不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/04/28
※2025/04/28 更新
マルウェア感染させると考えられるURLを検知（2025/04/28）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://goclouder[.]org/6a1F2b3C4d5E6f7A8b9C0d1E2f3A4b5/ hxxps://security[.]cludfgard[.]com/B6c4D1a9F8g3H7e5N6b5A9dE4f hxxps://security[.]cludfgard[.]com/wordpress hxxps://www[.]nemzieo[.]info/cloudflare[.]msi hxxps://grrlspace[.]com/4d2a[.]js hxxps://grrlspace[.]com/js[.]php hxxps://vickmarine[.]com/4r2h[.]js hxxps://ronthom[.]com/js[.]php hxxps://ronthom[.]com/2y5t[.]js hxxps://files[.]fnomworldwide[.]com/profileLayout hxxps://daltum[.]mx/xm[.]txt |
FAKEUPDATES |
| URL | hxxps://u1[.]pridefulamaretto[.]digital/7wj83j6wsf[.]bip hxxps://u1[.]pridefulamaretto[.]digital/t2ulzx7siu[.]bip hxxps://u1[.]pridefulamaretto[.]digital/2zcqhhz5wl[.]bip hxxps://u1[.]pridefulamaretto[.]digital/wyeh68o2b0[.]bip hxxps://u1[.]pridefulamaretto[.]digital/i45s1p9zt9[.]bip hxxps://u1[.]pridefulamaretto[.]digital/eldth1fmwk[.]bip hxxps://u1[.]pridefulamaretto[.]digital/5p8gdmfbel[.]bip hxxps://u1[.]pridefulamaretto[.]digital/dm7hbthukf[.]bip hxxps://u1[.]pridefulamaretto[.]digital/91o09jsxms[.]bip hxxps://u1[.]pridefulamaretto[.]digital/w87rdv3b3o[.]bip hxxps://u1[.]pridefulamaretto[.]digital/cmfu4kurqf[.]bip hxxps://u1[.]pridefulamaretto[.]digital/l67i4d9twl[.]bip hxxps://u1[.]pridefulamaretto[.]digital/zej1cp1exj[.]bip hxxps://u1[.]pridefulamaretto[.]digital/ozdakw43tv[.]bip hxxps://u1[.]pridefulamaretto[.]digital/wwwoxywr72[.]bip hxxps://u1[.]pridefulamaretto[.]digital/96i3xwv16t[.]bip hxxps://u1[.]pridefulamaretto[.]digital/kxgu5kpuno[.]bip hxxps://u1[.]pridefulamaretto[.]digital/olchlqp3mx[.]bip hxxps://u1[.]pridefulamaretto[.]digital/w8ivibky4p[.]bip hxxps://u1[.]pridefulamaretto[.]digital/pv4wds4y3x[.]bip hxxps://u1[.]pridefulamaretto[.]digital/au28vdsv27[.]bip hxxps://u1[.]pridefulamaretto[.]digital/zeoeviquag[.]bip hxxps://u1[.]pridefulamaretto[.]digital/0i1otdmbc9[.]bip hxxps://u1[.]pridefulamaretto[.]digital/evytu3ne24[.]bip hxxps://u1[.]pridefulamaretto[.]digital/fsv09dm869[.]bip hxxps://u1[.]pridefulamaretto[.]digital/xi4sa8ij90[.]bip hxxps://u1[.]pridefulamaretto[.]digital/6i4td0u1wh[.]bip hxxps://u1[.]pridefulamaretto[.]digital/lujh0omd8v[.]bip hxxps://u1[.]pridefulamaretto[.]digital/gcjjkz8n18[.]bip hxxps://u1[.]pridefulamaretto[.]digital/myq92fibvl[.]bip hxxps://u1[.]pridefulamaretto[.]digital/dlixkvd5ym[.]bip hxxps://u1[.]pridefulamaretto[.]digital/zo4bjhbisr[.]bip hxxps://u1[.]pridefulamaretto[.]digital/m8lclzigwz[.]bip hxxps://u1[.]pridefulamaretto[.]digital/6nfgkg78dk[.]bip hxxps://u1[.]pridefulamaretto[.]digital/w3kdr19rjk[.]bip hxxps://u1[.]pridefulamaretto[.]digital/6hdu94d8fa[.]bip hxxps://u1[.]pridefulamaretto[.]digital/v1u2kg7n46[.]bip hxxps://u1[.]pridefulamaretto[.]digital/hen8sycgq4[.]bip hxxps://u1[.]pridefulamaretto[.]digital/7o6m4hmus3[.]bip hxxps://u1[.]pridefulamaretto[.]digital/cnmki1nbkj[.]bip hxxps://u1[.]pridefulamaretto[.]digital/5izhqrenjj[.]bip hxxps://u1[.]pridefulamaretto[.]digital/yvblhib7nj[.]bip hxxps://u1[.]pridefulamaretto[.]digital/hbd00mg9xh[.]bip hxxps://u1[.]pridefulamaretto[.]digital/lc5n4nesn4[.]bip hxxps://u1[.]pridefulamaretto[.]digital/f0t1iemm9f[.]bip hxxps://u1[.]pridefulamaretto[.]digital/axo076os82[.]bip hxxps://u1[.]pridefulamaretto[.]digital/qpugnae9bs[.]bip hxxps://u1[.]pridefulamaretto[.]digital/tv4820fqrq[.]bip hxxps://u1[.]pridefulamaretto[.]digital/hc7t9xbyh7[.]bip hxxps://u1[.]pridefulamaretto[.]digital/pv91ese1pz[.]bip hxxps://u1[.]pridefulamaretto[.]digital/jfa7wumryu[.]bip hxxps://u1[.]pridefulamaretto[.]digital/gn7xlefihm[.]bip hxxps://u1[.]pridefulamaretto[.]digital/98cb4umtua[.]bip hxxps://u1[.]pridefulamaretto[.]digital/pov32pdkcr[.]bip hxxps://u1[.]pridefulamaretto[.]digital/du4lgheiwa[.]bip hxxps://u1[.]pridefulamaretto[.]digital/0ccai7kohw[.]bip hxxps://u1[.]pridefulamaretto[.]digital/6qjxnfovd5[.]bip hxxps://u1[.]pridefulamaretto[.]digital/p44hd9nmv7[.]bip hxxps://u1[.]pridefulamaretto[.]digital/whw979mpn0[.]bip hxxps://u1[.]pridefulamaretto[.]digital/58kvkboess[.]bip hxxps://u1[.]pridefulamaretto[.]digital/ikqqhjx7e0[.]bip hxxps://u1[.]pridefulamaretto[.]digital/1lcmb00ane[.]bip hxxps://u1[.]pridefulamaretto[.]digital/4a62o1vkle[.]bip hxxps://u1[.]pridefulamaretto[.]digital/9vl3q31bnn[.]bip hxxps://u1[.]pridefulamaretto[.]digital/p9xczyr5yj[.]bip hxxps://u1[.]pridefulamaretto[.]digital/jda47lpsi7[.]bip hxxps://u1[.]pridefulamaretto[.]digital/itslpa0bcc[.]bip hxxps://u1[.]pridefulamaretto[.]digital/8edr2kh7il[.]bip hxxps://u1[.]pridefulamaretto[.]digital/gra0u4wd15[.]bip hxxps://u1[.]pridefulamaretto[.]digital/afroe5b8i4[.]bip |
ClearFake |
