不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/03/19
※2025/03/19 更新
マルウェア感染させると考えられるURLを検知（2025/03/19）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://103[.]77[.]246[.]204/x-8[.]6-[.]Sakura hxxp://103[.]77[.]246[.]204/a-r[.]m-4[.]Sakura hxxp://103[.]77[.]246[.]204/a-r[.]m-5[.]Sakura hxxp://103[.]77[.]246[.]204/m-6[.]8-k[.]Sakura hxxp://103[.]77[.]246[.]204/m-p[.]s-l[.]Sakura hxxp://103[.]77[.]246[.]204/x-3[.]2-[.]Sakura hxxp://103[.]77[.]246[.]204/a-r[.]m-6[.]Sakura hxxp://103[.]77[.]246[.]204/m-i[.]p-s[.]Sakura hxxp://103[.]77[.]246[.]204/p-p[.]c-[.]Sakura hxxp://103[.]77[.]246[.]204/s-h[.]4-[.]Sakura hxxp://103[.]77[.]246[.]204/a-r[.]m-7[.]Sakura hxxp://103[.]77[.]246[.]204/i-5[.]8-6[.]Sakura |
Bashlite |
| URL | hxxp://198[.]46[.]132[.]226/xampp/seen/verynicewomenformygirlfriend[.]hta hxxp://stakloram[.]rs/css/abx[.]txt hxxp://invoice-docs-file[.]site/Downloads/ad[.]js hxxp://invoice-docs-file[.]site/Downloads/g2m[.]dll hxxps://elaajsupport[.]com/n/url/uploads/my[.]zip hxxps://elaajsupport[.]com/n/url/uploads/ad[.]zip hxxps://elaajsupport[.]com/n/url/uploads/cl[.]zip hxxp://141[.]98[.]10[.]154/xampp/kk/ll[.]hta hxxp://invoice-docs-file[.]site/Downloads/file[.]js |
Remcos |
| URL | hxxps://battlefie[.]shop/api hxxps://preoductpark[.]icu/dJWIn hxxps://1pistolpra[.]bet/api hxxps://0explorebieology[.]run/api hxxps://84moderzysics[.]top/api hxxps://ucodxefusion[.]top/api hxxps://qjowinjoinery[.]icu/api hxxps://rlegenassedk[.]top/api hxxps://12partparcadi[.]shop/api hxxps://5bugildbett[.]top/api hxxp://chillyhiss[.]update-checker-status[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://chillyhiss[.]update-checker-status[.]cc/1337/TORRENTOLD-1[.]exe hxxp://chillyhiss[.]update-checker-status[.]cc/update/TPB-1[.]exe hxxp://fox-news-checker[.]cc/update/TPB-1[.]exe hxxp://fox-news-checker[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://win-network-checker[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://utorrent-server-api[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://utorrent-server-api[.]cc/update/TPB-1[.]exe hxxp://security-service-api-link[.]cc/1337/TORRENTOLD-1[.]exe hxxp://update-checker-status[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://security-service-api-link[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://87[.]121[.]84[.]254/update/TPB-1[.]exe hxxp://microsoft-auth-network[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://microsoft-auth-network[.]cc/1337/TORRENTOLD-1[.]exe hxxp://87[.]121[.]84[.]254/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://87[.]121[.]84[.]254/1337/TORRENTOLD-1[.]exe hxxps://travelio[.]digital/api hxxps://rarmoryarch[.]shop/api hxxps://r11htardwarehu[.]icu/api hxxps://qgaragedrootz[.]top/api hxxps://fvpistolpra[.]bet/api hxxps://vmrodularmall[.]top/api hxxps://7moderzysics[.]top/api hxxps://asterpickced[.]digital/api hxxps://6garagedrootz[.]top/api hxxps://ukbegindecafer[.]world/api hxxps://boltetuurked[.]digital/api