不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様6社 -
2025/04/25
※2025/04/25 更新
マルウェア感染させると考えられるURLを検知（2025/04/25）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://u1[.]putdownpopcorn[.]digital/b2860riclz[.]xi hxxps://u1[.]putdownpopcorn[.]digital/rizhr1ih4j[.]xi hxxps://u1[.]putdownpopcorn[.]digital/9rtau89w4d[.]xi hxxps://u1[.]putdownpopcorn[.]digital/miqruiq77x[.]xi hxxps://u1[.]putdownpopcorn[.]digital/52i1y6y249[.]xi hxxps://u1[.]putdownpopcorn[.]digital/ginxf0im1x[.]xi hxxps://u1[.]putdownpopcorn[.]digital/r3ck6cp3lk[.]svg hxxps://u1[.]putdownpopcorn[.]digital/5cgz4l6tac[.]svg hxxps://u1[.]spottyscary[.]top/mr8gffacl2[.]bip |
ClearFake |
| URL | hxxps://vickmarine[.]com/3w1s[.]js hxxps://mrdltd[.]com/5q2g[.]js hxxps://qwlpert[.]com/srv/log hxxps://vickmarine[.]com/js[.]php hxxps://promo[.]kimmwhite[.]com/profileLayout hxxps://jsmakert[.]shop/nlm/sll[.]php hxxps://jsmakert[.]shop/nlm/flex[.]js hxxps://jsmakert[.]shop/nlm/index[.]php hxxps://umpmfss[.]top/files/files/AutoLaunch[.]zip |
FAKEUPDATES |
| URL | hxxps://www[.]wearerescue[.]com/wp-login[.]php?redirect_to=https%3A%2F%2Fwww[.]wearerescue[.]com%2Fwp-content%2Fplugins%2Fresads%2Fmfls[.]php%3Fid%3DqwSPUwLH23Twhnr6FMpI&bp-auth=1&action=bpnoaccess hxxps://setecores[.]com[.]br/wp-content/plugins/resads/mfls[.]php?id=z8GvGX523Ii0Amyem9qW hxxps://crushingthehairbiz[.]com/wp-content/plugins/wp-automatic/dwyrnb[.]php?dpf=1kw5q hxxps://emblemat[.]com/moszna/wp-content/plugins/resads/mfls[.]php?id=Z3m8aDdGyDQo8TnqIyri hxxps://atrandu[.]lt/wp-content/plugins/wp-automatic/pwlbdv[.]php?gdqg=q32e |
Latrodectus |
| URL | hxxps://renkpin[.]net/ZDBlMTc4YzkwODk2/ hxxps://santorinotornado5[.]com/ZDBlMTc4YzkwODk2/ hxxps://lospallos25[.]com/ZDBlMTc4YzkwODk2/ hxxps://sinagogdahaham1453[.]com/ZDBlMTc4YzkwODk2/ hxxps://hahohahohoahoa[.]com/ZDBlMTc4YzkwODk2/ |
Coper |
| URL | hxxp://152[.]36[.]128[.]18/cgi-bin/p[.]cgi?r=72&i=13I915O3FG6I2H12 hxxp://152[.]36[.]128[.]18/cgi-bin/p[.]cgi?add=aW5mbyB7DQp2NC4wMlZfVW5peDY0DQp1YnVudHUyMjA0LWFtZDY0LTIwMjUwMzA3LWVuLTANCg0KMXggQU1EIEVQWUMgUHJvY2Vzc29yDQoyMDExMDcyIGtCDQpRRU1VDQpTdGFuZGFyZCBQQyBfaTQ0MEZYICsgUElJWCwgMTk5Nl8NCg0KDQpVYnVudHUgMjIuMDQuNCBMVFMgJiAyMi4wNC40IExUUyAoSmFtbXkgSmVsbHlmaXNoKSAgJiBib29rd29ybS9zaWQgJiANCg0KL3Vzci9zYmluLw0KIDIwOjI2OjMwIHVwIDIgbWluLCAgMSB1c2VyLCAgbG9hZCBhdmVyYWdlOiAwLjE0LCAwLjA4LCAwLjAzfDE3NDU0Mzk5OTANCkxpbnV4IHVidW50dTIyMDQtYW1kNjQtMjAyNTAzMDctZW4tMCA1LjE1LjAtMTA1LWdlbmVyaWMgIzExNS1VYnVudHUgU01QIE1vbiBBcHIgMTUgMDk6NTI6MDQgVVRDIDIwMjQgeDg2XzY0IHg4Nl82NCB4ODZfNjQgR05VL0xpbnV4DQp9DQo_&i=13I915O3FG6I2H12&h=ubuntu2204-amd64-20250307-en-0&enckey=9LMgclPdcSWKXflCpEd0BzKyR8Cwp2XU6xUe4v4LacK3WFGaJ2IEuZ+lzzu/J4rlz1EhGA0HlARqACLMYsGCwFsDUQJsetapPuVJIy1S8RQAmZ/Waa6ak81fi4PV2Rsc6Tqesyz/bC1tvvBc7tjl/pmR7Jmy4WiZa0MlaosJv2M= |
Prometei |
| URL | hxxps://api[.]telegram[.]org/bot7609638669:AAGNfV4hl7F_19SvA1zpZ9EtqvZXX-TzrSw/sendMessage?chat_id=1018401531 hxxps://api[.]telegram[.]org/bot8070311428:AAEnE_dR3EigScvcBjEMV08EzHI55h4s7Ks/sendMessage?chat_id=1847485134 |
