptoiyb[.]com/search/?q=67e28dd83f5aa4794209ff1c7c27d78406abdd88be4b12eab517aa5c96bd86e893864a825a8bbc896c58e713bc90c91d36b5281fc235a925ed3e01d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909d3cc4699516 hxxp://bubhfeg[.]com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6289f713c3ec97 hxxp://ddqeypd[.]info/search/?q=67e28dd86d0ca420440ef91f7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f671ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa16c8ed96993b hxxp://dieduaq[.]info/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6289f715c7ec97 hxxp://bhtmwou[.]com/search/?q=67e28dd83e5cfa2f440afa1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa16c8eb92993a |
Socks5 Systemz |
| URL | hxxps://tumanovalekcey[.]github[.]io/tum/888[.]exe | Coinminer |
| URL | hxxps://qofik[.]location[.]oysterfloats[.]us/editContent | FAKEUPDATES |
| URL | hxxp://sempersim[.]su/d3/fre[.]php hxxp://45[.]90[.]57[.]51/big/five/fre[.]php |
LokiBot |