hxxps://targetsand[.]shop/api hxxps://1cmodelshiverd[.]icu/api hxxps://garulouscuto[.]com/api hxxps://ifostinjec[.]today/api hxxps://fcaliberc[.]today/api hxxps://kfostinjec[.]today/api hxxps://wmrodularmall[.]top/api hxxps://3defaulemot[.]run/api hxxps://pfeatureccus[.]shop/api hxxps://6selfdefens[.]bet/api hxxps://pcatterjur[.]run/api hxxps://bshootforyou[.]world/api hxxps://adecorathnome[.]icu/api hxxps://dziorangemyther[.]live/api hxxps://0kulihase[.]digital/api hxxps://ogaragedrootz[.]top/api hxxps://omoderzysics[.]top/api hxxps://mgaragedrootz[.]top/api hxxps://5modelshiverd[.]icu/api hxxps://4armamenti[.]world/api hxxps://nblast-hubs[.]com/api hxxps://iorangemyther[.]live/api hxxps://2blastikcn[.]com/api hxxps://sorangemyther[.]live/api hxxps://lgaragedrootz[.]top/api hxxps://rnmrodularmall[.]top/api hxxps://cfostinjec[.]today/api hxxps://lguncontrold[.]shop/api hxxps://7mrodularmall[.]top/api hxxps://ecatterjur[.]run/api hxxps://3xbreedertremnd[.]com/api hxxps://lfostinjec[.]today/api hxxps://zweaponrywo[.]digital/api hxxps://cmenuedgarli[.]shop/api hxxps://karisechairedd[.]shop/api hxxps://ldefaulemot[.]run/api hxxps://euncertainyelemz[.]bet/api hxxps://sfeatureccus[.]shop/api hxxps://74citydisco[.]bet/api hxxps://g9mrodularmall[.]top/api hxxps://8catterjur[.]run/api hxxps://jfeatureccus[.]shop/api hxxps://planenailke[.]top/api hxxps://mcodxefusion[.]top/api hxxps://kzteamprokla1[.]shop/api hxxps://f-fostinjec[.]today/api hxxps://s[.]farfinable[.]top/api hxxps://lbugildbett[.]top/api hxxps://vforangemyther[.]live/api hxxps://bookwormstop[.]top/api hxxps://cgaragedrootz[.]top/api hxxps://zghtardwarehu[.]icu/api hxxps://sfostinjec[.]today/api hxxps://2agroecologyguide[.]digital/api hxxps://9mrodularmall[.]top/api hxxps://w-crosshairc[.]life/api hxxps://9codxefusion[.]top/api hxxps://inestlecompany[.]world/api hxxps://uwildlnifeecho[.]world/api hxxps://2dsfljsdfjewf[.]info/api hxxps://gbuncertainyelemz[.]bet/api hxxps://hbtechspherxe[.]top/api hxxps://zjowinjoinery[.]icu/api hxxps://stgellar[.]shop/api hxxps://rsterpickced[.]digital/api hxxps://fhobbyedsmoker[.]live/api hxxps://jorangemyther[.]live/api hxxps://qfarfinable[.]top/api hxxps://a4qmodelshiverd[.]icu/api hxxps://qgadgethgfub[.]icu/api hxxps://ebugildbett[.]top/api hxxps://rlatchclan[.]shop/api hxxps://nfeatureccus[.]shop/api hxxps://tweaponwo[.]life/api hxxps://dgaragedrootz[.]top/api hxxps://hsetfupstore[.]icu/api hxxps://6begindecafer[.]world/api hxxps://yexplorebieology[.]run/api hxxps://3kp2orangemyther[.]live/api hxxps://sdecreaserid[.]world/api hxxps://pirtyoffensiz[.]bet/api hxxps://4dsfljsdfjewf[.]info/api hxxps://1playrfulpals[.]digital/api hxxps://3sterpickced[.]digital/api hxxps://4seedsxouts[.]shop/api hxxps://xjowinjoinery[.]icu/api hxxps://kcatterjur[.]run/api hxxps://0qcrosshairc[.]life/api hxxps://kudecreaserid[.]world/api hxxps://xarisechairedd[.]shop/api hxxps://fdecorathnome[.]icu/api hxxps://cgadgethgfub[.]icu/api hxxps://sselfdefens[.]bet/api