不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/05/07
※2025/05/07 更新
マルウェア感染させると考えられるURLを検知（2025/05/07）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://www[.]4sync[.]com/web/directDownload/gPp9O6FS/LO8xSpi2[.]e58d1db51e9c61f9e939f307fb0c0d77 hxxp://91[.]200[.]14[.]153/Downloads/pupa[.]pdf[.]lnk hxxp://91[.]200[.]14[.]153/Downloads/window_order[.]pdf[.]lnk |
Emmenhtal |
| URL | hxxps://otechsyncq[.]run/riid hxxps://obtcgeared[.]live/lbak hxxps://aureliae[.]run/tajsh hxxps://dogalmedical[.]org/xap hxxps://3jawdedmirror[.]run/ewqd hxxps://8quilltayle[.]live/gksi hxxps://moleqew[.]run/hdaf hxxps://7lonfgshadow[.]live/xawi hxxps://3tliftally[.]top/xasj hxxps://gpiratetwrath[.]run/ytus hxxps://dzestmodp[.]top/zeda hxxps://alatitudert[.]live/teui hxxps://4esccapewz[.]run/ANSbwqy hxxps://eliftally[.]top/xasj hxxps://zlatitudert[.]live/teui hxxps://ipiratetwrath[.]run/ytus hxxps://f[.]hemispherexz[.]top/xapp hxxps://buequatorf[.]run/reiq hxxps://gsmartbitsx[.]digital/tqbdz hxxps://mexratet[.]digital/tnaj hxxps://0nighetwhisper[.]top/lekd hxxps://2salaccgfa[.]top/gsooz hxxps://c0clarmodq[.]top/qoxo hxxps://qlongitudde[.]digital/wizu hxxps://o3clarmodq[.]top/qoxo hxxps://xtopographky[.]top/xlak hxxps://revomodm[.]run/pokl hxxps://2zjawdedmirror[.]run/ewqd hxxps://pzestmodp[.]top/zeda hxxps://npiratetwrath[.]run/ytus hxxps://6kjawdedmirror[.]run/ewqd hxxps://okapigdf[.]run/iuyd hxxps://eclarmodq[.]top/qoxo hxxps://cywmedici[.]top/noagis hxxps://2zestmodp[.]top/zeda hxxps://pnighetwhisper[.]top/lekd hxxps://njawdedmirror[.]run/ewqd hxxps://kquilltayle[.]live/gksi hxxps://aclimatologfy[.]top/kbud hxxps://0biosphxere[.]digital/tqoa hxxps://jproenhann[.]digital/thnb hxxps://n9changeaie[.]top/geps hxxps://frlonfgshadow[.]live/xawi hxxps://wawrdenshire[.]digital/oagx hxxps://zgeographys[.]run/eirq hxxps://apiratetwrath[.]run/ytus hxxps://zfishgh[.]digital/tequ hxxps://jbiosphxere[.]digital/tqoa hxxps://z1topographky[.]top/xlak hxxps://yjawdedmirror[.]run/ewqd hxxps://8jgeographys[.]run/eirq hxxps://qbiosphxere[.]digital/tqoa hxxps://alongitudde[.]digital/wizu hxxps://ztouvrlane[.]bet/ASKwjq hxxps://pquilltayle[.]live/gksi hxxps://oclimatologfy[.]top/kbud hxxps://jclimatologfy[.]top/kbud hxxps://wvigorbridgoe[.]top/banb hxxps://chemispherexz[.]top/xapp hxxps://wpquilltayle[.]live/gksi hxxps://zstarofliught[.]top/wozd hxxps://8latitudert[.]live/teui hxxps://6owlflright[.]digital/qopy hxxps://0changeaie[.]top/geps hxxps://lvigorbridgoe[.]top/banb hxxps://zbstarofliught[.]top/wozd hxxps://ztopographky[.]top/xlak hxxps://h2jawdedmirror[.]run/ewqd hxxps://porpoisecx[.]run/torieu hxxps://lancefighsg[.]run/agio hxxps://sdynamiczl[.]live/tgre hxxps://etjawdedmirror[.]run/ewqd hxxps://ocartograhphy[.]top/ixau hxxps://pvigorbridgoe[.]top/banb hxxps://mtropiscbs[.]live/iuwxx hxxps://l2zestmodp[.]top/zeda hxxps://hsalaccgfa[.]top/gsooz hxxps://bjawdedmirror[.]run/ewqd hxxps://jowlflright[.]digital/qopy hxxps://1salaccgfa[.]top/gsooz hxxps://econnit[.]digital/tqoi hxxps://nlonfgshadow[.]live/xawi hxxps://ystarofliught[.]top/wozd hxxps://7hemispherexz[.]top/xapp hxxps://kchangeaie[.]top/geps hxxps://8pepperiop[.]digital/oage hxxps://anemonebv[.]run/agaosnd hxxps://gtopographky[.]top/xlak hxxps://stoatrt[.]live/oapd hxxps://slovenecow[.]live/tanb hxxps://afreeconx[.]live/babo hxxps://dchangeaie[.]top/geps hxxps://4hemispherexz[.]top/xapp hxxps://ajawdedmirror[.]run/ewqd hxxps://5salaccgfa[.]top/gsooz hxxps://i6easyfwdr[.]digital/azxs hxxps://nquilltayle[.]live/gksi hxxps://hstarofliught[.]top/wozd hxxps://pldcbus[.]digital/idjj hxxps://2piratetwrath[.]run/ytus hxxps://lstarofliught[.]top/wozd hxxps://sequatorf[.]run/reiq hxxps://2owlflright[.]digital/qopy hxxps://4biosphxere[.]digital/tqoa hxxps://cowlflright[.]digital/qopy hxxps://8fstarofliught[.]top/wozd hxxps://antelopej[.]run/xaps hxxps://uspacedbv[.]world/EKdlsk hxxps://3lonfgshadow[.]live/xawi hxxps://cxquilltayle[.]live/gksi hxxps://wqeinqene[.]com/api hxxps://5latitudert[.]live/teui hxxps://lyjawdedmirror[.]run/ewqd hxxps://xagroeconb[.]live/bayz hxxps://yhqclimatologfy[.]top/kbud hxxps://a[.]owlflright[.]digital/qopy hxxps://kgeographys[.]run/eirq hxxps://turtlery[.]run/aopi hxxps://anighetwhisper[.]top/lekd hxxps://wequatorf[.]run/reiq hxxps://6geographys[.]run/eirq hxxps://0latitudert[.]live/teui hxxps://4longitudde[.]digital/wizu