| URL | hxxp://185[.]39[.]17[.]70/zgrnf/upx[.]exe hxxp://176[.]65[.]134[.]8/wealthysycn[.]txt hxxp://176[.]65[.]134[.]8/metacodings[.]txt hxxp://185[.]215[.]113[.]19//inc/cudo[.]exe hxxp://185[.]215[.]113[.]19//inc/xxxx[.]exe hxxp://185[.]215[.]113[.]19//inc/ven_protected[.]exe hxxp://185[.]215[.]113[.]19//inc/taskhost[.]exe hxxp://185[.]215[.]113[.]19//inc/xt[.]exe hxxp://185[.]215[.]113[.]19//inc/gagagggagagag[.]exe hxxp://185[.]215[.]113[.]19//inc/DeliciousPart[.]exe hxxp://185[.]215[.]113[.]117//inc/DeliciousPart[.]exe hxxp://185[.]215[.]113[.]117//inc/ven_protected[.]exe hxxp://185[.]215[.]113[.]117//inc/xxxx[.]exe hxxp://185[.]215[.]113[.]117//inc/xt[.]exe hxxp://185[.]215[.]113[.]117//inc/gagagggagagag[.]exe hxxp://185[.]215[.]113[.]117//inc/taskhost[.]exe hxxp://185[.]215[.]113[.]117//inc/cudo[.]exe hxxp://185[.]39[.]17[.]70/zgrnf/gt[.]exe hxxp://185[.]39[.]17[.]70/zgrnf/ckuh[.]exe hxxps://raw[.]githubusercontent[.]com/epicman548/ecacssaddd/main/discord[.]exe |
AsyncRAT |
| URL | hxxps://8biosphxere[.]digital/tqoa hxxps://xclarmodq[.]top/qoxo hxxps://hnwoodpeckersd[.]run/glsk hxxps://nequatorf[.]run/reiq hxxps://slatitudert[.]live/teui hxxps://digilayerx[.]digital/hmand hxxps://rlatitudert[.]live/teui hxxps://ahemispherexz[.]top/xapp hxxps://ybiosphxere[.]digital/tqoa hxxps://0topographky[.]top/xlak hxxps://fclarmodq[.]top/qoxo hxxps://mclimatologfy[.]top/kbud hxxp://185[.]39[.]17[.]162/files/5494432675/iyHA21b[.]exe hxxp://185[.]39[.]17[.]162/files/5494432675/Mvyo43T[.]exe hxxp://185[.]39[.]17[.]162/files/6691015685/LNHCtPX[.]exe hxxp://185[.]39[.]17[.]162/files/5494432675/BKbClfr[.]exe hxxp://185[.]39[.]17[.]162/files/qqdoup/random[.]exe hxxps://ciwoodpeckersd[.]run/glsk hxxps://avigorbridgoe[.]top/banb hxxps://ywoodpeckersd[.]run/glsk hxxps://ufclimatologfy[.]top/kbud hxxps://3cartograhphy[.]top/ixau hxxp://185[.]39[.]17[.]162/files/5265591378/HL1YRkM[.]exe hxxps://vlongitudde[.]digital/wizu hxxps://qfybiosphxere[.]digital/tqoa hxxps://eclimatologfy[.]top/kbud hxxps://bclimatologfy[.]top/kbud hxxps://lbiosphxere[.]digital/tqoa hxxps://-vigorbridgoe[.]top/banb hxxp://185[.]39[.]17[.]162/files/1401316133/wqANqmh[.]exe hxxps://ttopographky[.]top/xlak hxxps://lgeographys[.]run/eirq hxxps://egeographys[.]run/eirq hxxps://btopographky[.]top/xlak hxxps://atropiscbs[.]live/iuwxx hxxps://1cartograhphy[.]top/ixau hxxps://quonecony[.]live/tpeo hxxps://k2salaccgfa[.]top/gsooz hxxps://8starofliught[.]top/wozd hxxps://-ageographys[.]run/eirq hxxps://otopographky[.]top/xlak hxxps://mcartograhphy[.]top/ixau hxxps://1biosphxere[.]digital/tqoa hxxps://vclimatologfy[.]top/kbud hxxps://pbiosphxere[.]digital/tqoa hxxps://ncartograhphy[.]top/ixau hxxps://fgeographys[.]run/eirq hxxps://transdataa[.]digital/xwpa hxxp://185[.]39[.]17[.]162/files/1401316133/FQdia1P[.]exe hxxps://xvigorbridgoe[.]top/banb hxxps://ubiosphxere[.]digital/tqoa hxxps://mediaflowq[.]run/aeui hxxp://185[.]215[.]113[.]19//inc/Firefox[.]exe hxxp://185[.]215[.]113[.]19//inc/blackload[.]exe hxxp://185[.]215[.]113[.]19//inc/postbox[.]exe hxxp://185[.]215[.]113[.]19//inc/broadcom5[.]exe hxxp://185[.]215[.]113[.]19//inc/mobiletrans[.]exe hxxp://185[.]215[.]113[.]19//inc/CompleteStudio[.]exe hxxp://185[.]215[.]113[.]19//inc/lummetc[.]exe hxxp://185[.]215[.]113[.]19//inc/coreplugin[.]exe hxxp://185[.]215[.]113[.]19//inc/shopfree[.]exe hxxp://185[.]215[.]113[.]19//inc/GoogleUpdate[.]exe hxxp://185[.]215[.]113[.]19//inc/setup[.]exe hxxp://185[.]215[.]113[.]19//inc/Amadeus[.]exe hxxp://185[.]215[.]113[.]19//inc/PctOccurred[.]exe hxxp://185[.]215[.]113[.]19//inc/cccc2[.]exe hxxp://185[.]215[.]113[.]19//inc/qqq[.]exe hxxp://185[.]215[.]113[.]19//inc/LgendPremium[.]exe hxxp://185[.]215[.]113[.]19//inc/LummaC22222[.]exe hxxp://185[.]215[.]113[.]19//inc/LummaC222222[.]exe hxxp://185[.]215[.]113[.]19//inc/zzzz1[.]exe hxxp://185[.]215[.]113[.]19//inc/LummaC2[.]exe hxxp://185[.]215[.]113[.]117//inc/Firefox[.]exe hxxp://185[.]215[.]113[.]117//inc/blackload[.]exe hxxp://185[.]215[.]113[.]117//inc/coreplugin[.]exe hxxp://185[.]215[.]113[.]117//inc/Amadeus[.]exe hxxp://185[.]215[.]113[.]117//inc/postbox[.]exe hxxp://185[.]215[.]113[.]117//inc/mobiletrans[.]exe hxxp://185[.]215[.]113[.]117//inc/GoogleUpdate[.]exe hxxp://185[.]215[.]113[.]117//inc/setup[.]exe hxxp://185[.]215[.]113[.]117//inc/zzzz1[.]exe hxxp://185[.]215[.]113[.]117//inc/LummaC22222[.]exe hxxp://185[.]215[.]113[.]117//inc/LgendPremium[.]exe hxxp://185[.]215[.]113[.]117//inc/LummaC2[.]exe hxxp://185[.]215[.]113[.]117//inc/qqq[.]exe hxxp://185[.]215[.]113[.]117//inc/cccc2[.]exe hxxp://185[.]215[.]113[.]117//inc/broadcom5[.]exe hxxp://185[.]215[.]113[.]117//inc/LummaC222222[.]exe hxxp://185[.]215[.]113[.]117//inc/shopfree[.]exe hxxp://185[.]215[.]113[.]117//inc/PctOccurred[.]exe hxxp://185[.]215[.]113[.]117//inc/lummetc[.]exe hxxp://185[.]215[.]113[.]117//inc/CompleteStudio[.]exe hxxps://flongitudde[.]digital/wizu hxxps://bhungreecoq[.]run/tqow hxxps://uwoodpeckersd[.]run/glsk hxxps://stropiscbs[.]live/iuwxx hxxps://surmisehotte[.]click/api hxxp://195[.]82[.]147[.]91/key/041525-bd/042225-ar/Men[.]exe hxxps://s4cartograhphy[.]top/ixau hxxps://ucartograhphy[.]top/ixau hxxps://qwoodpeckersd[.]run/glsk hxxps://tcartograhphy[.]top/ixau hxxps://stopographky[.]top/xlak