不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/05/16
※2025/05/16 更新
マルウェア感染させると考えられるURLを検知（2025/05/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://7lancery[.]digital/goj hxxps://github[.]com/legendary99999/lsdmfvkjsmndva/releases/download/fdvasdfvadvfa/CompoundsTrim[.]exe hxxp://185[.]156[.]72[.]2/files/5494432675/HGVm49v[.]exe hxxp://185[.]156[.]72[.]2/files/1131915492/d1oAX1c[.]exe hxxps://o9cornerdurv[.]top/adwq hxxps://ylaminaflbx[.]shop/twoq hxxps://demphatakpn[.]bet/ladk hxxps://4featurlyin[.]top/pdal hxxps://ycornerdurv[.]top/adwq hxxps://mflowerexju[.]bet/lanz hxxps://nposseswsnc[.]top/akds hxxps://wfeaturlyin[.]top/pdal hxxps://raraucahkbm[.]live/baneb hxxps://12[.]innospark[.]cloud/vpnmcg[.]txt hxxps://winterpwthc[.]digital/juab hxxps://milkwevvmw[.]run/gakz hxxps://7meteorplyp[.]live/lekp hxxps://eqcobwuxr[.]digital/mnf hxxps://-grizzlqzuk[.]live/qhbu hxxps://anna-akhmatova[.]com/login hxxp://185[.]156[.]72[.]2/files/5354535077/j6J70wm[.]exe hxxps://16testcawepr[.]run/dsap hxxps://6laminaflbx[.]shop/twoq hxxps://chiasmymnb[.]live/godk hxxps://zsaxecocnak[.]live/manj hxxps://jemphatakpn[.]bet/ladk hxxps://8jugulagklc[.]live/roek hxxps://-zmedtipp[.]live/mnvzx hxxps://qfeaturlyin[.]top/pdal hxxps://psearchilyo[.]run/gsna hxxps://2otestcawepr[.]run/dsap |
Lumma Stealer |
| URL | hxxps://allaivo[.]me/crypted[.]exe | Stealc |
| URL | hxxps://api[.]telegram[.]org/bot7916775626:AAEpKtCXhW8JVhlJ4gm9KnQGEsOrt7L3fNQ/sendMessage?chat_id=7838187567 hxxp://107[.]175[.]88[.]27/xampp/bnu/bestskillforsupportcharacterbasedonme[.]hta |
MASS Logger |
| URL | hxxps://fmovies123[.]top/fix/select[.]js hxxps://fmovies123[.]top/fix/his[.]php hxxps://probuildgroupusa[.]com/xsxs[.]zip hxxps://regopramide[.]top/lav/xf_addon[.]js hxxps://regopramide[.]top/lav/select[.]js hxxps://regopramide[.]top/lav/lll[.]php hxxps://badgervolleyball[.]org/fsos[.]zip |
NetSupportManager RAT |
| URL | hxxp://193[.]32[.]162[.]74/bins/mips | Bashlite |
| URL | hxxp://110[.]40[.]142[.]234/02[.]08[.]2022[.]exe hxxp://45[.]192[.]99[.]197:9999/02[.]08[.]2022[.]exe hxxp://192[.]238[.]128[.]191:8444/02[.]08[.]2022[.]exe hxxp://45[.]192[.]99[.]197:9997/02[.]08[.]2022[.]exe hxxp://45[.]192[.]99[.]197:9998/02[.]08[.]2022[.]exe hxxp://149[.]104[.]25[.]171/02[.]08[.]2022[.]exe hxxp://156[.]238[.]233[.]94:8888/02[.]08[.]2022[.]exe hxxp://47[.]238[.]99[.]123/02[.]08[.]2022[.]exe hxxp://193[.]124[.]41[.]54/02[.]08[.]2022[.]exe hxxp://8[.]137[.]60[.]154:7777/02[.]08[.]2022[.]exe hxxp://124[.]70[.]25[.]169/02[.]08[.]2022[.]exe hxxp://8[.]134[.]80[.]60:12345/02[.]08[.]2022[.]exe hxxp://180[.]76[.]138[.]238/02[.]08[.]2022[.]exe hxxp://62[.]234[.]97[.]159:7777/02[.]08[.]2022[.]exe hxxp://43[.]143[.]216[.]185:801/02[.]08[.]2022[.]exe hxxp://103[.]171[.]35[.]26:9443/dot[.]gif |
Cobalt Strike |
| URL | hxxp://185[.]156[.]72[.]2/files/5790266621/1ogHzss[.]exe | Quasar RAT |
| URL | hxxps://github[.]com/piunildunkos8/nom/raw/refs/heads/main/sgsdg[.]exe | Coinminer |
| URL | hxxps://github[.]com/popa339/nef5/raw/refs/heads/main/Slasher[.]exe hxxp://77[.]246[.]158[.]103/secureTrafficPublic[.]php |
DCRat |
| URL | hxxps://api[.]telegram[.]org/bot7561796973:AAHEfUD0q29RnP0Q9r9hPI6almUXtmYo4AQ/sendMessage?chat_id=8063867525 hxxps://api[.]telegram[.]org/bot7864134399:AAHZaAfTVI8H-Ig2De5yEqk6vDdGDe4gHD4/sendMessage?chat_id=8063867525 hxxps://api[.]telegram[.]org/bot7978718398:AAEnxzlxUVaHhWbTJtHf1L5p2bxCRaHtJik/sendMessage?chat_id=7286478455 hxxps://api[.]telegram[.]org/bot8179417994:AAHGrUvOB5AFny1C5SqUiKOheRMg_rtl_yE/sendMessage?chat_id=7828110568 hxxps://api[.]telegram[.]org/bot8076914767:AAFQ5rrfYheuKigmCGyNVTnIWa4OJ_YUa4U/sendMessage?chat_id=7249492547 hxxps://api[.]telegram[.]org/bot7519648173:AAFa0gRLSrIn-pqn8ZMXH8MLdNswY45-0Yw/sendMessage?chat_id=8154660619 |
Snake Keylogger |
| URL | hxxp://109[.]248[.]144[.]217/FYrmoTgLzzNAmgBGdwtT96[.]bin | CloudEyE |
| URL | hxxps://www[.]rivercitymech[.]biz/profileLayout hxxps://equss[.]result[.]garrettcountygranfondo[.]org/editContent |
FAKEUPDATES |
| URL | hxxp://213[.]209[.]150[.]18/alphamm[.]exe | LokiBot |
| URL | hxxp://94[.]26[.]90[.]204/kjoxca[.]exe hxxp://213[.]218[.]234[.]220/Archives/transacted_hollowing[.]dll |
Formbook |
| URL | hxxp://185[.]29[.]9[.]64/gKihuwGhxt122[.]bin hxxp://75[.]127[.]7[.]164/emmmmmmslay[.]exe |
Agent Tesla |
| URL | hxxp://h4[.]tykeblot[.]today/sh[.]ext[.]bin | AsyncRAT |
| URL | hxxps://qv[.]gahq[.]ru/fdgv[.]sh hxxps://8r[.]czlw[.]ru/2f5a9e85-ee81-41df-8f15-e83a4ffac6c2 |
ClearFake |