hxxps://iquilltayle[.]live/gksi hxxps://wcartograhphy[.]top/ixau hxxps://btwilitghtarc[.]live/gposzd hxxps://econbult[.]live/gant hxxps://2starofliught[.]top/wozd hxxps://scriptorumh[.]live/dzkl hxxps://4uclarmodq[.]top/qoxo hxxps://fkbiosphxere[.]digital/tqoa hxxps://indoeconw[.]live/rqwr hxxps://bpiratetwrath[.]run/ytus hxxps://0hgeographys[.]run/eirq hxxps://mwtquilltayle[.]live/gksi hxxps://quselfdefens[.]bet/dASBUz hxxps://r43owlflright[.]digital/qopy hxxps://yglongitudde[.]digital/wizu hxxps://8nighetwhisper[.]top/lekd hxxps://n5biosphxere[.]digital/tqoa hxxps://4owlflright[.]digital/qopy hxxps://6zestmodp[.]top/zeda hxxps://0climatologfy[.]top/kbud hxxps://q0topographky[.]top/xlak hxxps://4ywmedici[.]top/noagis hxxps://1owlflright[.]digital/qopy hxxps://cbuzzarddf[.]live/ktnt hxxps://8woodpeckersd[.]run/glsk hxxps://nsalaccgfa[.]top/gsooz hxxps://1changeaie[.]top/geps hxxps://svigorbridgoe[.]top/banb hxxps://dorangemyther[.]live/IozZ hxxps://smartbitsx[.]digital/tqbdz hxxps://stratinfot[.]live/tooz hxxps://hclimatologfy[.]top/kbud hxxps://sclimatologfy[.]top/kbud hxxps://pttb-opi[.]xyz/api hxxps://vlmrodularmall[.]top/aNzS hxxps://8esalaccgfa[.]top/gsooz hxxps://tsalaccgfa[.]top/gsooz hxxps://qpiratetwrath[.]run/ytus hxxps://ulonfgshadow[.]live/xawi hxxps://nstarofliught[.]top/wozd hxxps://ygeographys[.]run/eirq hxxps://a9topographky[.]top/xlak hxxps://9owlflright[.]digital/qopy hxxps://2liftally[.]top/xasj hxxps://cstarofliught[.]top/wozd hxxps://oequatorf[.]run/reiq hxxps://zchangeaie[.]top/geps hxxps://hedgehocvg[.]digital/yhio hxxps://themispherexz[.]top/xapp hxxps://ojawdedmirror[.]run/ewqd hxxps://hzlatitudert[.]live/teui hxxps://7xrfxcaseq[.]live/gspaz hxxps://50woodpeckersd[.]run/glsk hxxps://atirflee[.]world/KEnsj hxxps://e0ynighetwhisper[.]top/lekd hxxps://oclarmodq[.]top/qoxo hxxps://hdragoqnfly[.]run/qopwe hxxps://uclarmodq[.]top/qoxo hxxps://gcrosshairc[.]life/dAnjhw hxxps://lmlatitudert[.]live/teui hxxps://9piratetwrath[.]run/ytus hxxps://v3nvigorbridgoe[.]top/banb hxxps://2biosphxere[.]digital/tqoa hxxps://fjliftally[.]top/xasj hxxps://gnighetwhisper[.]top/lekd hxxps://awxayfarer[.]live/ALosnz hxxps://rugbybrign[.]life/gKAozj hxxps://mquilltayle[.]live/gksi hxxps://asylumejkr[.]icu/api hxxps://fpiratetwrath[.]run/ytus hxxps://6hemispherexz[.]top/xapp hxxps://llongitudde[.]digital/wizu hxxps://jchangeaie[.]top/geps hxxps://bowlflright[.]digital/qopy hxxps://nhemispherexz[.]top/xapp hxxps://gsighbtseeing[.]shop/ASJnzh hxxps://0cartograhphy[.]top/ixau hxxps://zdvigorbridgoe[.]top/banb hxxps://zliftally[.]top/xasj hxxps://ybardcauft[.]run/tured hxxps://zjawdedmirror[.]run/ewqd hxxps://kcartograhphy[.]top/ixau hxxps://uquilltayle[.]live/gksi hxxps://silveyrmoon[.]live/aqwozp hxxps://ggrxeasyw[.]digital/xxepw hxxps://valortruade[.]run/zqwig hxxps://n6nighetwhisper[.]top/lekd hxxps://xadvennture[.]top/GKsiio hxxps://5changeaie[.]top/geps hxxps://zfurrycomp[.]top/kFwo hxxps://ofreshenqew[.]digital/wpoo hxxps://3weaponwo[.]life/NghsayA hxxps://jquilltayle[.]live/gksi hxxps://lnighetwhisper[.]top/lekd hxxps://xlatitudert[.]live/teui hxxps://0owlflright[.]digital/qopy hxxps://2clarmodq[.]top/qoxo hxxps://4cartograhphy[.]top/ixau hxxps://1selfdefens[.]bet/dASBUz hxxps://7owlflright[.]digital/qopy hxxps://v0zestmodp[.]top/zeda hxxps://vtropiscbs[.]live/iuwxx hxxps://sstarofliught[.]top/wozd hxxps://wznxcelmodo[.]run/nahd hxxps://antilcvope[.]live/rtdd hxxps://rmywmedici[.]top/noagis hxxps://knightliyway[.]run/gpazdg hxxps://nliftally[.]top/xasj hxxps://etopographky[.]top/xlak hxxps://2nighetwhisper[.]top/lekd hxxps://gclimatologfy[.]top/kbud hxxps://5quilltayle[.]live/gksi hxxps://0woodpeckersd[.]run/glsk hxxps://qsectorecoo[.]live/btnf hxxps://hpiratetwrath[.]run/ytus hxxps://eowlflright[.]digital/qopy hxxps://8climatologfy[.]top/kbud hxxps://devloopt[.]live/GiaOzp hxxps://5liftally[.]top/xasj hxxps://4salaccgfa[.]top/gsooz hxxps://atopographky[.]top/xlak hxxps://znighetwhisper[.]top/lekd hxxps://flatitudert[.]live/teui hxxps://z9changeaie[.]top/geps hxxps://4veasyupgw[.]live/eosz hxxps://1liftally[.]top/xasj hxxps://0darjkafsg[.]digital/aoiz hxxps://2lonfgshadow[.]live/xawi hxxps://hungreecoq[.]run/tqow hxxps://jellyfisnbnh[.]live/ijnn hxxps://6climatologfy[.]top/kbud hxxps://7woodpeckersd[.]run/glsk hxxps://7bearjk[.]live/benj hxxps://43liftally[.]top/xasj