hxxps://sgeographys[.]run/eirq hxxps://h-tropiscbs[.]live/iuwxx hxxps://ootopographky[.]top/xlak hxxps://qclimatologfy[.]top/kbud hxxps://gcartograhphy[.]top/ixau hxxp://185[.]39[.]17[.]162/files/teamex_support/random[.]exe hxxps://twoodpeckersd[.]run/glsk hxxps://i8geographys[.]run/eirq hxxps://vgeographys[.]run/eirq hxxps://mqtropiscbs[.]live/iuwxx hxxps://buzzarddf[.]live/ktnt hxxps://parakehjet[.]run/kewk hxxps://n-ubearjk[.]live/benj hxxps://5cartograhphy[.]top/ixau hxxp://185[.]39[.]17[.]162/files/1147936913/0UAO4G0[.]exe hxxps://bearjk[.]live/benj hxxps://fishgh[.]digital/tequ hxxps://sclarmodq[.]top/qoxo hxxps://fbearjk[.]live/benj hxxps://dwoodpeckersd[.]run/glsk hxxps://qclarmodq[.]top/qoxo hxxps://pixelcodey[.]digital/mnbvj hxxps://owoodpeckersd[.]run/glsk hxxps://ntropiscbs[.]live/iuwxx hxxps://mobitront[.]run/dsiu hxxps://kbiosphxere[.]digital/tqoa hxxps://8geographys[.]run/eirq hxxps://9topographky[.]top/xlak hxxps://1clarmodq[.]top/qoxo hxxps://2gvigorbridgoe[.]top/banb |
Lumma Stealer |
| URL | hxxps://www[.]wilkinsonbeane[.]com/css/slider/ynebhc[.]php hxxp://79[.]124[.]78[.]173/incongruousness[.]php hxxps://www[.]wilkinsonbeane[.]com/css/slider |
Koi Stealer |
| URL | hxxp://185[.]39[.]17[.]162/files/5979055508/ajNyRQT[.]exe hxxp://d[.]0000o[.]xyz:88/we64[.]exe hxxp://rundl[.]l0o01[.]com:88/we64[.]exe hxxp://176[.]65[.]138[.]20:88/we64[.]exe hxxp://t[.]0000o[.]xyz:88/we64[.]exe hxxp://rundl[.]0000o[.]xyz:88/we64[.]exe hxxp://185[.]215[.]113[.]19//inc/pyld64[.]exe hxxp://185[.]215[.]113[.]19//inc/2020[.]exe hxxp://185[.]215[.]113[.]19//inc/pyld611114[.]exe hxxp://185[.]215[.]113[.]19//inc/xxz[.]exe hxxp://185[.]215[.]113[.]19//inc/svchost[.]exe hxxp://185[.]215[.]113[.]117//inc/pyld611114[.]exe hxxp://185[.]215[.]113[.]117//inc/pyld64[.]exe hxxp://185[.]215[.]113[.]117//inc/svchost[.]exe hxxp://185[.]215[.]113[.]117//inc/xxz[.]exe hxxp://185[.]215[.]113[.]117//inc/2020[.]exe hxxp://twizthash[.]net/x[.]exe hxxp://twizthash[.]net/tdrp[.]exe |
Coinminer |
| URL | hxxp://185[.]39[.]17[.]162/files/Machiavellismz/random[.]exe | Rhadamanthys |
| URL | hxxp://185[.]147[.]124[.]116/M0XmDru/Login[.]php hxxp://185[.]39[.]17[.]163/Su8kud7i/Login[.]php hxxp://185[.]39[.]17[.]241/0Bdh3sQpbD/Plugins/clip64[.]dll hxxp://185[.]39[.]17[.]241/0Bdh3sQpbD/Plugins/cred64[.]dll hxxp://185[.]39[.]17[.]163/Su8kud7i/Plugins/cred[.]dll hxxp://185[.]39[.]17[.]241/0Bdh3sQpbD/Plugins/clip[.]dll hxxp://185[.]39[.]17[.]163/Su8kud7i/Plugins/clip64[.]dll hxxp://185[.]39[.]17[.]163/Su8kud7i/Plugins/clip[.]dll hxxp://185[.]215[.]113[.]19//dobre/splwow64_1[.]exe hxxp://185[.]215[.]113[.]19//mine/random[.]exe hxxp://185[.]215[.]113[.]19//inc/splwow64[.]exe hxxp://185[.]215[.]113[.]19//inc/Amadey[.]exe hxxp://185[.]215[.]113[.]19//dobre/splwow64[.]exe hxxp://185[.]215[.]113[.]19//inc/SemiconductorNot[.]exe hxxp://185[.]215[.]113[.]19//soka/random[.]exe hxxp://185[.]215[.]113[.]117//inc/SemiconductorNot[.]exe hxxp://185[.]215[.]113[.]117//inc/splwow64[.]exe hxxp://185[.]215[.]113[.]117//dobre/splwow64_1[.]exe hxxp://185[.]215[.]113[.]117//soka/random[.]exe hxxp://185[.]215[.]113[.]117//mine/random[.]exe hxxp://185[.]215[.]113[.]117//dobre/splwow64[.]exe hxxp://185[.]215[.]113[.]117//inc/Amadey[.]exe hxxp://185[.]39[.]17[.]241/0Bdh3sQpbD/Plugins/cred[.]dll hxxp://185[.]39[.]17[.]163/Su8kud7i/Plugins/cred64[.]dll |
Amadey |
| URL | hxxp://147[.]45[.]44[.]116/c60d76a15a1d4de5[.]php hxxp://185[.]215[.]113[.]19//inc/pimer_bbbcontents7[.]exe hxxp://185[.]215[.]113[.]19//inc/stealc_default[.]exe hxxp://185[.]215[.]113[.]19//inc/5447jsX[.]exe hxxp://185[.]215[.]113[.]19//inc/needmoney[.]exe hxxp://185[.]215[.]113[.]19//inc/stealc_daval[.]exe hxxp://185[.]215[.]113[.]19//inc/343dsxs[.]exe hxxp://185[.]215[.]113[.]19//inc/4434[.]exe hxxp://185[.]215[.]113[.]19//inc/prem1[.]exe hxxp://185[.]215[.]113[.]19//inc/stealc_default2[.]exe hxxp://185[.]215[.]113[.]19//inc/12[.]exe hxxp://185[.]215[.]113[.]19//inc/stealc_valenciga[.]exe hxxp://185[.]215[.]113[.]19//steam/random[.]exe hxxp://185[.]215[.]113[.]117//inc/pimer_bbbcontents7[.]exe hxxp://185[.]215[.]113[.]117//inc/needmoney[.]exe hxxp://185[.]215[.]113[.]117//inc/343dsxs[.]exe hxxp://185[.]215[.]113[.]117//inc/stealc_default2[.]exe hxxp://185[.]215[.]113[.]117//inc/prem1[.]exe hxxp://185[.]215[.]113[.]117//inc/stealc_valenciga[.]exe hxxp://185[.]215[.]113[.]117//inc/5447jsX[.]exe hxxp://185[.]215[.]113[.]117//inc/stealc_default[.]exe hxxp://185[.]215[.]113[.]117//inc/stealc_daval[.]exe hxxp://185[.]215[.]113[.]117//inc/12[.]exe hxxp://185[.]215[.]113[.]117//inc/4434[.]exe hxxp://185[.]215[.]113[.]117//steam/random[.]exe |
Stealc |
| URL | hxxps://www[.]wilkinsonbeane[.]com/css/slider/sd4[.]ps1 hxxps://www[.]wilkinsonbeane[.]com/css/slider/untippedhi[.]exe |
Koi Loader |
| URL | hxxp://147[.]45[.]179[.]212:8080/docs/setup7372[.]msi hxxp://185[.]215[.]113[.]19//inc/Vn70wVxW[.]exe hxxp://185[.]215[.]113[.]19//inc/out_test_sig[.]exe hxxp://185[.]215[.]113[.]117//inc/Vn70wVxW[.]exe hxxp://185[.]215[.]113[.]117//inc/out_test_sig[.]exe hxxp://92[.]118[.]112[.]135:8080/part/setup7372[.]msi |
