不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様4社 -
2025/03/18
※2025/03/18 更新
マルウェア感染させると考えられるURLを検知（2025/03/18）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://u1[.]creasingzen[.]shop/q26p14do4t[.]mp3 hxxps://u1[.]creasingzen[.]shop/2fk5rh1yzf[.]mp3 hxxps://u1[.]creasingzen[.]shop/h2irz9x3rw[.]mp3 hxxps://u1[.]creasingzen[.]shop/id4q2est7o[.]mp3 hxxps://u1[.]creasingzen[.]shop/iya9doxvyo[.]mp3 hxxps://check[.]xujamio2[.]icu/gkcxv[.]google hxxps://u1[.]creasingzen[.]shop/w2x0x25h6z[.]mp3 hxxps://u1[.]creasingzen[.]shop/j48ciaj4b6[.]mp3 hxxps://check[.]telavya8[.]icu/gkcxv[.]google hxxps://u1[.]creasingzen[.]shop/7nznwwx25z[.]mp3 hxxps://u1[.]creasingzen[.]shop/p4rx7rdy1n[.]mp3 hxxps://check[.]xemyrai6[.]icu/gkcxv[.]google hxxps://u1[.]creasingzen[.]shop/pbpqupdhww[.]mp3 hxxps://u1[.]creasingzen[.]shop/6vptyva42j[.]mp3 hxxps://u1[.]resolutestumble[.]shop/xh1o7h8uqt[.]mp3 hxxps://u1[.]resolutestumble[.]shop/wfj5jdyj7c[.]mp3 hxxps://u1[.]resolutestumble[.]shop/u7psgzbe5t[.]mp3 hxxps://u1[.]resolutestumble[.]shop/h0wxxtmlw3[.]mp3 hxxps://u1[.]resolutestumble[.]shop/dbdylaxck2[.]mp3 hxxps://u1[.]resolutestumble[.]shop/zobrw74l2f[.]mp3 hxxps://u1[.]resolutestumble[.]shop/uiep0jysop[.]mp3 hxxps://u1[.]resolutestumble[.]shop/t4ui3n5lbf[.]mp3 hxxps://u1[.]resolutestumble[.]shop/oitpu2xkps[.]mp3 hxxps://u1[.]resolutestumble[.]shop/zborzr7ljj[.]mp3 |
ClearFake |
| URL | hxxp://176[.]113[.]115[.]58/yXNwKVfkS28Y/index[.]php hxxp://176[.]113[.]115[.]58/yXNwKVfkS28Y/Login[.]php hxxp://159[.]100[.]14[.]208/jb87ejvjdsS/index[.]php hxxp://159[.]100[.]14[.]208/jb87ejvjdsS/Login[.]php |
Amadey |
| URL | hxxps://caliberc[.]life/api hxxps://7selfdefens[.]bet/api hxxps://github[.]com/1tthens1/PMI/raw/refs/heads/main/DEVM27[.]exe hxxps://github[.]com/1tthens1/PMI/raw/1eeab13f000cb24c5521811d29443cece3068713/DEVM25[.]exe hxxps://goholiday[.]run/api hxxps://legistaiteo[.]world/api hxxps://expldore[.]run/api hxxps://armoryacumen[.]run/api hxxps://marksmanm[.]today/api hxxps://shootforyou[.]world/api hxxps://gunpolicy[.]today/api hxxps://firearmfab[.]world/api hxxps://shootef[.]world/api hxxps://escapade[.]bet/api hxxps://adcventr[.]life/api hxxps://gunsmith[.]bet/api hxxps://taramigo[.]life/api hxxps://pupmeholk[.]bet/api hxxps://shootings[.]life/api hxxps://weaponswh[.]run/api hxxps://gunhandl[.]today/api |
Lumma Stealer |
| URL | hxxps://api[.]telegram[.]org/bot7804963747:AAHu7pkrGEG_WytLPrtHrO9KwjFVZC2s1oQ/sendMessage?chat_id=7249492547 hxxp://198[.]12[.]89[.]24/312/cosse[.]exe hxxps://api[.]telegram[.]org/bot6994566592:AAFG5oUMwauAlVnA9DMcHpYhgeZxbCERK9s/sendMessage?chat_id=7094129633 hxxps://api[.]telegram[.]org/bot7222288618:AAHmjWFpZ08g76_6xr4NgmiN7PynC_nQC7Y/sendMessage?chat_id=7941708421 hxxps://api[.]telegram[.]org/bot7265039693:AAEgBQWh2zD6Y0qjiHnF71BlD3yWIMzprMM/sendMessage?chat_id=7886581547 hxxps://api[.]telegram[.]org/bot7240961293:AAFAgMkEDNSUcrYvtV0PPQzIbvMO0u6bMRs/sendMessage?chat_id=5061956073 hxxps://api[.]telegram[.]org/bot7565163328:AAEI42F9nmxA2bdpLTl_vY3TZxtR7wYL_eY/sendMessage?chat_id=6931313421 hxxps://api[.]telegram[.]org/bot7703889528:AAEgXQBfekOEEj5rCxJhfRJIhjZnvNaYBl8/sendMessage?chat_id=2117893104 hxxps://api[.]telegram[.]org/bot8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM/sendMessage?chat_id=5521168189 hxxps://api[.]telegram[.]org/bot7510901185:AAEaNMHbnFNUALyMNDM6DBXd5YExpBwIHTQ/sendMessage?chat_id=1695799026 |