hxxps://hgazellevb[.]digital/poai hxxps://clongitudde[.]digital/wizu hxxps://steelgoy[.]run/pqowen hxxps://dragoqnfly[.]run/qopwe hxxps://2newzeconi[.]digital/tikl hxxps://0r[.]zestmodp[.]top/zeda hxxps://3-starofliught[.]top/wozd hxxps://n24nighetwhisper[.]top/lekd hxxps://h9bardcauft[.]run/tured hxxps://rtravewlio[.]shop/ZNxbHi hxxps://jlatitudert[.]live/teui hxxps://econbele[.]digital/agji hxxps://mutedhofrn[.]live/xaebyd hxxps://rcartograhphy[.]top/ixau hxxps://bcjlaspcorne[.]icu/DbIps hxxps://6fzestmodp[.]top/zeda hxxps://0quilltayle[.]live/gksi hxxps://ibiosphxere[.]digital/tqoa hxxps://telvernwood[.]digital/gids hxxps://lsalaccgfa[.]top/gsooz hxxps://9tropiscbs[.]live/iuwxx hxxps://udrbettere[.]live/aniodg hxxps://qlatitudert[.]live/teui hxxps://1longitudde[.]digital/wizu hxxps://estarofliught[.]top/wozd hxxps://jxrfxcaseq[.]live/gspaz hxxps://ferrexz[.]run/gsazx hxxps://3starofliught[.]top/wozd hxxps://4liftally[.]top/xasj hxxps://7vigorbridgoe[.]top/banb hxxps://pselfdefens[.]bet/dASBUz hxxps://9geographys[.]run/eirq hxxps://vhemispherexz[.]top/xapp hxxps://nnighetwhisper[.]top/lekd hxxps://0equatorf[.]run/reiq hxxps://triggerte[.]digital/DKsuq hxxps://hmediaflowq[.]run/aeui hxxps://abuzzarddf[.]live/ktnt hxxps://jliftally[.]top/xasj hxxps://gqzestmodp[.]top/zeda hxxps://6starofliught[.]top/wozd hxxps://enighetwhisper[.]top/lekd hxxps://techfocusm[.]run/gnny hxxps://rebuildecuon[.]digital/tnpp hxxps://hlatitudert[.]live/teui hxxps://ycartograhphy[.]top/ixau hxxps://8elvernwood[.]digital/gids hxxps://9quilltayle[.]live/gksi hxxps://xgeographys[.]run/eirq hxxps://n3climatologfy[.]top/kbud hxxps://7liftally[.]top/xasj hxxps://9zestmodp[.]top/zeda hxxps://pwoodpeckersd[.]run/glsk hxxps://cnavstarx[.]shop/FoaJSi hxxps://mbnighetwhisper[.]top/lekd hxxps://0piratetwrath[.]run/ytus hxxps://ibequatorf[.]run/reiq hxxps://dlatitudert[.]live/teui hxxps://jnighetwhisper[.]top/lekd hxxps://zowlflright[.]digital/qopy hxxps://zbardcauft[.]run/tured hxxps://elongitudde[.]digital/wizu hxxps://t9piratetwrath[.]run/ytus hxxps://ppiratetwrath[.]run/ytus hxxps://fhemispherexz[.]top/xapp hxxps://blongitudde[.]digital/wizu hxxps://t[.]salaccgfa[.]top/gsooz hxxps://requatorf[.]run/reiq hxxps://hjawdedmirror[.]run/ewqd hxxps://3wjawdedmirror[.]run/ewqd hxxps://falcondfy[.]digital/vtys hxxps://tjrxsafer[.]top/shpaoz hxxps://dliftally[.]top/xasj hxxps://thiefbshadow[.]run/nogsz hxxps://japeconu[.]run/anbr hxxps://medievalarth[.]live/xewqz hxxps://8changeaie[.]top/geps hxxps://9esccapewz[.]run/ANSbwqy hxxps://tjawdedmirror[.]run/ewqd hxxps://9liftally[.]top/xasj hxxps://zzestmodp[.]top/zeda hxxps://lbardcauft[.]run/tured hxxps://techwaveg[.]run/oipz hxxps://4[.]changeaie[.]top/geps hxxps://techmindj[.]live/pozz hxxps://gbardcauft[.]run/tured hxxps://82quilltayle[.]live/gksi hxxps://fzestmodp[.]top/zeda hxxps://mmexratet[.]digital/tnaj hxxps://neburonz[.]shop/AISOpzs hxxps://phemispherexz[.]top/xapp hxxps://wizardholdp[.]run/wiqza hxxps://dnighetwhisper[.]top/lekd hxxps://nechangeaie[.]top/geps hxxps://inighetwhisper[.]top/lekd hxxps://uugeographys[.]run/eirq hxxps://gbweaponwo[.]life/NghsayA hxxps://dequatorf[.]run/reiq hxxps://i5svigorbridgoe[.]top/banb hxxps://zquilltayle[.]live/gksi hxxps://cwoodpeckersd[.]run/glsk hxxps://xtropiscbs[.]live/iuwxx hxxps://w7quilltayle[.]live/gksi hxxps://xsalaccgfa[.]top/gsooz hxxps://spiderq[.]run/oiwq hxxps://9rlonfgshadow[.]live/xawi hxxps://kclimatologfy[.]top/kbud hxxps://9biosphxere[.]digital/tqoa hxxps://kosalaccgfa[.]top/gsooz hxxps://onighetwhisper[.]top/lekd hxxps://wlatitudert[.]live/teui hxxps://kmediaflowq[.]run/aeui hxxps://swoodpeckersd[.]run/glsk hxxps://mjawdedmirror[.]run/ewqd hxxps://4mlongitudde[.]digital/wizu hxxps://olatitudert[.]live/teui hxxps://ferry-champage[.]cyou/api hxxps://dbxattlepath[.]digital/ogda hxxps://0tpistolpra[.]bet/dABYyaz hxxps://nzealjkh[.]digital/qpte hxxps://xx9piratetwrath[.]run/ytus hxxps://xliftally[.]top/xasj hxxps://asoursopsf[.]run/gsoiao hxxps://jclarmodq[.]top/qoxo hxxps://hequatorf[.]run/reiq hxxps://achangeaie[.]top/geps hxxps://z2starofliught[.]top/wozd hxxps://wscriptao[.]digital/vpep hxxps://pbrandihx[.]run/lowp hxxps://9baseurzv[.]run/asuz hxxps://mtpraetori[.]live/vepr hxxps://hgcivitasu[.]run/werrp hxxps://8disciplipna[.]top/eqwu hxxps://4civitasu[.]run/werrp hxxps://1opusculy[.]top/keaj hxxps://2viriatoe[.]live/laopx