hxxps://urbanodys[.]top/api hxxps://7legenassedk[.]top/api hxxps://dlegenassedk[.]top/api hxxps://2htardwarehu[.]icu/api hxxps://1governoagoal[.]pw/api hxxps://chtardwarehu[.]icu/api hxxps://wcjlaspcorne[.]icu/api hxxps://dhtardwarehu[.]icu/api hxxps://vcjlaspcorne[.]icu/api hxxps://mbugildbett[.]top/api hxxps://obegindecafer[.]world/api hxxps://rmetropoli[.]shop/api hxxps://2cjlaspcorne[.]icu/api hxxps://gearthsymphzony[.]today/api hxxps://oweaponwo[.]life/api hxxps://rmodelshiverd[.]icu/api hxxps://ewbugildbett[.]top/api hxxps://ghcjlaspcorne[.]icu/api hxxps://whmodelshiverd[.]icu/api hxxps://zquietswtreams[.]life/api hxxps://0latchclan[.]shop/api hxxps://es-dgtese[.]top/api hxxps://uarisechairedd[.]shop/api hxxps://htracnquilforest[.]life/api hxxps://kmrodularmall[.]top/api hxxps://8pastedeputten[.]life/api hxxps://jsterpickced[.]digital/api hxxps://npausedcritiaca[.]fun/api hxxps://zbegindecafer[.]world/api hxxps://1begindecafer[.]world/api hxxps://hmodelshiverd[.]icu/api hxxps://4featureccus[.]shop/api hxxps://8htardwarehu[.]icu/api hxxps://yselfdefens[.]bet/api hxxps://8mweteorm[.]top/api hxxps://f3garagedrootz[.]top/api hxxps://zsfostinjec[.]today/api hxxps://hmrodularmall[.]top/api hxxps://9techspherxe[.]top/api hxxps://xhardswarehub[.]today/api hxxps://scropcircleforum[.]today/api hxxps://9caliberc[.]today/api hxxps://0begindecafer[.]world/api hxxps://kzteamprokla2[.]shop/api hxxps://kacatterjur[.]run/api hxxps://farewellnzu[.]icu/api hxxps://2hardrwarehaven[.]run/api hxxps://qcrosshairc[.]life/api hxxps://e6mrodularmall[.]top/api hxxps://dwjowinjoinery[.]icu/api hxxps://6latchclan[.]shop/api hxxps://ntechspherxe[.]top/api hxxps://wurbaninsi[.]top/api hxxps://1loadoutle[.]life/api hxxps://7catterjur[.]run/api hxxps://qdefaulemot[.]run/api hxxps://jgaragedrootz[.]top/api hxxps://f3htardwarehu[.]icu/api hxxps://munitions[.]life/api hxxps://aarmamenti[.]world/api hxxps://2techspherxe[.]top/api hxxps://psterpickced[.]digital/api hxxps://uhtardwarehu[.]icu/api hxxps://fweaponrywo[.]digital/api hxxps://kgaragedrootz[.]top/api hxxps://dfeatureccus[.]shop/api hxxps://x1vgaragedrootz[.]top/api hxxps://6defaulemot[.]run/api hxxps://jqdefaulemot[.]run/api hxxps://ucatterjur[.]run/api hxxps://iastralconnec[.]icu/api hxxps://cclassyhelped[.]net/api hxxps://wsterpickced[.]digital/api hxxps://8klegenassedk[.]top/api hxxps://yorangemyther[.]live/api hxxps://4exoprlanet[.]digital/api hxxps://7sterpickced[.]digital/api hxxps://mseedsxouts[.]shop/api hxxps://lsterpickced[.]digital/api hxxps://lastralconnec[.]icu/api hxxps://pbegindecafer[.]world/api hxxps://grelaxingxpillow[.]digital/api hxxps://dsterpickced[.]digital/api hxxps://gtechspherxe[.]top/api hxxps://parisechairedd[.]shop/api hxxps://hskylinejo[.]world/api hxxps://tvomenuedgarli[.]shop/api hxxps://9crosshairc[.]life/api hxxps://soqulfonections[.]tech/api hxxps://2crosshairc[.]life/api hxxps://5explorebieology[.]run/api hxxps://3fostinjec[.]today/api hxxps://ephygcsforum[.]life/api