MetaStealer |
| URL | hxxp://185[.]39[.]17[.]239/files/unique2/random[.]exe hxxp://185[.]215[.]113[.]19//inc/univ[.]exe hxxp://185[.]215[.]113[.]117//inc/torque[.]exe hxxp://185[.]215[.]113[.]117//inc/univ[.]exe hxxp://185[.]215[.]113[.]19//inc/torque[.]exe |
GCleaner |
| URL | hxxp://www[.]zw5m[.]top/an20/ hxxp://www[.]uponbs3[.]pro/an20/ hxxp://www[.]upport-meta2903[.]online/an20/ hxxp://www[.]uv3kq5tvbkys[.]xyz/an20/ hxxp://www[.]vertdzb[.]xyz/an20/ hxxp://www[.]winx6[.]casino/an20/ hxxp://www[.]x39q[.]top/an20/ hxxp://www[.]zev[.]net/an20/ hxxp://www[.]reta99[.]info/an20/ hxxp://www[.]rishticodiegfortysix[.]online/an20/ hxxp://www[.]ritishpanel[.]net/an20/ hxxp://www[.]rostygust[.]shop/an20/ hxxp://www[.]slarose[.]online/an20/ hxxp://www[.]ssiduousate[.]online/an20/ hxxp://www[.]tn67n[.]cfd/an20/ hxxp://www[.]uangjiahao[.]online/an20/ hxxp://www[.]uper-bowl-kickoff-time[.]cfd/an20/ hxxp://www[.]oftfusion[.]shop/an20/ hxxp://www[.]ogparks[.]club/an20/ hxxp://www[.]omiq[.]tech/an20/ hxxp://www[.]orchers[.]world/an20/ hxxp://www[.]orkshopaicollaborationhub[.]xyz/an20/ hxxp://www[.]ovaecho[.]shop/an20/ hxxp://www[.]palmsrd[.]net/an20/ hxxp://www[.]levateballoonco[.]net/an20/ hxxp://www[.]lobaltravelbookings[.]xyz/an20/ hxxp://www[.]mail-marketing-job-62763[.]bond/an20/ hxxp://www[.]marcato[.]online/an20/ hxxp://www[.]ndimadeahome[.]net/an20/ hxxp://www[.]nnotechbs[.]online/an20/ hxxp://www[.]odeatoll[.]shop/an20/ hxxp://www[.]odzat[.]info/an20/ hxxp://www[.]ightmareroad[.]net/an20/ hxxp://www[.]inancialfreedomclub[.]xyz/an20/ hxxp://www[.]ires-72090[.]bond/an20/ hxxp://www[.]ixmy[.]beauty/an20/ hxxp://www[.]khsim[.]top/an20/ hxxp://www[.]ksp679[.]top/an20/ hxxp://www[.]lanajoyeria[.]shop/an20/ hxxp://www[.]layplus77[.]vip/an20/ hxxp://www[.]bcw1219[.]xyz/an20/ hxxp://www[.]ellwish[.]online/an20/ hxxp://www[.]ethil[.]xyz/an20/ hxxp://www[.]fp8ch[.]cfd/an20/ hxxp://www[.]hieh33[.]xyz/an20/ hxxp://www[.]ideoxxfree[.]xyz/an20/ hxxp://www[.]igaborgz[.]xyz/an20/ hxxp://www[.]ash-paying-jobs-79621[.]bond/an20/ hxxp://www[.]asinocruiseclub[.]net/an20/ hxxp://www[.]astertechhub[.]info/an20/ hxxp://www[.]atizenairdrop[.]bet/an20/ hxxp://www[.]audace[.]shop/an20/ hxxp://www[.]avino[.]website/an20/ hxxp://www[.]8j3tfb2djzoo[.]xyz/an20/ hxxp://www[.]9o8yd[.]top/an20/ hxxp://www[.]alisisi[.]xyz/an20/ hxxp://www[.]andygirls[.]biz/an20/ hxxp://www[.]arisasuestalvey[.]net/an20/ hxxp://www[.]arka[.]group/an20/ hxxp://www[.]aser-eye-surgery-3291[.]bond/an20/ hxxp://www[.]1198[.]pet/an20/ hxxp://www[.]4260621[.]xyz/an20/ hxxp://www[.]4260686[.]xyz/an20/ hxxp://www[.]488ns[.]top/an20/ hxxp://www[.]8ekcmt[.]top/an20/ hxxp://www[.]zjylsp22[.]sbs/fs24/ hxxp://www[.]roxyduwanjuan[.]info/fs24/ hxxp://www[.]sqwe[.]pet/fs24/ hxxp://www[.]tbbwd[.]top/fs24/ hxxp://www[.]twanguffo[.]xyz/fs24/ hxxp://www[.]uikjobs[.]biz/fs24/ hxxp://www[.]unfunbigbgames[.]pics/fs24/ hxxp://www[.]wandafilmfestival[.]net/fs24/ hxxp://www[.]wqrqj[.]info/fs24/ hxxp://www[.]ykkg[.]pet/fs24/ hxxp://www[.]ysp9[.]info/fs24/ hxxp://www[.]ooty[.]city/fs24/ hxxp://www[.]orgevision147[.]info/fs24/ hxxp://www[.]ork-abroad-36556[.]bond/fs24/ hxxp://www[.]ospital-care-us-bl-36561[.]click/fs24/ hxxp://www[.]ploots[.]xyz/fs24/ hxxp://www[.]ptiorder[.]shop/fs24/ hxxp://www[.]qx4ie[.]sbs/fs24/ hxxp://www[.]ravella[.]biz/fs24/ hxxp://www[.]riginorder[.]shop/fs24/ hxxp://www[.]rintsforu[.]shop/fs24/ hxxp://www[.]liza[.]locker/fs24/ hxxp://www[.]mrnm[.]bingo/fs24/ hxxp://www[.]nonymix[.]net/fs24/ hxxp://www[.]obisumo[.]xyz/fs24/ hxxp://www[.]od-mine[.]net/fs24/ hxxp://www[.]odestapparel[.]net/fs24/ hxxp://www[.]ofas-cave-379[.]world/fs24/ hxxp://www[.]ogicloop[.]shop/fs24/ hxxp://www[.]okuousekizai[.]net/fs24/ hxxp://www[.]g9r430o6al1l[.]xyz/fs24/ hxxp://www[.]gkjkeiwbzou8pf[.]xyz/fs24/ hxxp://www[.]gnouqk3mq[.]shop/fs24/ hxxp://www[.]h10y[.]top/fs24/ hxxp://www[.]heworkshop[.]biz/fs24/ hxxp://www[.]hinaai[.]club/fs24/ hxxp://www[.]iqaqua[.]xyz/fs24/ hxxp://www[.]ithsugar[.]net/fs24/ hxxp://www[.]jdc6[.]one/fs24/ hxxp://www[.]klinic[.]cfd/fs24/ hxxp://www[.]enteku[.]click/fs24/ hxxp://www[.]epayne[.]net/fs24/ hxxp://www[.]erenitypool-spa[.]net/fs24/ hxxp://www[.]esilientplaybook[.]online/fs24/ hxxp://www[.]et-together[.]vip/fs24/ hxxp://www[.]etafury[.]xyz/fs24/ hxxp://www[.]etiantang9673[.]top/fs24/ hxxp://www[.]extenglishinstitute[.]online/fs24/ hxxp://www[.]anglove[.]net/fs24/ hxxp://www[.]arinsurancehints[.]xyz/fs24/ hxxp://www[.]bscript[.]top/fs24/ hxxp://www[.]bvexil[.]xyz/fs24/ hxxp://www[.]dsignageaustralia[.]online/fs24/ hxxp://www[.]ealingcarecounseling[.]net/fs24/ hxxp://www[.]ealthsewa[.]online/fs24/ hxxp://www[.]ellbuyon[.]shop/fs24/ hxxp://www[.]emka[.]live/fs24/ hxxp://www[.]en-health-37595[.]bond/fs24/ hxxp://www[.]1ewqdas456yhytredvb[.]autos/fs24/ hxxp://www[.]3tcart[.]cyou/fs24/ hxxp://www[.]5x1r2p5bg86q[.]xyz/fs24/ hxxp://www[.]7558a5[.]vip/fs24/ hxxp://www[.]9bet[.]bar/fs24/ hxxp://www[.]acaushowdesafios[.]shop/fs24/ hxxp://www[.]amir7[.]sbs/fs24/ hxxp://185[.]215[.]113[.]19//inc/freedom[.]exe hxxp://185[.]215[.]113[.]19//inc/explorer[.]exe hxxp://185[.]215[.]113[.]117//inc/freedom[.]exe hxxp://185[.]215[.]113[.]117//inc/explorer[.]exe |