hxxp://80[.]64[.]18[.]219/files/6336929412/bPtJj46[.]exe hxxp://80[.]64[.]18[.]219/files/unique1/random[.]exe hxxp://80[.]64[.]18[.]219/files/7453936223/08IyOOF[.]exe hxxp://80[.]64[.]18[.]219/files/fate/random[.]exe hxxps://rdisciplipna[.]top/eqwu hxxps://orjinalecza[.]net/lxaz hxxps://eczakozmetik[.]net/qop hxxps://orijinalecza[.]org/jub hxxps://aeczamedikal[.]org/vax hxxps://orijinalecza[.]net/kazd hxxps://medicalbitkisel[.]net/juj hxxp://185[.]39[.]17[.]162/files/5964778733/jYKC9dZ[.]exe hxxps://github[.]com/legendary99999/fdbafdbadbadb/releases/download/ale1/ale1[.]exe hxxps://github[.]com/legendary99999/sddfsfds/releases/download/dsadsasdaasd/alex1231231123[.]exe hxxps://github[.]com/legendary99999/klmdfbsfdbaf/releases/download/fbnsfdbs/crypted[.]69[.]exe hxxps://github[.]com/legendary99999/sdfdfsdfsfds/releases/download/sdfdfsdfs/installer[.]exe hxxps://github[.]com/legendary99999/dfdsffdsfds/releases/download/dsfdfsdsfdsf/goldik121212[.]exe hxxps://github[.]com/legendary99999/cr2/releases/download/cr2/cr2[.]exe hxxps://github[.]com/legendary99999/lllll/releases/download/nnnn/ale22[.]exe hxxps://github[.]com/legendary99999/bvfdabadfbd/releases/download/cr1/cr1[.]exe hxxps://github[.]com/legendary99999/vdfavadfv/releases/download/fvsfdvbafd/ale222[.]exe hxxps://github[.]com/legendary99999/afdbafbafdba/releases/download/vafdvafvafv/joker1221[.]exe hxxps://ztortoisgfe[.]top/paxk hxxps://fmedicalbitkisel[.]net/juj hxxps://baseurzv[.]run/asuz hxxps://ksnakejh[.]top/adsk hxxps://aeneasq[.]live/nmgj hxxps://borijinalecza[.]org/jub hxxps://xsnakejh[.]top/adsk hxxps://ftortoisgfe[.]top/paxk hxxps://sformydab[.]run/gaus hxxps://github[.]com/legendary99999/fvdadvafbvaf/releases/download/gafdgafbaefd/EXE[.]exe hxxps://github[.]com/legendary99999/fbadsddfsbadfbadb/releases/download/sdvdfavadfv/cron2[.]exe hxxps://github[.]com/legendary99999/bfdabsdbsdbbdsb/releases/download/bsdfbsfdbadsbf/Shy_lzt_crypted_LAB[.]exe hxxps://github[.]com/legendary99999/fdbdfsbsfgbgbs/releases/download/fbaadfbfabdfafabdfbsdfbabfd/crypted[.]2[.]exe hxxps://github[.]com/legendary99999/fdvsdfvdsfvsdfv/releases/download/vfdbvadfvafdvafdf/cron1[.]exe hxxps://quaestort[.]live/toquw hxxps://porjinalecza[.]net/lxaz hxxps://ljorijinalecza[.]org/jub hxxps://hexitiumt[.]digital/xane hxxps://dhemispherexz[.]top/xapp hxxps://zmedicalbitkisel[.]net/juj hxxps://porijinalecza[.]net/kazd hxxps://0opusculy[.]top/keaj hxxps://scivitasu[.]run/werrp hxxp://80[.]64[.]18[.]219/files/6691015685/o0I26V0[.]exe hxxps://github[.]com/legendary99999/cro111/releases/download/cro11111cro111/cron1[.]exe hxxp://80[.]64[.]18[.]219/luma/random[.]exe hxxps://zorijinalecza[.]net/kazd hxxps://zreczamedikal[.]org/vax hxxps://seczamedikal[.]org/vax hxxps://q0eczakozmetik[.]net/qop hxxps://oeczakozmetik[.]net/qop hxxps://o1orjinalecza[.]net/lxaz hxxps://forijinalecza[.]net/kazd hxxps://esnakejh[.]top/adsk hxxps://9medicalbitkisel[.]net/juj hxxps://5vecturar[.]top/zsia hxxps://1snakejh[.]top/adsk hxxps://zaeneasq[.]live/nmgj hxxps://vvecturar[.]top/zsia hxxps://wmedicalbitkisel[.]net/juj hxxps://veczamedikal[.]org/vax hxxps://lsnakejh[.]top/adsk hxxps://jsnakejh[.]top/adsk hxxps://heczamedikal[.]org/vax hxxps://dsnakejh[.]top/adsk hxxps://ceczamedikal[.]org/vax hxxps://8orjinalecza[.]net/lxaz hxxps://4orijinalecza[.]org/jub hxxps://1tortoisgfe[.]top/paxk hxxps://ycivitasu[.]run/werrp hxxps://dscriptao[.]digital/vpep hxxps://drypingzyr[.]run/ariq hxxps://8opusculy[.]top/keaj hxxps://vmedicalbitkisel[.]net/juj hxxp://80[.]64[.]18[.]219/files/5494432675/z4tJzfQ[.]exe hxxp://80[.]64[.]18[.]219/files/6336929412/Q1yLGzl[.]exe hxxps://hackergala[.]digital/gajd hxxps://skcartograhphy[.]top/ixau hxxps://4topographky[.]top/xlak hxxps://rorijinalecza[.]net/kazd hxxps://thinkellk[.]run/nyba hxxps://keczamedikal[.]org/vax hxxps://corjinalecza[.]net/lxaz hxxps://gmedicalbitkisel[.]net/juj hxxps://dorijinalecza[.]org/jub hxxps://callinuxwf[.]run/tnquw hxxps://1orjinalecza[.]net/lxaz hxxps://hvecturar[.]top/zsia hxxps://gorijinalecza[.]org/jub hxxps://dwsnakejh[.]top/adsk hxxps://deczakozmetik[.]net/qop hxxps://rmedicalbitkisel[.]net/juj hxxps://nsnakejh[.]top/adsk hxxps://sorjinalecza[.]net/lxaz hxxps://medikalbitkisel[.]net/qos hxxps://medicalbitkisel[.]org/mbj hxxps://improvxf[.]run/kobe hxxps://vorijinalecza[.]org/jub hxxps://tvecturar[.]top/zsia