Snake Keylogger |
| URL | hxxps://woodpeckersd[.]run/glsk hxxps://vigorbridgoe[.]top/banb hxxps://topographky[.]top/xlak hxxps://rbiosphxere[.]digital/tqoa hxxps://ltropiscbs[.]live/iuwxx hxxps://geographys[.]run/eirq hxxps://cartograhphy[.]top/ixau hxxps://yequatorf[.]run/reiq hxxps://tropiscbs[.]live/iuwxx hxxps://igeographys[.]run/eirq hxxps://edumakerb[.]digital/gffh hxxps://3biosphxere[.]digital/tqoa hxxps://biosphxere[.]digital/tqoa hxxps://2hemispherexz[.]top/xapp hxxp://185[.]39[.]17[.]162/files/6668031608/8l6cDbq[.]exe hxxp://185[.]39[.]17[.]162/files/6336929412/zb7jDew[.]exe hxxp://185[.]39[.]17[.]162/files/7453936223/47Q6wZM[.]exe hxxp://185[.]39[.]17[.]162/files/6142491850/zKYlowN[.]exe hxxps://yvigorbridgoe[.]top/banb hxxps://undo[.]sg/file[.]exe hxxps://undo[.]sg/script[.]ps1 hxxps://netscoute[.]digital/quwe hxxps://4climatologfy[.]top/kbud hxxps://slliftally[.]top/xasj hxxps://rusconfi[.]run/pokd hxxps://4quilltayle[.]live/gksi hxxps://astarofliught[.]top/wozd hxxps://gorillao[.]digital/pkno |
Lumma Stealer |
| URL | hxxp://185[.]39[.]17[.]162/files/942660095/5YQQxZL[.]exe | Lumar |
| URL | hxxp://185[.]29[.]8[.]57/BLkyMfnbhSlFop223[.]bin | CloudEyE |
| URL | hxxps://api[.]telegram[.]org/bot7637203109:AAEwF0h434NduLaTadsXsSgHvM5K6b5snDs/sendMessage?chat_id=7135428463 | MASS Logger |
| URL | hxxp://93[.]190[.]143[.]101:667/IE9CompatViewList[.]xml | Cobalt Strike |
| URL | hxxp://185[.]39[.]17[.]162/files/7768319862/0IxfBFM[.]exe | Coinminer |
| URL | hxxp://badnesspandemic[.]shop/Up/b | ACR Stealer |
| URL | hxxp://209[.]141[.]48[.]207/i-5[.]8-6[.]Sakura hxxp://209[.]141[.]48[.]207/m-i[.]p-s[.]Sakura hxxp://209[.]141[.]48[.]207/Sakura[.]sh hxxp://209[.]141[.]48[.]207/a-r[.]m-4[.]Sakura hxxp://209[.]141[.]48[.]207/x-3[.]2-[.]Sakura hxxp://209[.]141[.]48[.]207/x-8[.]6-[.]Sakura hxxp://209[.]141[.]48[.]207/s-h[.]4-[.]Sakura hxxp://209[.]141[.]48[.]207/a-r[.]m-7[.]Sakura hxxp://209[.]141[.]48[.]207/a-r[.]m-5[.]Sakura hxxp://209[.]141[.]48[.]207/m-p[.]s-l[.]Sakura hxxp://209[.]141[.]48[.]207/a-r[.]m-6[.]Sakura hxxp://209[.]141[.]48[.]207/p-p[.]c-[.]Sakura hxxp://209[.]141[.]48[.]207/m-6[.]8-k[.]Sakura hxxp://45[.]143[.]166[.]71/a-r[.]m-4[.]Sakura hxxp://45[.]143[.]166[.]71/m-i[.]p-s[.]Sakura hxxp://45[.]143[.]166[.]71/a-r[.]m-7[.]Sakura hxxp://45[.]143[.]166[.]71/p-p[.]c-[.]Sakura hxxp://45[.]143[.]166[.]71/x-8[.]6-[.]Sakura hxxp://45[.]143[.]166[.]71/i-5[.]8-6[.]Sakura hxxp://45[.]143[.]166[.]71/a-r[.]m-5[.]Sakura hxxp://45[.]143[.]166[.]71/Sakura[.]sh hxxp://45[.]143[.]166[.]71/x-3[.]2-[.]Sakura hxxp://45[.]143[.]166[.]71/m-p[.]s-l[.]Sakura hxxp://45[.]143[.]166[.]71/a-r[.]m-6[.]Sakura hxxp://45[.]143[.]166[.]71/s-h[.]4-[.]Sakura hxxp://45[.]143[.]166[.]71/m-6[.]8-k[.]Sakura |
Bashlite |
| URL | hxxp://139[.]5[.]1[.]172:43399/Mozi[.]m | Mozi |