Formbook |
| URL | hxxps://api[.]telegram[.]org/bot7941278366:AAEaNerdR3ysFFfS8NCqw2mTvSoiCyVYGqE/sendMessage?chat_id=6623091671 hxxps://api[.]telegram[.]org/bot7381501080:AAEf6OV30zeoZs2sgUTiSqHwb_Z4gqTPoqU/sendMessage?chat_id=7881071100 |
MASS Logger |
| URL | hxxp://d[.]0000o[.]xyz:88/mimi[.]dat hxxp://rundl[.]0000o[.]xyz:88/mimi[.]dat hxxp://176[.]65[.]138[.]20:88/mimi[.]dat hxxp://rundl[.]l0o01[.]com:88/mimi[.]dat hxxp://t[.]0000o[.]xyz:88/mimi[.]dat |
MimiKatz |
| URL | hxxp://d[.]0000o[.]xyz:88/javaw[.]exe hxxp://rundl[.]l0o01[.]com:88/javaw[.]exe hxxp://176[.]65[.]138[.]20:88/javaw[.]exe hxxp://rundl[.]0000o[.]xyz:88/javaw[.]exe |
Ghost RAT |
| URL | hxxp://146[.]19[.]143[.]149/weedbash hxxp://146[.]19[.]143[.]149/weedsshd hxxp://146[.]19[.]143[.]149/weedftp hxxp://146[.]19[.]143[.]149/weedopenssh hxxp://146[.]19[.]143[.]149/weedtftp hxxp://146[.]19[.]143[.]149/weedntpd hxxp://146[.]19[.]143[.]149/weed[.]sh hxxp://146[.]19[.]143[.]149/weedshit hxxp://146[.]19[.]143[.]149/weedcron hxxp://146[.]19[.]143[.]149/weedapache2 hxxp://146[.]19[.]143[.]149/weedtelnetd hxxp://146[.]19[.]143[.]149/weedpftp hxxp://146[.]19[.]143[.]149/weedsh hxxp://146[.]19[.]143[.]149/weedwget hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]arm4 hxxp://156[.]253[.]227[.]62/skid[.]arm6 hxxp://156[.]253[.]227[.]62/skid[.]mpsl hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]sparc hxxp://156[.]253[.]227[.]62/skid[.]sparc hxxp://156[.]253[.]227[.]62/skid[.]x86 hxxp://156[.]253[.]227[.]62/8arm58 hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]mpsl hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]arm6 hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]arm7 hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]arm5 hxxp://156[.]253[.]227[.]62/skid[.]mips hxxp://156[.]253[.]227[.]62/8mips8 hxxp://156[.]253[.]227[.]62/skid[.]ppc hxxp://156[.]253[.]227[.]62/8ppc8 hxxp://156[.]253[.]227[.]62/skid[.]arm5 hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]mips hxxp://156[.]253[.]227[.]62/skid[.]arm4 hxxp://148[.]135[.]95[.]104/m-6[.]8-k[.]Sakura hxxp://148[.]135[.]95[.]104/i-5[.]8-6[.]Sakura hxxp://148[.]135[.]95[.]104/m-i[.]p-s[.]Sakura hxxp://148[.]135[.]95[.]104/a-r[.]m-4[.]Sakura hxxp://148[.]135[.]95[.]104/x-3[.]2-[.]Sakura hxxp://148[.]135[.]95[.]104/s-h[.]4-[.]Sakura hxxp://148[.]135[.]95[.]104/a-r[.]m-6[.]Sakura hxxp://148[.]135[.]95[.]104/a-r[.]m-7[.]Sakura hxxp://148[.]135[.]95[.]104/m-p[.]s-l[.]Sakura hxxp://148[.]135[.]95[.]104/x-8[.]6-[.]Sakura hxxp://148[.]135[.]95[.]104/p-p[.]c-[.]Sakura hxxp://148[.]135[.]95[.]104/a-r[.]m-5[.]Sakura hxxp://176[.]65[.]148[.]222/wget hxxp://176[.]65[.]148[.]222/openssh hxxp://176[.]65[.]148[.]222/sh hxxp://176[.]65[.]148[.]222/nut hxxp://176[.]65[.]148[.]222/apache2 hxxp://176[.]65[.]148[.]222/pftp hxxp://176[.]65[.]148[.]222/ntpd hxxp://176[.]65[.]148[.]222/cron hxxp://176[.]65[.]148[.]222/sshd hxxp://176[.]65[.]148[.]222/ftp hxxp://185[.]39[.]207[.]89/gmips hxxp://46[.]29[.]235[.]158/gmips hxxp://185[.]39[.]207[.]89/garm7 hxxp://46[.]29[.]235[.]158/garm7 hxxp://62[.]60[.]232[.]26/garm7 hxxp://156[.]253[.]227[.]62/8sh48 hxxp://156[.]253[.]227[.]62/8spc8 hxxp://156[.]253[.]227[.]62/8m68k8 hxxp://176[.]65[.]148[.]222/bins[.]sh hxxp://148[.]135[.]95[.]104/Sakura[.]sh hxxp://156[.]253[.]227[.]62/skid[.]sh hxxp://156[.]253[.]227[.]62/fuckjewishpeople[.]sh hxxp://176[.]65[.]148[.]37/mssl hxxp://176[.]65[.]148[.]37/msps hxxp://176[.]65[.]148[.]37/kmpsl |
Bashlite |
| URL | hxxps://api[.]telegram[.]org/bot7301807379:AAEZGVLtzhhDQnMsT37EBjrP4vbsZdXDsuA/sendMessage?chat_id=6503988516 | Snake Keylogger |
| URL | hxxp://106[.]75[.]210[.]106/02[.]08[.]2022[.]exe hxxp://196[.]251[.]72[.]189:8080/02[.]08[.]2022[.]exe hxxp://43[.]139[.]124[.]56:8888/02[.]08[.]2022[.]exe hxxp://45[.]136[.]125[.]85:8080/02[.]08[.]2022[.]exe hxxp://23[.]146[.]40[.]13:2082/02[.]08[.]2022[.]exe hxxp://43[.]250[.]174[.]95:8080/02[.]08[.]2022[.]exe hxxp://43[.]133[.]41[.]106/02[.]08[.]2022[.]exe hxxp://118[.]195[.]189[.]82/02[.]08[.]2022[.]exe hxxp://47[.]238[.]140[.]204:5544/02[.]08[.]2022[.]exe hxxp://125[.]77[.]172[.]64:8888/02[.]08[.]2022[.]exe hxxp://166[.]88[.]14[.]137:8001/02[.]08[.]2022[.]exe hxxp://59[.]110[.]233[.]152:8888/02[.]08[.]2022[.]exe hxxp://47[.]102[.]209[.]177:8389/02[.]08[.]2022[.]exe hxxp://43[.]138[.]81[.]232:50051/02[.]08[.]2022[.]exe hxxp://8[.]148[.]20[.]113/02[.]08[.]2022[.]exe hxxp://116[.]198[.]229[.]197:9999/02[.]08[.]2022[.]exe hxxp://36[.]41[.]71[.]241:2086/02[.]08[.]2022[.]exe hxxp://111[.]230[.]244[.]189/02[.]08[.]2022[.]exe