hxxps://xvorjinalecza[.]net/lxaz hxxps://nmedicalbitkisel[.]net/juj hxxps://ktortoisgfe[.]top/paxk hxxps://dmedikalbitkisel[.]net/qos hxxps://8medicalbitkisel[.]net/juj hxxps://2nbiorijinalecza[.]net/kazd hxxps://7snakejh[.]top/adsk hxxps://1orijinalecza[.]net/kazd hxxps://mtortoisgfe[.]top/paxk hxxps://9vudatawavej[.]digital/bafy hxxps://yvecturar[.]top/zsia hxxps://1climatologfy[.]top/kbud hxxps://copusculy[.]top/keaj hxxps://bdatawavej[.]digital/bafy hxxps://ctechguidet[.]digital/apdo hxxps://ftechmindj[.]live/pozz hxxps://jpraetori[.]live/vepr hxxps://7umigeographys[.]run/eirq hxxps://4bearjk[.]live/benj hxxps://w6topographky[.]top/xlak hxxps://fnodepathr[.]run/oturu hxxps://gbearjk[.]live/benj hxxps://gviriatoe[.]live/laopx hxxps://6orijinalecza[.]org/jub hxxps://8techchaiun[.]live/qwes hxxps://vexitiumt[.]digital/xane hxxps://utortoisgfe[.]top/paxk hxxps://2corexlaib[.]top/xzea hxxps://0twoodpeckersd[.]run/glsk hxxps://kbrandihx[.]run/lowp hxxps://coyoteqw[.]run/retu hxxps://fbtcgeared[.]live/lbak hxxps://odisciplipna[.]top/eqwu hxxps://lzenithcorde[.]top/auid hxxps://obiosphxere[.]digital/tqoa hxxps://jfishgh[.]digital/tequ hxxps://jnscorexlaib[.]top/xzea hxxps://9disciplipna[.]top/eqwu hxxps://mtechsyncq[.]run/riid hxxps://6scriptao[.]digital/vpep hxxps://mbtcgeared[.]live/lbak hxxps://skunkxd[.]live/wezd hxxps://4elonfgshadow[.]live/xawi hxxps://fairytalesw[.]run/ytrn hxxps://8eczamedikal[.]org/vax hxxps://6biosphxere[.]digital/tqoa hxxps://irbuzzarddf[.]live/ktnt hxxps://3civitasu[.]run/werrp hxxps://znavstarx[.]shop/FoaJSi hxxps://ebearjk[.]live/benj hxxps://homelecyfi[.]digital/pqw hxxps://lpraetori[.]live/vepr hxxps://cvigorbridgoe[.]top/banb hxxps://salmonqw[.]live/gdat hxxps://2tropiscbs[.]live/iuwxx hxxps://9cartograhphy[.]top/ixau hxxps://pejnguin[.]live/qwena hxxps://etechguidet[.]digital/apdo hxxps://qpraetori[.]live/vepr hxxps://1nighetwhisper[.]top/lekd hxxps://leczamedikal[.]org/vax hxxps://gdisciplipna[.]top/eqwu hxxps://6btcgeared[.]live/lbak hxxps://xcorexlaib[.]top/xzea hxxps://btechsyncq[.]run/riid hxxps://boreholeconstruction[.]org/weq hxxps://0antilcvope[.]live/rtdd hxxps://6equatorf[.]run/reiq hxxps://issuehouf[.]live/qxaos hxxps://maximusw[.]live/yiowo hxxps://3opusculy[.]top/keaj hxxps://7brandihx[.]run/lowp hxxps://jwoodpeckersd[.]run/glsk hxxps://dweaponrywo[.]digital/dJSuaj hxxps://fdgeographys[.]run/eirq hxxps://jorijinalecza[.]net/kazd hxxps://hbiosphxere[.]digital/tqoa hxxps://rabbitw[.]run/iomqwe hxxps://ffishgh[.]digital/tequ hxxps://0bardcauft[.]run/tured hxxps://ddatamanipy[.]run/bent hxxps://fwoodpeckersd[.]run/glsk hxxps://9techguidet[.]digital/apdo hxxps://bvecturar[.]top/zsia hxxps://gbuzzarddf[.]live/ktnt hxxps://4praetori[.]live/vepr hxxps://0vigorbridgoe[.]top/banb hxxps://7orijinalecza[.]org/jub hxxps://circumii[.]digital/gjyu hxxps://jtropiscbs[.]live/iuwxx hxxps://datacuet[.]live/twoow hxxps://rfishgh[.]digital/tequ hxxps://5jrxsafer[.]top/shpaoz hxxps://q9qzenithcorde[.]top/auid hxxps://6techguidet[.]digital/apdo hxxps://fscriptao[.]digital/vpep hxxps://uintelhube[.]live/api hxxps://tfishgh[.]digital/tequ hxxps://ytortoisgfe[.]top/paxk hxxps://9praetori[.]live/vepr hxxps://eorijinalecza[.]org/jub hxxps://xfishgh[.]digital/tequ hxxps://ypraetori[.]live/vepr hxxps://chivalryr[.]run/abmn hxxps://lscriptao[.]digital/vpep hxxps://mgeographys[.]run/eirq hxxps://3techchaiun[.]live/qwes hxxps://8parakehjet[.]run/kewk hxxps://1zenithcorde[.]top/auid hxxps://wbuzzarddf[.]live/ktnt hxxps://rdarjkafsg[.]digital/aoiz hxxps://tvigorbridgoe[.]top/banb hxxps://raesccapewz[.]run/ANSbwqy hxxps://1praetori[.]live/vepr hxxps://chimselcaked[.]digital/aosd hxxps://meczamedikal[.]org/vax hxxps://uparakehjet[.]run/kewk hxxps://vvigorbridgoe[.]top/banb hxxps://mygadgety[.]live/akrl hxxps://1jbuzzarddf[.]live/ktnt hxxps://rzenithcorde[.]top/auid hxxps://vnighetwhisper[.]top/lekd hxxps://tomorrefig[.]run/erap hxxps://s-tortoisgfe[.]top/paxk hxxps://iviriatoe[.]live/laopx hxxps://wtortoisgfe[.]top/paxk hxxps://jbearjk[.]live/benj hxxps://qdatawavej[.]digital/bafy hxxps://paincopp[.]digital/pqoweb hxxps://fhclarmodq[.]top/qoxo hxxps://holyseypju[.]run/xapz hxxps://ztechchaiun[.]live/qwes hxxps://xbitortoisgfe[.]top/paxk hxxps://sectorecoo[.]live/btnf hxxps://obuzzarddf[.]live/ktnt hxxps://eviriatoe[.]live/laopx hxxps://courtjew[.]digital/tqpo