hxxps://fdefaulemot[.]run/api hxxps://rarmamenti[.]world/api hxxps://tpistolpra[.]bet/api hxxps://cweaponrywo[.]digital/api hxxps://l4garagedrootz[.]top/api hxxps://growtesitte[.]life/api hxxps://5orangemyther[.]live/api hxxps://8jpsterpickced[.]digital/api hxxps://abegindecafer[.]world/api hxxps://ofeatureccus[.]shop/api hxxps://tweaponrywo[.]digital/api hxxps://mlatchclan[.]shop/api hxxps://jcrosshairc[.]life/api hxxps://jcatterjur[.]run/api hxxps://7defaulemot[.]run/api hxxps://3vjowinjoinery[.]icu/api hxxps://cafostinjec[.]today/api hxxps://rweaponrywo[.]digital/api hxxps://4jowinjoinery[.]icu/api hxxps://hcatterjur[.]run/api hxxps://322orangemyther[.]live/api hxxps://6hseedsxouts[.]shop/api hxxps://4urbanexp[.]digital/api hxxps://ypistolpra[.]bet/api hxxps://5sterpickced[.]digital/api hxxps://ijowinjoinery[.]icu/api hxxps://s-cjlaspcorne[.]icu/api hxxps://iarisechairedd[.]shop/api hxxps://2dcousidporke[.]icu/api hxxps://khekgaragedrootz[.]top/api hxxps://7featureccus[.]shop/api hxxps://yjowinjoinery[.]icu/api hxxps://swammelohare[.]top/api hxxps://xtmrodularmall[.]top/api hxxps://2jowinjoinery[.]icu/api hxxps://wujowinjoinery[.]icu/api hxxps://9weaponrywo[.]digital/api hxxps://ycjlaspcorne[.]icu/api hxxps://varisechairedd[.]shop/api hxxps://8jowinjoinery[.]icu/api hxxps://aquietswtreams[.]life/api hxxps://3latchclan[.]shop/api hxxps://igadgethgfub[.]icu/api hxxps://acrosshairc[.]life/api hxxps://facitydisco[.]bet/api hxxps://jbugildbett[.]top/api hxxps://oagroecologyguide[.]digital/api hxxps://2citydisco[.]bet/api hxxps://tgaragedrootz[.]top/api hxxps://dxkushha[.]com/api hxxps://bhtardwarehu[.]icu/api hxxp://moderzysics[.]top/api hxxps://bbegindecafer[.]world/api hxxps://aarisechairedd[.]shop/api hxxps://mweaponrywo[.]digital/api hxxps://0arisechairedd[.]shop/api hxxps://rblackeblast[.]run/api hxxps://xfeatureccus[.]shop/api hxxps://fblackeblast[.]run/api hxxps://gunownersg[.]top/api hxxps://giarmamenti[.]world/api hxxps://edsimensio[.]bet/api hxxps://hcjlaspcorne[.]icu/api hxxps://6earthsymphzony[.]today/api hxxps://hpsterpickced[.]digital/api hxxps://qiastralconnec[.]icu/api hxxps://ggaragedrootz[.]top/api hxxps://3citydisco[.]bet/api hxxps://gpinfuzoriatufelka[.]com/api hxxps://4borangemyther[.]live/api hxxps://lyorangemyther[.]live/api hxxps://6fostinjec[.]today/api hxxps://8arisechairedd[.]shop/api hxxps://hbgaragedrootz[.]top/api hxxps://2puillowjourney[.]icu/api hxxps://odefaulemot[.]run/api hxxps://9begindecafer[.]world/api hxxps://elegenassedk[.]top/api hxxps://8legenassedk[.]top/api hxxps://thtardwarehu[.]icu/api hxxps://wlegenassedk[.]top/api hxxps://zmrodularmall[.]top/api hxxps://pmrodularmall[.]top/api hxxps://6importenptoc[.]com/api hxxps://nfostinjec[.]today/api hxxps://presentymusse[.]world/api hxxps://l0legenassedk[.]top/api hxxps://wseedsxouts[.]shop/api hxxps://2catterjur[.]run/api hxxps://vbreedertremnd[.]com/api hxxps://2bugildbett[.]top/api hxxps://cdecreaserid[.]world/api hxxps://hloadoutle[.]life/api