hxxp://113[.]45[.]225[.]150:8888/02[.]08[.]2022[.]exe hxxp://120[.]26[.]139[.]176:8080/02[.]08[.]2022[.]exe hxxp://194[.]36[.]171[.]78/02[.]08[.]2022[.]exe hxxp://120[.]46[.]16[.]37:1144/02[.]08[.]2022[.]exe hxxp://47[.]254[.]74[.]170:13561/02[.]08[.]2022[.]exe hxxp://1[.]94[.]249[.]10:888/02[.]08[.]2022[.]exe hxxp://47[.]93[.]25[.]72:9088/02[.]08[.]2022[.]exe hxxp://45[.]159[.]209[.]179/02[.]08[.]2022[.]exe hxxp://179[.]43[.]186[.]234/02[.]08[.]2022[.]exe hxxp://49[.]232[.]56[.]252/02[.]08[.]2022[.]exe hxxp://185[.]215[.]113[.]19//inc/ConsiderableWinners[.]exe hxxp://185[.]215[.]113[.]117//inc/ConsiderableWinners[.]exe hxxp://185[.]243[.]96[.]104:5556/02[.]08[.]2022[.]exe hxxp://118[.]107[.]221[.]14/02[.]08[.]2022[.]exe hxxp://118[.]107[.]221[.]15/02[.]08[.]2022[.]exe hxxp://111[.]173[.]104[.]176:8888/02[.]08[.]2022[.]exe hxxp://129[.]211[.]28[.]117:8443/02[.]08[.]2022[.]exe hxxp://212[.]64[.]73[.]200/02[.]08[.]2022[.]exe hxxp://47[.]100[.]34[.]234/02[.]08[.]2022[.]exe hxxp://113[.]45[.]225[.]150:9999/02[.]08[.]2022[.]exe hxxp://101[.]201[.]76[.]1/02[.]08[.]2022[.]exe hxxp://60[.]204[.]152[.]14/02[.]08[.]2022[.]exe hxxp://143[.]47[.]251[.]31:1435/02[.]08[.]2022[.]exe hxxp://8[.]138[.]119[.]70:5003/beacon[.]bin |
Cobalt Strike |
| URL | hxxp://45[.]230[.]66[.]42:11826/Mozi[.]m hxxp://117[.]209[.]1[.]114:53127/Mozi[.]m hxxp://117[.]232[.]5[.]183:59191/Mozi[.]m hxxp://111[.]9[.]73[.]250:49081/Mozi[.]m |
Mozi |
| URL | hxxps://todocarritos[.]top/www/sss[.]php hxxps://todocarritos[.]top/www/select[.]js hxxps://todocarritos[.]top/www/good[.]js hxxps://islonline[.]org/D[.]JS hxxps://erectilehelp[.]top/www/select[.]js hxxps://erectilehelp[.]top/www/sss[.]php hxxps://haidao10[.]top/www/good[.]js hxxps://haidao10[.]top/www/index[.]php?0dRf8bcr hxxps://haidao10[.]top/www/sss[.]php hxxps://todocarritos[.]top/www/files/Proxy[.]zip?a9b3d8daa70919f77bf5a2f9&a9b3d8daa70919f77bf5a2f9 hxxps://smart-american[.]com/j[.]js hxxps://haidao10[.]top/www/select[.]js hxxps://todocarritos[.]top/www/files/Teleram[.]zip hxxps://erectilehelp[.]top/www/d55b48[.]exe |
NetSupportManager RAT |
| URL | hxxp://88[.]214[.]48[.]26/tpnl98/namen[.]ps1 hxxp://185[.]39[.]17[.]70/zgrnf/namen[.]ps1 hxxp://88[.]214[.]48[.]26/tpnl98/op[.]exe hxxp://88[.]214[.]48[.]26/tpnl98/ret[.]exe hxxp://88[.]214[.]48[.]26/tpnl98/pik[.]ps1 hxxp://185[.]215[.]113[.]19//inc/DCRatBuild[.]exe hxxp://185[.]215[.]113[.]19//inc/AI2[.]exe hxxp://185[.]215[.]113[.]19//inc/cvv[.]exe hxxp://185[.]215[.]113[.]19//inc/onlysteal[.]exe hxxp://185[.]215[.]113[.]117//inc/cvv[.]exe hxxp://185[.]215[.]113[.]117//inc/DCRatBuild[.]exe hxxp://185[.]215[.]113[.]117//inc/onlysteal[.]exe hxxp://185[.]215[.]113[.]117//inc/AI2[.]exe |
DCRat |
| URL | hxxp://185[.]215[.]113[.]19//inc/hashed[.]exe hxxp://185[.]215[.]113[.]19//inc/Channel1[.]exe hxxp://185[.]215[.]113[.]19//inc/Set-up[.]exe hxxp://185[.]215[.]113[.]19//inc/Setup2[.]exe hxxp://185[.]215[.]113[.]19//inc/clcs[.]exe hxxp://185[.]215[.]113[.]19//inc/3546345[.]exe hxxp://185[.]215[.]113[.]19//inc/DOC[.]exe hxxp://185[.]215[.]113[.]19//inc/S%D0%B5tup[.]exe hxxp://185[.]215[.]113[.]19//inc/channel[.]exe hxxp://185[.]215[.]113[.]19//inc/1111[.]exe hxxp://185[.]215[.]113[.]19//inc/S%D0%B5tu%D1%80111[.]exe hxxp://185[.]215[.]113[.]19//inc/file1[.]exe hxxp://185[.]215[.]113[.]117//inc/channel[.]exe hxxp://185[.]215[.]113[.]117//inc/clcs[.]exe hxxp://185[.]215[.]113[.]117//inc/file1[.]exe hxxp://185[.]215[.]113[.]117//inc/Set-up[.]exe hxxp://185[.]215[.]113[.]117//inc/Channel1[.]exe hxxp://185[.]215[.]113[.]117//inc/hashed[.]exe hxxp://185[.]215[.]113[.]117//inc/S%D0%B5tu%D1%80111[.]exe hxxp://185[.]215[.]113[.]117//inc/S%D0%B5tup[.]exe hxxp://185[.]215[.]113[.]117//inc/1111[.]exe hxxp://185[.]215[.]113[.]117//inc/Setup2[.]exe hxxp://185[.]215[.]113[.]117//inc/3546345[.]exe hxxp://185[.]215[.]113[.]117//inc/DOC[.]exe |
CryptBot |
| URL | hxxp://185[.]215[.]113[.]19//inc/WindowsUI[.]exe hxxp://185[.]215[.]113[.]19//inc/rstxdhuj[.]exe hxxp://185[.]215[.]113[.]19//inc/BaddStore[.]exe hxxp://185[.]215[.]113[.]19//inc/1[.]exe hxxp://185[.]215[.]113[.]19//inc/DiskUtility[.]exe hxxp://185[.]215[.]113[.]19//inc/msedge[.]exe hxxp://185[.]215[.]113[.]19//inc/kitty[.]exe hxxp://185[.]215[.]113[.]117//inc/DiskUtility[.]exe hxxp://185[.]215[.]113[.]117//inc/kitty[.]exe hxxp://185[.]215[.]113[.]117//inc/WindowsUI[.]exe hxxp://185[.]215[.]113[.]117//inc/BaddStore[.]exe hxxp://185[.]215[.]113[.]117//inc/msedge[.]exe hxxp://185[.]215[.]113[.]117//inc/rstxdhuj[.]exe hxxp://185[.]215[.]113[.]117//inc/1[.]exe hxxps://ver[.]blackjack[.]lol/load/output[.]bat |
XWorm |