hxxps://ttzenithcorde[.]top/auid hxxps://7[.]geographys[.]run/eirq hxxps://tidalqhbf[.]live/ybbt hxxps://4ubtcgeared[.]live/lbak hxxps://5fishgh[.]digital/tequ hxxps://4fishgh[.]digital/tequ hxxps://4htardwarehu[.]icu/Sbdsa hxxps://czenithcorde[.]top/auid hxxps://2fishgh[.]digital/tequ hxxps://qparakehjet[.]run/kewk hxxps://aorjinalecza[.]net/lxaz hxxps://3rabbitw[.]run/iomqwe hxxps://datacubei[.]digital/xawo hxxps://kcivitasu[.]run/werrp hxxps://0buzzarddf[.]live/ktnt hxxps://tdisciplipna[.]top/eqwu hxxps://oeczamedikal[.]org/vax hxxps://3ozenithcorde[.]top/auid hxxps://5eczakozmetik[.]net/qop hxxps://atechguidet[.]digital/apdo hxxps://8awoodpeckersd[.]run/glsk hxxps://dtropiscbs[.]live/iuwxx hxxps://fypraetori[.]live/vepr hxxps://vzestmodp[.]top/zeda hxxps://zootechq[.]run/iods hxxps://gtechguidet[.]digital/apdo hxxps://vcivitasu[.]run/werrp hxxps://2parakehjet[.]run/kewk hxxps://4medicalbitkisel[.]net/juj hxxps://5bearjk[.]live/benj hxxps://etechsyncq[.]run/riid hxxps://djcivitasu[.]run/werrp hxxps://unicoriun[.]live/reoqi hxxps://0datawavej[.]digital/bafy hxxps://gtechchaiun[.]live/qwes hxxps://1a3techsyncq[.]run/riid hxxps://uopusculy[.]top/keaj hxxps://ydarjkafsg[.]digital/aoiz hxxps://3parakehjet[.]run/kewk hxxps://j7bearjk[.]live/benj hxxps://bdatamanipy[.]run/bent hxxps://nfishgh[.]digital/tequ hxxps://uvigorbridgoe[.]top/banb hxxps://8vecturar[.]top/zsia hxxps://latropiscbs[.]live/iuwxx hxxps://scorexlaib[.]top/xzea hxxps://4exitiumt[.]digital/xane hxxps://bviriatoe[.]live/laopx hxxps://qdatamanipy[.]run/bent hxxps://7usnakejh[.]top/adsk hxxps://sorijinalecza[.]org/jub hxxps://vzenithcorde[.]top/auid hxxps://sbearjk[.]live/benj hxxps://q8btcgeared[.]live/lbak hxxps://neczamedikal[.]org/vax hxxps://gparakehjet[.]run/kewk hxxps://adisciplipna[.]top/eqwu hxxps://lparakehjet[.]run/kewk hxxps://lfishgh[.]digital/tequ hxxps://4vecturar[.]top/zsia hxxps://ftopographky[.]top/xlak hxxps://9mediaflowq[.]run/aeui hxxp://check-for-status[.]cc/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://check-for-status[.]cc/1337/TORRENTOLD-1[.]exe hxxp://check-for-status[.]cc/update/TPB-1[.]exe |
Lumma Stealer |
| URL | hxxp://176[.]65[.]144[.]23/HOST/FJHFFRR[.]exe hxxp://176[.]65[.]144[.]23/HOST/CZXZDDS22[.]exe hxxp://134[.]209[.]67[.]242/xp/oric[.]exe hxxp://134[.]209[.]67[.]242/xp/audio[.]bat hxxp://176[.]65[.]144[.]23/HOST/BAG[.]exe hxxp://176[.]65[.]144[.]23/HOST/XZCZFS222[.]exe |
Agent Tesla |
| URL | hxxp://80[.]64[.]18[.]219/testmine/random[.]exe hxxp://80[.]64[.]18[.]219/mine/random[.]exe hxxp://185[.]156[.]72[.]96/te4h2nus/index[.]php hxxp://80[.]64[.]18[.]63/tom4ku9v/index[.]php hxxp://80[.]64[.]18[.]63/tom4ku9v/Login[.]php |
Amadey |
| URL | hxxps://api[.]telegram[.]org/bot7600133005:AAGKWLTSiLMwx177ZVrYDq036fSiKt5KpZk/sendMessage?chat_id=8063867525 hxxps://api[.]telegram[.]org/bot8033131150:AAH2pVHBsu2xj-81Zbywfn8eEx6dyRfBqKA/sendMessage?chat_id=8067696349 hxxps://api[.]telegram[.]org/bot7689482293:AAFv_kpd755t_N33ZSXc4sQLP3-PFsnevjA/sendMessage?chat_id=7153546848 hxxps://api[.]telegram[.]org/bot7892097493:AAGBFDSRDnXjUljP_qknpZebfu39dmX8tr4/sendMessage?chat_id=5600682828 hxxps://api[.]telegram[.]org/bot7834405147:AAFJJCi-Mz1RkxNU55cmqA-t4TrtYgD56kE/sendMessage?chat_id=5821888532 hxxps://api[.]telegram[.]org/bot8195548441:AAGsP9DCojvycN7-yL1i6Z6GsevljJQpQeo/sendMessage?chat_id=6077046490 hxxps://api[.]telegram[.]org/bot7525210835:AAGnDPOH-lox7r8k1zZV0fooBew7iRIwZ1M/sendMessage?chat_id=7788030038 hxxps://api[.]telegram[.]org/bot7572676375:AAGftDuONGD20-yxGHNS9SGEiXe5WYaWLRM/sendMessage?chat_id=6593768982 hxxps://api[.]telegram[.]org/bot8133728415:AAGGFLa2NWuKyZhzoRabsMxmiKo92pLqR9k/sendMessage?chat_id=7153546848 hxxps://api[.]telegram[.]org/bot7933866884:AAEJjcZjPtgDgRUH4I4Po1kW4LK9TXZivwE/sendMessage?chat_id=1474445387 hxxps://api[.]telegram[.]org/bot7337058262:AAFPJnCm-ikIMYKcvDisXUzXJWBPOAzwYgc/sendMessage?chat_id=5000799731 hxxps://api[.]telegram[.]org/bot7530804344:AAEJiEkE38TLdcjqD5ACEr83Z9K2H61s5k4/sendMessage?chat_id=7903365335 |
Snake Keylogger |