hxxps://cseedsxouts[.]shop/api hxxps://farmfreshideas[.]digital/api hxxps://zcjlaspcorne[.]icu/api hxxps://6astralconnec[.]icu/api hxxps://xcircujitstorm[.]bet/api hxxps://warisechairedd[.]shop/api hxxps://0fostinjec[.]today/api hxxps://ajarisechairedd[.]shop/api hxxps://7zlatchclan[.]shop/api hxxps://tsterpickced[.]digital/api hxxps://jcodxefusion[.]top/api hxxps://xcatterjur[.]run/api hxxps://ecrosshairc[.]life/api hxxps://cousidporke[.]icu/api hxxps://xselfdefens[.]bet/api |
Lumma Stealer |
| URL | hxxps://topflowow[.]top/ZmU2YzQ2NjZlNjc2/ | Coper |
| URL | hxxps://opteme[.]com/1q2w[.]js hxxps://kimjohan[.]com/js[.]php hxxps://kimjohan[.]com/1q2w[.]js hxxps://training[.]preschoolproblems[.]com/profileLayout hxxps://exchange[.]tuckx[.]com/profileLayout |
FAKEUPDATES |
| URL | hxxp://961570cm[.]nyashk[.]ru/ProvidervmProcessorBigloadwordpressDlePublicTempUploads[.]php hxxp://697580cm[.]nyashk[.]ru/LinePolllowProcessorTraffictempcentraluploadstemporary[.]php |
DCRat |
| URL | hxxp://eficienciaeningenieria[.]com[.]mx/ngbee/ngqabn[.]exe hxxp://176[.]65[.]144[.]3/dev/DEV[.]exe hxxp://176[.]65[.]144[.]3/dev/bbelieve[.]exe hxxp://176[.]65[.]144[.]3/dev/devil[.]ps1 |
Agent Tesla |
| URL | hxxp://196[.]251[.]115[.]212/sh | Coinminer |
| URL | hxxps://api[.]telegram[.]org/bot7893130484:AAHZ9_1mVZgB9YkPIOotyMcA_NuzO0RybM0/sendMessage?chat_id=7886581547 hxxp://eficienciaeningenieria[.]com[.]mx/ngeeto/edxuin[.]exe hxxps://api[.]telegram[.]org/bot7341566981:AAH_QhKPgpHvD4E-8Yu-Ykq_swRA6fRW7TE/sendMessage?chat_id=7564846096 hxxps://api[.]telegram[.]org/bot7617051354:AAFrK85WiKexPD3DPywzlZaNaKqBnfNLHpg/sendMessage?chat_id=7000018009 hxxps://api[.]telegram[.]org/bot7876749337:AAF0i4ZoyGf4tE2zVqihoZaQsewrLTGkYe8/sendMessage?chat_id=6784063670 |
Snake Keylogger |
| URL | hxxp://j4b2[.]icu/TL341/index[.]php | Azorult |
| URL | hxxps://planachiever[.]au/admin-admin/bPeMVYr142[.]bin hxxps://planachiever[.]au/admin-admin/Belejrers[.]fla |
CloudEyE |
| URL | hxxps://u1[.]resolutestumble[.]shop/tai12uht8k[.]mp3 hxxps://check[.]inea3[.]icu/gkcxv[.]google hxxps://check[.]qusixoy6[.]icu/gkcxv[.]google hxxps://u1[.]resolutestumble[.]shop/oxsjf61gv4[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/cytnooxn5a[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/38xbljpbqa[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/qf26bnvjuf[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/tx8vxzdl7g[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/25uy9cdsx6[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/cpi15aoetg[.]mp3 hxxps://check[.]abye7[.]icu/gkcxv[.]google hxxps://u1[.]tweeddisparity[.]shop/dnlqquzcxd[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/lvzx8k08ao[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/gkfn4qv15m[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/di0j15lug9[.]mp3 hxxps://check[.]opie6[.]icu/gkcxv[.]google hxxps://u1[.]tweeddisparity[.]shop/bwgqx9ytyv[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/ommtiz4z00[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/dtbpfyk9n5[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/wva46jjwhr[.]mp3 hxxps://u1[.]tweeddisparity[.]shop/tqevevk1rn[.]mp3 hxxps://check[.]etau0[.]icu/gkcxv[.]google hxxps://u1[.]tweeddisparity[.]shop/2eexnbqa8s[.]mp3 |