| URL | hxxp://185[.]215[.]113[.]19//inc/GIFT-INFO[.]lMG[.]exe hxxp://185[.]215[.]113[.]19//inc/4ck3rr[.]exe hxxp://185[.]215[.]113[.]19//inc/systems[.]exe hxxp://185[.]215[.]113[.]19//inc/penis[.]exe hxxp://185[.]215[.]113[.]19//inc/cc2[.]exe hxxp://185[.]215[.]113[.]19//inc/crypted[.]exe hxxp://185[.]215[.]113[.]19//inc/new1[.]exe hxxp://185[.]215[.]113[.]19//inc/Operation6572[.]exe hxxp://185[.]215[.]113[.]19//inc/surfex[.]exe hxxp://185[.]215[.]113[.]19//inc/frap[.]exe hxxp://185[.]215[.]113[.]19//inc/anticheat[.]exe hxxp://185[.]215[.]113[.]19//inc/kiyan[.]exe hxxp://185[.]215[.]113[.]19//inc/30072024[.]exe hxxp://185[.]215[.]113[.]19//inc/scheduledllama[.]exe hxxp://185[.]215[.]113[.]19//inc/morphic[.]exe hxxp://185[.]215[.]113[.]19//inc/BattleGermany[.]exe hxxp://185[.]215[.]113[.]19//inc/whiteheroin[.]exe hxxp://185[.]215[.]113[.]19//inc/25072023[.]exe hxxp://185[.]215[.]113[.]19//inc/14082024[.]exe hxxp://185[.]215[.]113[.]19//inc/crypteda[.]exe hxxp://185[.]215[.]113[.]19//inc/js[.]exe hxxp://185[.]215[.]113[.]19//inc/06082025[.]exe hxxp://185[.]215[.]113[.]19//inc/MK[.]exe hxxp://185[.]215[.]113[.]19//inc/xxl[.]exe hxxp://185[.]215[.]113[.]19//inc/bundle[.]exe hxxp://185[.]215[.]113[.]19//inc/newbundle[.]exe hxxp://185[.]215[.]113[.]19//inc/robotic[.]exe hxxp://185[.]215[.]113[.]19//inc/MYNEWRDX[.]exe hxxp://185[.]215[.]113[.]19//inc/GOLD[.]exe hxxp://185[.]215[.]113[.]19//inc/MePaxil[.]exe hxxp://185[.]215[.]113[.]19//inc/buildred[.]exe hxxp://185[.]215[.]113[.]19//inc/cookie250[.]exe hxxp://185[.]215[.]113[.]19//inc/meta[.]exe hxxp://185[.]215[.]113[.]19//inc/drchoe[.]exe hxxp://185[.]215[.]113[.]19//inc/resex[.]exe hxxp://185[.]215[.]113[.]19//inc/newbundle2[.]exe hxxp://185[.]215[.]113[.]19//inc/windowsexecutable[.]exe hxxp://185[.]215[.]113[.]19//inc/vlst[.]exe hxxp://185[.]215[.]113[.]117//inc/meta[.]exe hxxp://185[.]215[.]113[.]117//inc/resex[.]exe hxxp://185[.]215[.]113[.]117//inc/morphic[.]exe hxxp://185[.]215[.]113[.]117//inc/BattleGermany[.]exe hxxp://185[.]215[.]113[.]117//inc/MePaxil[.]exe hxxp://185[.]215[.]113[.]117//inc/penis[.]exe hxxp://185[.]215[.]113[.]117//inc/30072024[.]exe hxxp://185[.]215[.]113[.]117//inc/robotic[.]exe hxxp://185[.]215[.]113[.]117//inc/windowsexecutable[.]exe hxxp://185[.]215[.]113[.]117//inc/06082025[.]exe hxxp://185[.]215[.]113[.]117//inc/vlst[.]exe hxxp://185[.]215[.]113[.]117//inc/drchoe[.]exe hxxp://185[.]215[.]113[.]117//inc/MYNEWRDX[.]exe hxxp://185[.]215[.]113[.]117//inc/systems[.]exe hxxp://185[.]215[.]113[.]117//inc/cc2[.]exe hxxp://185[.]215[.]113[.]117//inc/xxl[.]exe hxxp://185[.]215[.]113[.]117//inc/whiteheroin[.]exe hxxp://185[.]215[.]113[.]117//inc/frap[.]exe hxxp://185[.]215[.]113[.]117//inc/14082024[.]exe hxxp://185[.]215[.]113[.]117//inc/kiyan[.]exe hxxp://185[.]215[.]113[.]117//inc/newbundle[.]exe hxxp://185[.]215[.]113[.]117//inc/25072023[.]exe hxxp://185[.]215[.]113[.]117//inc/crypteda[.]exe hxxp://185[.]215[.]113[.]117//inc/js[.]exe hxxp://185[.]215[.]113[.]117//inc/4ck3rr[.]exe hxxp://185[.]215[.]113[.]117//inc/cookie250[.]exe hxxp://185[.]215[.]113[.]117//inc/surfex[.]exe hxxp://185[.]215[.]113[.]117//inc/crypted[.]exe hxxp://185[.]215[.]113[.]117//inc/MK[.]exe hxxp://185[.]215[.]113[.]117//inc/GOLD[.]exe hxxp://185[.]215[.]113[.]117//inc/bundle[.]exe hxxp://185[.]215[.]113[.]117//inc/new1[.]exe hxxp://185[.]215[.]113[.]117//inc/buildred[.]exe hxxp://185[.]215[.]113[.]117//inc/GIFT-INFO[.]lMG[.]exe hxxp://185[.]215[.]113[.]117//inc/anticheat[.]exe hxxp://185[.]215[.]113[.]117//inc/newbundle2[.]exe hxxp://185[.]215[.]113[.]117//inc/Operation6572[.]exe hxxp://185[.]215[.]113[.]117//inc/scheduledllama[.]exe hxxp://185[.]39[.]17[.]162/files/5308024245/JLVnvnZ[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]215[.]113[.]19//inc/PharmaciesDetection[.]exe hxxp://185[.]215[.]113[.]19//inc/seo[.]exe hxxp://185[.]215[.]113[.]19//inc/noll[.]exe hxxp://185[.]215[.]113[.]19//inc/InfluencedNervous[.]exe hxxp://185[.]215[.]113[.]19//inc/vidar[.]exe hxxp://185[.]215[.]113[.]117//inc/vidar[.]exe hxxp://185[.]215[.]113[.]117//inc/noll[.]exe hxxp://185[.]215[.]113[.]117//inc/seo[.]exe hxxp://185[.]215[.]113[.]117//inc/PharmaciesDetection[.]exe hxxp://185[.]215[.]113[.]117//inc/InfluencedNervous[.]exe |
Vidar |
| URL | hxxp://185[.]215[.]113[.]19//inc/winn[.]exe hxxp://185[.]215[.]113[.]19//inc/HVNC1[.]exe hxxp://185[.]215[.]113[.]19//inc/5KNCHALAH[.]exe hxxp://185[.]215[.]113[.]19//inc/T3[.]exe hxxp://185[.]215[.]113[.]117//inc/HVNC1[.]exe hxxp://185[.]215[.]113[.]117//inc/winn[.]exe hxxp://185[.]215[.]113[.]117//inc/5KNCHALAH[.]exe hxxp://185[.]215[.]113[.]117//inc/T3[.]exe |
PureCrypter |
| URL | hxxp://185[.]215[.]113[.]19//inc/Mswgoudnv[.]exe hxxp://185[.]215[.]113[.]19//inc/Ukodbcdcl[.]exe hxxp://185[.]215[.]113[.]19//inc/Ewpeloxttug[.]exe hxxp://185[.]215[.]113[.]19//inc/gawdth[.]exe hxxp://185[.]215[.]113[.]19//inc/jsawdtyjde[.]exe hxxp://185[.]215[.]113[.]19//inc/Cvimelugfq[.]exe hxxp://185[.]215[.]113[.]19//inc/Cbmefxrmnv[.]exe hxxp://185[.]215[.]113[.]19//inc/uhigdbf[.]exe hxxp://185[.]215[.]113[.]19//inc/Opdxdyeul[.]exe hxxp://185[.]215[.]113[.]117//inc/Opdxdyeul[.]exe hxxp://185[.]215[.]113[.]117//inc/Cvimelugfq[.]exe hxxp://185[.]215[.]113[.]117//inc/Cbmefxrmnv[.]exe hxxp://185[.]215[.]113[.]117//inc/uhigdbf[.]exe hxxp://185[.]215[.]113[.]117//inc/jsawdtyjde[.]exe hxxp://185[.]215[.]113[.]117//inc/Ukodbcdcl[.]exe hxxp://185[.]215[.]113[.]117//inc/Ewpeloxttug[.]exe hxxp://185[.]215[.]113[.]117//inc/Mswgoudnv[.]exe hxxp://185[.]215[.]113[.]117//inc/gawdth[.]exe |