| URL | hxxp://18[.]166[.]113[.]176:7755/get64[.]gif?id=1234 hxxp://20[.]107[.]17[.]32/beacon_x64[.]exe hxxp://192[.]238[.]206[.]11/02[.]08[.]2022[.]exe hxxp://20[.]169[.]41[.]5:2086/02[.]08[.]2022[.]exe hxxp://45[.]157[.]148[.]200:4499/02[.]08[.]2022[.]exe hxxp://1[.]94[.]236[.]193:9998/02[.]08[.]2022[.]exe hxxp://206[.]238[.]114[.]38/02[.]08[.]2022[.]exe hxxp://161[.]35[.]255[.]100:55556/02[.]08[.]2022[.]exe hxxp://43[.]142[.]161[.]126:8889/02[.]08[.]2022[.]exe hxxp://101[.]200[.]76[.]102:8080/02[.]08[.]2022[.]exe hxxp://123[.]60[.]135[.]200/02[.]08[.]2022[.]exe hxxp://115[.]159[.]71[.]204:10000/02[.]08[.]2022[.]exe hxxp://155[.]138[.]228[.]172:8888/02[.]08[.]2022[.]exe hxxp://8[.]135[.]237[.]16:2223/02[.]08[.]2022[.]exe hxxp://8[.]135[.]237[.]16:8528/02[.]08[.]2022[.]exe hxxp://47[.]89[.]194[.]207:55555/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://103[.]188[.]82[.]240/skid[.]mips hxxp://103[.]188[.]82[.]240/lol[.]mips hxxp://103[.]188[.]82[.]240/massload hxxp://103[.]188[.]82[.]240/uni hxxp://103[.]188[.]82[.]240/tplink[.]sh hxxp://38[.]54[.]17[.]161/lol[.]mips hxxp://156[.]253[.]227[.]62/assailant[.]mpsl hxxp://156[.]253[.]227[.]62/assailant[.]m68k hxxp://156[.]253[.]227[.]62/assailant[.]mips hxxp://156[.]253[.]227[.]62/assailant[.]i686 hxxp://156[.]253[.]227[.]62/assailant[.]sparc hxxp://156[.]253[.]227[.]62/assailant[.]x86 hxxp://156[.]253[.]227[.]62/assailant[.]arm4 hxxp://156[.]253[.]227[.]62/assailant[.]arm7 hxxp://156[.]253[.]227[.]62/assailant[.]arm5 hxxp://156[.]253[.]227[.]62/assailant[.]arm6 hxxp://156[.]253[.]227[.]62/assailant[.]i586 hxxp://156[.]253[.]227[.]62/assailant[.]ppc hxxp://156[.]253[.]227[.]62/assailant[.]sh4 hxxp://157[.]230[.]3[.]112/586 hxxp://157[.]230[.]3[.]112/ppc hxxp://157[.]230[.]3[.]112/dss hxxp://157[.]230[.]3[.]112/m68k hxxp://157[.]230[.]3[.]112/mips hxxp://157[.]230[.]3[.]112/sh4 hxxp://157[.]230[.]3[.]112/x86 hxxp://157[.]230[.]3[.]112/mipsel hxxp://157[.]230[.]3[.]112/dc hxxp://157[.]230[.]3[.]112/co hxxp://157[.]230[.]3[.]112/arm61 hxxp://157[.]230[.]3[.]112/i686 hxxp://176[.]65[.]148[.]190/skid[.]sh hxxp://176[.]65[.]148[.]190/bins[.]sh hxxp://176[.]65[.]148[.]190/assailant[.]i586 hxxp://176[.]65[.]148[.]190/assailant[.]sh4 hxxp://176[.]65[.]148[.]190/assailant[.]arm7 hxxp://176[.]65[.]148[.]190/assailant[.]i686 hxxp://176[.]65[.]148[.]190/skid[.]sparc hxxp://176[.]65[.]148[.]190/assailant[.]arm5 hxxp://176[.]65[.]148[.]190/assailant[.]mips hxxp://176[.]65[.]148[.]190/skid[.]arm4 hxxp://176[.]65[.]148[.]190/assailant[.]mpsl hxxp://176[.]65[.]148[.]190/assailant[.]sparc hxxp://176[.]65[.]148[.]190/skid[.]arm5 hxxp://176[.]65[.]148[.]190/assailant[.]arm4 hxxp://176[.]65[.]148[.]190/assailant[.]x86 hxxp://176[.]65[.]148[.]190/skid[.]mips hxxp://176[.]65[.]148[.]190/assailant[.]ppc hxxp://176[.]65[.]148[.]190/skid[.]x86 hxxp://176[.]65[.]148[.]190/assailant[.]arm6 hxxp://176[.]65[.]148[.]190/assailant[.]m68k hxxp://176[.]65[.]148[.]190/skid[.]arm6 hxxp://176[.]65[.]148[.]190/skid[.]ppc hxxp://176[.]65[.]148[.]190/skid[.]mpsl hxxp://157[.]230[.]3[.]112/sex[.]sh |
Bashlite |
| URL | hxxps://amssh[.]co/script[.]ps1 hxxp://62[.]60[.]226[.]232/1a228f64bf7ebcb0[.]php hxxps://62[.]60[.]226[.]232/1a228f64bf7ebcb0[.]php hxxps://e[.]overallwobbly[.]ru/era-stc hxxps://e[.]overallwobbly[.]ru/era-std |
Stealc |
| URL | hxxps://github[.]com/legendary99999/gsdgsd-g/releases/download/dsffdsfddsf/setup[.]exe hxxp://80[.]64[.]18[.]219/files/7909788468/msP2PiF[.]exe |
Rhadamanthys |
| URL | hxxps://github[.]com/legendary99999/dfabdfbsfdbfdb/releases/download/bfdbsfdbabfd/setup[.]1[.]exe hxxp://80[.]64[.]18[.]219/files/unique2/random[.]exe hxxp://80[.]64[.]18[.]219/files/740061926/2NWfbLK[.]exe hxxp://80[.]64[.]18[.]219/files/740061926/ra02W4S[.]exe |
GCleaner |
| URL | hxxp://117[.]200[.]148[.]155:50879/Mozi[.]m hxxp://115[.]48[.]148[.]187:60817/Mozi[.]m hxxp://115[.]48[.]146[.]120:41987/Mozi[.]m |
Mozi |
| URL | hxxp://192[.]210[.]214[.]133/JTONmpC159[.]bin hxxp://198[.]12[.]83[.]69/rlkEWeaoRLt135[.]bin hxxp://198[.]12[.]83[.]69/mlYOHPe255[.]bin hxxp://192[.]210[.]214[.]133/iOhsbzuJXkX168[.]bin hxxp://192[.]210[.]214[.]133/HABnJHDh118[.]bin |
CloudEyE |
| URL | hxxp://80[.]64[.]18[.]219/files/1781548144/f1zcE94[.]exe hxxp://176[.]65[.]144[.]23/HOST/XZCCWW[.]exe |
Quasar RAT |