ClearFake |
| URL | hxxps://iran-bitumen[.]com/wp-imported/Crypt%20B[.]dll hxxps://iran-bitumen[.]com/wp-imported/NoCrypt[.]dll hxxps://iran-bitumen[.]com/wp-imported/Crypt%20C[.]dll hxxps://iran-bitumen[.]com/wp-imported/Crypt%20A%20x64[.]dll hxxps://iran-bitumen[.]com/wp-imported/Crypt%20A%20x32[.]dll |
DanaBot |
| URL | hxxp://185[.]147[.]125[.]81:9000/simpledownload/watcher[.]bin | donut_injector |
| URL | hxxps://api[.]telegram[.]org/bot1616004787:AAH60oNqVa82nffKp0gB2yn5A_jmiTy0_XY/sendMessage?chat_id= | Stealerium |
| URL | hxxp://89[.]23[.]107[.]240:7777/confirmm2[.]com/Capcha | Emmenhtal |
| URL | hxxps://194[.]116[.]214[.]153/6b0f5eaa14a7f807/sqlite3[.]dll hxxps://194[.]116[.]214[.]153/6b0f5eaa14a7f807/vcruntime140[.]dll hxxps://194[.]116[.]214[.]153/6b0f5eaa14a7f807/mozglue[.]dll hxxps://185[.]196[.]9[.]140/9574584b66fd42a8/vcruntime140[.]dll hxxps://185[.]196[.]9[.]140/9574584b66fd42a8/mozglue[.]dll hxxps://185[.]196[.]9[.]140/9574584b66fd42a8/sqlite3[.]dll hxxps://195[.]10[.]205[.]117/d308e86880289517/vcruntime140[.]dll hxxps://195[.]10[.]205[.]117/d308e86880289517/mozglue[.]dll hxxps://213[.]209[.]150[.]220/263ff79562167f22/mozglue[.]dll hxxps://195[.]10[.]205[.]117/d308e86880289517/sqlite3[.]dll hxxps://213[.]209[.]150[.]220/263ff79562167f22/sqlite3[.]dll hxxps://213[.]209[.]150[.]220/263ff79562167f22/vcruntime140[.]dll hxxps://95[.]216[.]112[.]83/5840871afdb84f06/sqlite3[.]dll hxxps://95[.]216[.]112[.]83/5840871afdb84f06/mozglue[.]dll hxxps://185[.]247[.]184[.]7/b00dc1fe53045ca1/sqlite3[.]dll hxxps://179[.]43[.]162[.]2/3461133978273cb9/sqlite3[.]dll hxxps://179[.]43[.]162[.]2/3461133978273cb9/vcruntime140[.]dll hxxps://179[.]43[.]162[.]2/3461133978273cb9/mozglue[.]dll hxxps://146[.]70[.]161[.]51/58d66e64beb49702/vcruntime140[.]dll hxxps://146[.]70[.]161[.]51/58d66e64beb49702/sqlite3[.]dll hxxps://146[.]70[.]161[.]51/58d66e64beb49702/mozglue[.]dll hxxps://185[.]215[.]113[.]214/0d60be0de163924d/sqlite3[.]dll hxxps://185[.]215[.]113[.]214/0d60be0de163924d/mozglue[.]dll hxxps://185[.]215[.]113[.]214/0d60be0de163924d/vcruntime140[.]dll hxxps://5[.]188[.]87[.]42/6cbff507d3fb9f0d/mozglue[.]dll hxxps://82[.]115[.]223[.]38/013b21cbc9e3ff58/mozglue[.]dll hxxps://82[.]115[.]223[.]38/013b21cbc9e3ff58/vcruntime140[.]dll hxxps://62[.]204[.]41[.]177/db293a2c1b1c70c4/mozglue[.]dll hxxps://62[.]204[.]41[.]150/db293a2c1b1c70c4/sqlite3[.]dll hxxps://62[.]204[.]41[.]177/db293a2c1b1c70c4/vcruntime140[.]dll hxxps://62[.]122[.]184[.]145/00122117a2c73c51/vcruntime140[.]dll hxxps://62[.]122[.]184[.]145/00122117a2c73c51/sqlite3[.]dll hxxps://62[.]122[.]184[.]111/00122117a2c73c51/sqlite3[.]dll hxxps://62[.]122[.]184[.]111/00122117a2c73c51/vcruntime140[.]dll