SystemBC |
| URL | hxxp://185[.]215[.]113[.]19//inc/SingerJudy[.]exe hxxp://185[.]215[.]113[.]19//inc/AnneSalt[.]exe hxxp://185[.]215[.]113[.]19//inc/XClient_protected[.]exe hxxp://185[.]215[.]113[.]117//inc/AnneSalt[.]exe hxxp://185[.]215[.]113[.]117//inc/SingerJudy[.]exe hxxp://185[.]215[.]113[.]117//inc/XClient_protected[.]exe |
Venom RAT |
| URL | hxxp://185[.]215[.]113[.]19//inc/ufw[.]exe hxxp://185[.]215[.]113[.]19//inc/3544436[.]exe hxxp://185[.]215[.]113[.]19//inc/dccrypt[.]exe hxxp://185[.]215[.]113[.]19//inc/DecryptJohn[.]exe hxxp://185[.]215[.]113[.]117//inc/DecryptJohn[.]exe hxxp://185[.]215[.]113[.]117//inc/3544436[.]exe hxxp://185[.]215[.]113[.]117//inc/ufw[.]exe hxxp://185[.]215[.]113[.]117//inc/dccrypt[.]exe |
PureLogs Stealer |
| URL | hxxp://185[.]215[.]113[.]19//inc/crypted8888[.]exe hxxp://185[.]215[.]113[.]117//inc/crypted8888[.]exe |
Mars Stealer |
| URL | hxxp://185[.]215[.]113[.]19//inc/neon[.]exe hxxp://185[.]215[.]113[.]19//inc/armadegon[.]exe hxxp://185[.]215[.]113[.]19//inc/neonn[.]exe hxxp://185[.]215[.]113[.]117//inc/armadegon[.]exe hxxp://185[.]215[.]113[.]117//inc/neonn[.]exe hxxp://185[.]215[.]113[.]117//inc/neon[.]exe |
DarkTortilla |
| URL | hxxp://185[.]215[.]113[.]19//inc/NorthSperm[.]exe hxxp://185[.]215[.]113[.]117//inc/NorthSperm[.]exe |
StormKitty |
| URL | hxxp://185[.]215[.]113[.]19//inc/soft2[.]exe hxxp://185[.]215[.]113[.]117//inc/soft2[.]exe |
DanaBot |
| URL | hxxp://185[.]215[.]113[.]19//inc/Pichon[.]exe hxxp://185[.]215[.]113[.]19//inc/cclent[.]exe hxxp://185[.]215[.]113[.]117//inc/cclent[.]exe hxxp://185[.]215[.]113[.]117//inc/Pichon[.]exe hxxp://185[.]39[.]17[.]162/files/1781548144/CzdmqAp[.]exe hxxps://raw[.]githubusercontent[.]com/wasdw8606/wasdw8606pw/refs/heads/main/Windows%20Update[.]exe hxxps://raw[.]githubusercontent[.]com/TestingMyInfomration123/123/refs/heads/main/Client-built[.]exe |
Quasar RAT |
| URL | hxxp://185[.]215[.]113[.]19//inc/OneDrive[.]exe hxxp://185[.]215[.]113[.]19//inc/Client_protected[.]exe hxxp://185[.]215[.]113[.]19//inc/PkContent[.]exe hxxp://185[.]215[.]113[.]117//inc/PkContent[.]exe hxxp://185[.]215[.]113[.]117//inc/Client_protected[.]exe hxxp://185[.]215[.]113[.]117//inc/OneDrive[.]exe hxxps://raw[.]githubusercontent[.]com/virusstudiov64/rat/main/sdc[.]exe |
NjRAT |
| URL | hxxp://185[.]215[.]113[.]19//inc/nano[.]exe hxxp://185[.]215[.]113[.]19//inc/Survox[.]exe hxxp://185[.]215[.]113[.]117//inc/nano[.]exe hxxp://185[.]215[.]113[.]117//inc/Survox[.]exe hxxps://raw[.]githubusercontent[.]com/doodoofart3443/test/refs/heads/main/file5[.]exe hxxps://raw[.]githubusercontent[.]com/doodoofart3443/test/refs/heads/main/file[.]exe hxxps://raw[.]githubusercontent[.]com/doodoofart3443/test/refs/heads/main/file4[.]exe |
Nanocore RAT |
| URL | hxxp://185[.]215[.]113[.]19//inc/file[.]exe hxxp://185[.]215[.]113[.]19//inc/DEF[.]exe hxxp://185[.]215[.]113[.]117//inc/DEF[.]exe hxxp://185[.]215[.]113[.]117//inc/file[.]exe hxxp://188[.]127[.]231[.]170/460/cent/camewithbesttechnologygivenmebestthingsentierimte______camewithbesttechnologygivenmebestthingsentierimte___camewithbesttechnologygivenmebestthingsentierimte[.]doc |
Remcos |
| URL | hxxp://185[.]215[.]113[.]19//inc/Rage[.]exe hxxp://185[.]215[.]113[.]117//inc/Rage[.]exe hxxps://nationaldefencebackup[.]xyz/doc/Adjustable[.]lpk hxxps://nationaldefencebackup[.]xyz/doc/YbfbcYauWIi174[.]bin hxxps://nationaldefencebackup[.]xyz/doc/gNLwUw23[.]bin hxxps://nationaldefencebackup[.]xyz/doc/Brawlers[.]sea hxxp://178[.]173[.]244[.]118/wuBQR165[.]bin |
CloudEyE |
| URL | hxxp://185[.]215[.]113[.]19//inc/kill[.]exe hxxp://185[.]215[.]113[.]117//inc/kill[.]exe |
SmokeLoader |
| URL | hxxp://185[.]215[.]113[.]19//inc/clsid[.]exe hxxp://185[.]215[.]113[.]117//inc/clsid[.]exe |
Agent Tesla |
| URL | hxxp://216[.]126[.]229[.]166:1224/pdown hxxp://144[.]172[.]100[.]142:1224/pdown hxxp://144[.]172[.]103[.]97:1224/pdown |
BeaverTail |
| URL | hxxp://68[.]183[.]17[.]155/msf[.]exe hxxp://182[.]92[.]113[.]13:8000/svchost[.]exe hxxp://103[.]71[.]220[.]28/shelltcp[.]exe |
Meterpreter |
| URL | hxxp://203[.]115[.]83[.]231:88/login[.]php | BlackNET RAT |
| URL | hxxp://185[.]208[.]156[.]208/win/checking[.]ps1 | XMRig |
| URL | hxxps://www[.]smoffrs[.]ru/s/42cf1c2250951 | Latrodectus |
| URL | hxxp://143[.]198[.]186[.]79:8000/client[.]exe | Havoc |
| URL | hxxps://raw[.]githubusercontent[.]com/penivai3sdfs1/1/refs/heads/main/24321[.]exe hxxps://raw[.]githubusercontent[.]com/BankXAdmin/Free-PhotoShop-Meme-Coin-Packs/refs/heads/main/FreePhotoShop%20Meme%20Coin%20Packs[.]exe hxxps://raw[.]githubusercontent[.]com/softrust11/sdfdf/refs/heads/main/1[.]exe |
Phemedrone Stealer |
| URL | hxxp://222[.]187[.]239[.]136:9518/ctfmo[.]bin | KrBanker |