Snake Keylogger |
| URL | hxxps://paulsss[.]com/1q2w[.]js hxxps://vononline[.]com/3e4r[.]js hxxps://vononline[.]com/js[.]php hxxps://opteme[.]com/js[.]php hxxps://opteme[.]com/4r6t[.]js hxxps://login[.]icvpartners[.]com/profileLayout |
FAKEUPDATES |
| URL | hxxps://65[.]21[.]118[.]116/7b10d5d78fdd0/p09qs22q[.]4xr9s hxxps://asp[.]hankeringcrestedwrist[.]shop/54f93e4c9e4b381833ea400527326dbe |
Rhadamanthys |
| URL | hxxp://198[.]12[.]89[.]24/346/cosses[.]exe hxxp://198[.]12[.]89[.]24/xampp/efv/niceworkingskillgivenmebest[.]hta |
MASS Logger |
| URL | hxxp://192[.]159[.]99[.]27/rrzogcvDo253[.]bin hxxp://192[.]159[.]99[.]27/kFYAJQJIElmTMMb95[.]bin |
CloudEyE |
| URL | hxxps://remustarofilac[.]com/test/ | Latrodectus |
| URL | hxxp://ctrlgem[.]xyz/gate[.]php | Arkei Stealer |
| URL | hxxp://342613cm[.]nyashk[.]ru/PythonphpApiwp[.]php hxxp://fdgfddgfgfdgfddfggfdfho[.]ru/Pipepacketwindows[.]php |
DCRat |
| URL | hxxp://pink900g[.]xyz/cl hxxp://pink900g[.]xyz/sb hxxp://pink900g[.]xyz/sl hxxp://pink900g[.]xyz/cb |
Pink |
| URL | hxxp://185[.]165[.]29[.]116/doncha22/02/gate[.]php | Pony |
| URL | hxxps://alt-check-v3[.]com/j8oGN6XCdTtHqFVq[.]html hxxp://92[.]255[.]85[.]2/b[.]mp4 hxxps://old[.]ivanoviplus[.]com/redirect[.]php?redirect=hxxps://boxiesreservguste[.]com hxxps://alt-check-v3[.]com/gamTCuxm3euyWmAL[.]html hxxp://92[.]255[.]85[.]2/a[.]mp4 hxxp://92[.]255[.]85[.]2/cmd-bat |
XWorm |
| URL | hxxp://92[.]255[.]85[.]2/pq[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/2lzb9irl819[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/5q6j2p071qo[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/hxpoefpwus[.]exe |
AsyncRAT |
| URL | hxxp://198[.]98[.]48[.]4:8000/kworker | Vshell |
| URL | hxxp://176[.]65[.]144[.]14:8000/bins/rql5j8sfus[.]bin hxxp://176[.]65[.]144[.]14:8000/bins/g2avnv1osnr[.]bin hxxp://176[.]65[.]144[.]14:8000/bins/v8k7h0kbg[.]bin hxxp://176[.]65[.]144[.]14:8000/bins/xl29xsw10j[.]bin hxxp://176[.]65[.]144[.]14:8000/bins/8yfgu68jb05[.]bin hxxp://176[.]65[.]144[.]14:8000/bins/rluw8gys7t[.]bin hxxp://176[.]65[.]144[.]14:8000/bins/tvqj8m3uev9[.]bin |
donut_injector |
| URL | hxxp://176[.]65[.]144[.]14:8000/exe/iyj01phbm9h[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/4yx3rtukqdu[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/8k192cky7a5[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/fs5p0dpmnsi[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/qh8i8y7jzml[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/pzwax7v4y3p[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/1w2zj9q9aky[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/t4owrsgni3[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/btuh5w1ff8n[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/x769kwpjldk[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/xvi43yqgo4j[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/0meqlsp1qfea[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/0i9e4czutzsl[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/ga0w9shjpkc[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/ecpnvklgsx6[.]exe hxxp://176[.]65[.]144[.]14:8000/exe/vlqzaznzan[.]exe |
Quasar RAT |