| URL | hxxps://u1[.]dimmergauntlet[.]ru/2iegip6o41[.]1 hxxps://u1[.]dimmergauntlet[.]ru/niep6uicc9[.]1 hxxps://captcha[.]deetux[.]top/z7m5pe2k0p hxxps://u1[.]dimmergauntlet[.]ru/t4cere01uq[.]1 hxxps://u1[.]dimmergauntlet[.]ru/z7k6f42v7j[.]1 hxxps://u1[.]dimmergauntlet[.]ru/u3ahru1w1g[.]1 hxxps://u1[.]dimmergauntlet[.]ru/vld6qw1xyr[.]1 hxxps://u1[.]vad6[.]ru/igmnaycy59[.]1 hxxps://u1[.]vad6[.]ru/cq9m8fp13o[.]1 hxxps://u1[.]vad6[.]ru/1f63l7yfrh[.]1 hxxps://u1[.]vad6[.]ru/cddhgqealq[.]1 hxxps://u1[.]vad6[.]ru/dyklnq65wl[.]1 hxxps://u1[.]vad6[.]ru/o5ce5g2b7m[.]1 hxxps://u1[.]vad6[.]ru/yhsbmwxqez[.]1 hxxps://u1[.]vad6[.]ru/2w3hzyrwd5[.]1 hxxps://u1[.]vad6[.]ru/8bhhtvsc6k[.]1 hxxps://u1[.]vad6[.]ru/79wdl5b4zq[.]1 hxxps://u1[.]vad6[.]ru/qkeymu1w77[.]1 hxxps://u1[.]vad6[.]ru/f1gwxsiuvg[.]1 hxxps://u1[.]vad6[.]ru/91ibhnswav[.]1 hxxps://u1[.]vad6[.]ru/a56fcpqnfo[.]1 hxxps://u1[.]vad6[.]ru/1wyh2m8ex0[.]1 hxxps://u1[.]vad6[.]ru/qmy9qw1wbd[.]1 hxxps://captcha[.]deetux[.]top/4vjuwr0ea5 hxxps://u1[.]vad6[.]ru/otslrqu055[.]1 hxxps://u1[.]vad6[.]ru/fd8c49fjmu[.]1 hxxps://u1[.]vad6[.]ru/pmfu8mafoa[.]1 hxxps://u1[.]vad6[.]ru/kismymkjfe[.]1 hxxps://u1[.]vad6[.]ru/yg4ut7lp0b[.]1 hxxps://u1[.]vad6[.]ru/orhedvdglv[.]1 hxxps://u1[.]vad6[.]ru/9f14onh77a[.]1 hxxps://u1[.]vad6[.]ru/c1au2dzgq6[.]1 hxxps://u1[.]vad6[.]ru/y3hfh0lpkf[.]1 hxxps://u1[.]vad6[.]ru/scs5984vbu[.]1 |
ClearFake |
| URL | hxxp://91[.]200[.]14[.]153/Downloads/window[.]exe hxxp://134[.]209[.]67[.]242/xp/ukrn1[.]js hxxp://134[.]209[.]67[.]242/xp/ktt[.]exe hxxp://134[.]209[.]67[.]242/xp/as[.]exe hxxp://134[.]209[.]67[.]242/xp/sam[.]exe hxxps://api[.]telegram[.]org/bot7475087682:AAEfJpWc86AxzuoY9HVEoL7CzhKKWWdwm7o/sendMessage hxxps://api[.]telegram[.]org/bot7031368257:AAEAyMl3gTYo32U31GsCzVzhJ0rB5fTSrBk/sendMessage hxxps://api[.]telegram[.]org/bot7578329923:AAH1YBgPMCw1HVRIFhWov539Cm6IOTQHmYc/sendMessage hxxps://api[.]telegram[.]org/bot8177260835:AAEXCx28DtJ7-eKIv0s5TZm7zodxfQwk_8g/sendMessage hxxps://api[.]telegram[.]org/bot8106600591:AAFkNO73MtTmQuvi4fBDGE7hd2H7FNOw8eg/sendMessage hxxps://api[.]telegram[.]org/bot7257760192:AAFClYOmArWxKiacR3573MWqD62mbd_eXGA/sendMessage hxxps://api[.]telegram[.]org/bot8059363624:AAEhjaugTlx1V9C5izRLQPmja3oHatuR0dk/sendMessage hxxps://api[.]telegram[.]org/bot7782647045:AAFM7L8c4tAXj7D8a7fRs8cjLDXtBtKqtuo/sendMessage hxxps://api[.]telegram[.]org/bot7478550442:AAFFrjVUKsvQtQXD68jNIEL-6LtQUIoajxw/sendMessage hxxps://api[.]telegram[.]org/bot7949886343:AAGSY11P4ZIbYpc60AmI_h8lcuqaoWnMcE8/sendMessage hxxps://api[.]telegram[.]org/bot7927310401:AAHyDdHI3rMVKvYDrBqwj5U-P3hnXcqb_r4/sendMessage hxxps://api[.]telegram[.]org/bot7787815780:AAGtfuCDrymU2I4vC1dNYoe2s3p1zhdBePI/sendMessage hxxps://api[.]telegram[.]org/bot7740014778:AAHvv4iO_JUp_5ZN94WZwkIb3odsDxvRSjM/sendMessage hxxp://45[.]152[.]149[.]15/music/Lamno[.]exe |
AsyncRAT |
| URL | hxxp://45[.]141[.]86[.]133:4443/TechGuardSecureSuite/ hxxps://45[.]141[.]86[.]133/TechGuardSecureSuite/ |
Matanbuchus |
| URL | hxxp://bikbike[.]info/tmp3/gate[.]php | Pony |
| URL | hxxps://umatblog[.]top/test/ hxxps://kdsigncreation[.]net/wp-content/plugins/wp-file-upload/zaroci[.]php?ncuv=1sgqm |
Latrodectus |
| URL | hxxp://185[.]156[.]72[.]39/newtpp[.]exe hxxp://185[.]156[.]72[.]39/x[.]exe hxxp://80[.]64[.]18[.]219/files/6560547276/cHXswWx[.]exe |
Coinminer |
| URL | hxxps://powlopski[.]com/sig/ini hxxps://order[.]meetandeatsac[.]com/profileLayout hxxps://adspixle[.]com/public/pixel[.]js hxxps://email[.]gwlawgroupattorneys[.]com/profileLayout |
FAKEUPDATES |
| URL | hxxp://mcrsftuptade[.]pro/Up/b hxxps://u1[.]dynamicrename[.]run/au1 |
ACR Stealer |
| URL | hxxps://api[.]telegram[.]org/bot8146780794:AAHYx0zHtVwn4U4jxDVHPDihJAucL74X1yQ/sendMessage?chat_id=1128973051 | MASS Logger |
| URL | hxxp://134[.]209[.]67[.]242/xp/wordart[.]exe | DarkTortilla |
| URL | hxxps://onlinewatchmovegirls[.]net/txt/1[.]txt | DCRat |
| URL | hxxp://5[.]181[.]156[.]158/files/winhost[.]exe | Sliver |
| URL | hxxp://80[.]64[.]18[.]219/files/813095759/mHRBb56[.]exe | Venom RAT |
| URL | hxxp://176[.]65[.]144[.]23/HOST/SIR[.]ps1 hxxp://176[.]65[.]144[.]23/HOST/ffDGGG[.]exe hxxp://80[.]64[.]18[.]219/files/1370676839/Zw3tA4m[.]exe |
Formbook |
| URL | hxxps://pastebin[.]com/raw/xBWdSmzr hxxps://41[.]216[.]188[.]194/ca[.]ps1 hxxp://newlifejob[.]click/Downloads/music[.]vbs |
XWorm |
| URL | hxxp://91[.]208[.]206[.]217/bot[.]arm7 hxxp://91[.]208[.]206[.]217/hidden[.]sh |
Mirai |
| URL | hxxp://185[.]149[.]146[.]73/WindowsHealthMonitor[.]exe hxxp://185[.]149[.]146[.]73/archive8[.]zip hxxp://111[.]90[.]143[.]217:1488/fakeurl[.]htm hxxp://111[.]90[.]143[.]217/fakeurl[.]htm |
NetSupportManager RAT |
| URL | hxxp://42[.]200[.]207[.]90/386 hxxp://42[.]200[.]207[.]90/arm |
QNAPCrypt |