hxxps://62[.]122[.]184[.]145/00122117a2c73c51/mozglue[.]dll hxxps://62[.]122[.]184[.]111/00122117a2c73c51/mozglue[.]dll hxxps://82[.]115[.]223[.]38/013b21cbc9e3ff58/sqlite3[.]dll hxxps://62[.]204[.]41[.]177/db293a2c1b1c70c4/sqlite3[.]dll hxxps://185[.]215[.]113[.]206/0d60be0de163924d/vcruntime140[.]dll hxxps://194[.]15[.]46[.]65/896c9ad8bf739ee8/sqlite3[.]dll hxxps://185[.]215[.]113[.]206/0d60be0de163924d/sqlite3[.]dll hxxps://194[.]15[.]46[.]65/896c9ad8bf739ee8/mozglue[.]dll hxxps://185[.]215[.]113[.]206/0d60be0de163924d/mozglue[.]dll hxxps://194[.]15[.]46[.]65/896c9ad8bf739ee8/vcruntime140[.]dll hxxps://128[.]140[.]91[.]217/16c60772756db6d6/vcruntime140[.]dll hxxps://5[.]42[.]199[.]9/25f588723ad06749/vcruntime140[.]dll hxxps://212[.]86[.]109[.]106/df6db770d6188cea/sqlite3[.]dll hxxps://147[.]45[.]47[.]59/04e11569f3f575cf/vcruntime140[.]dll hxxps://62[.]60[.]226[.]53/89b86fda49329a90/vcruntime140[.]dll hxxp://45[.]93[.]20[.]64/96d56f5c90701384[.]php |
Stealc |
| URL | hxxp://37[.]139[.]129[.]142/htdocs/ncxqhfxfmzldsmj[.]exe hxxp://81[.]161[.]229[.]110/htdocs/towmwxrhbrlbnyp[.]exe hxxp://37[.]139[.]129[.]142/htdocs/dtjseniczgohfqf[.]exe hxxp://37[.]139[.]129[.]142/htdocs/fwkjpnnymsjbadc[.]exe hxxp://37[.]139[.]129[.]142/htdocs/ftbizcdklgaeway[.]exe hxxp://37[.]139[.]129[.]142/htdocs/mbrktpgtxyzelnn[.]exe |
MASS Logger |
| URL | hxxps://api[.]telegram[.]org/bot8183912070:AAGxwq-YWsMb4FtMiN-pnoAFnMm_DdvDrN8/sendMessage hxxps://api[.]telegram[.]org/bot7772893676:AAHsXXekbKXk34N9C2s13jbOqoFMDLR-8pQ/sendMessage hxxps://api[.]telegram[.]org/bot7538644364:AAF8RmyqUUeiIW2FY-CiLkvH5n7OnXLqSuo/sendMessage hxxps://api[.]telegram[.]org/bot8081397613:AAHnKbBUW2ygwUg-dyR07uKaxuo-1A7dLzk/sendMessage hxxps://api[.]telegram[.]org/bot8007077483:AAHM4_PlNxkpckDEqg6ywAn9tdKAEoUNe4o/sendMessage hxxp://96[.]9[.]210[.]135/Test/mio[.]zip |
AsyncRAT |
| URL | hxxps://nanshanwu[.]com/TechGuardSecureSuite/ | Matanbuchus |
| URL | hxxp://156[.]225[.]31[.]175:808/linux_mips64 hxxp://156[.]225[.]31[.]175:808/linux_mips64el hxxp://156[.]225[.]31[.]175:808/linux_mips64el_softfloat hxxp://156[.]225[.]31[.]175:808/linux_mips hxxp://156[.]225[.]31[.]175:808/dw[.]sh hxxp://156[.]225[.]31[.]175:808/linux_ppc64el hxxp://156[.]225[.]31[.]175:808/linux_ppc64 hxxp://156[.]225[.]31[.]175:808/linux_mipsel hxxp://156[.]225[.]31[.]175:808/linux_mips64_softfloat hxxp://156[.]225[.]31[.]175:808/download[.]sh hxxp://156[.]225[.]31[.]175:808/linux_arm64 hxxp://156[.]225[.]31[.]175:808/linux_arm6 hxxp://156[.]225[.]31[.]175:808/linux_mips_softfloat hxxp://156[.]225[.]31[.]175:808/linux_386 hxxp://156[.]225[.]31[.]175:808/linux_arm7 hxxp://156[.]225[.]31[.]175:808/linux_mipsel_softfloat hxxp://156[.]225[.]31[.]175:808/linux_arm5 hxxp://156[.]225[.]31[.]175:808/linux_amd64 |
Kaiji |
| URL | hxxp://38[.]180[.]60[.]198:8080/note/setup3956[.]msi hxxp://38[.]180[.]60[.]198:8080/upd/Document_WP160400278[.]lnk |
MetaStealer |
| URL | hxxp://219[.]68[.]235[.]149:52006/Mozi[.]m | Mozi |
