不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様6社 -
2025/07/16
※2025/07/16 更新
マルウェア感染させると考えられるURLを検知（2025/07/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]80[.]158[.]76/garm7 hxxp://45[.]80[.]158[.]76/gmpsl hxxp://45[.]80[.]158[.]76/gmips hxxp://45[.]80[.]158[.]76/gompsl hxxp://78[.]31[.]250[.]161/toto hxxp://185[.]208[.]158[.]140/bins/huawei hxxp://5[.]175[.]249[.]52/m-6[.]8-k[.]Sakura hxxp://5[.]175[.]249[.]52/m-p[.]s-l[.]Sakura hxxp://5[.]175[.]249[.]52/a-r[.]m-5[.]Sakura hxxp://5[.]175[.]249[.]52/i-5[.]8-6[.]Sakura hxxp://5[.]175[.]249[.]52/a-r[.]m-7[.]Sakura hxxp://5[.]175[.]249[.]52/x-3[.]2-[.]Sakura hxxp://5[.]175[.]249[.]52/a-r[.]m-6[.]Sakura hxxp://5[.]175[.]249[.]52/p-p[.]c-[.]Sakura hxxp://5[.]175[.]249[.]52/s-h[.]4-[.]Sakura hxxp://5[.]175[.]249[.]52/a-r[.]m-4[.]Sakura hxxp://5[.]175[.]249[.]52/m-i[.]p-s[.]Sakura |
Bashlite |
| URL | hxxps://adrianfrieg[.]com/go/install[.]sh hxxps://adrianfrieg[.]com/go/update |
AMOS |
| URL | hxxp://176[.]46[.]157[.]32/files/6335391544/PX08uaH[.]exe hxxp://182[.]143[.]112[.]19:81/AV[.]scr hxxp://182[.]143[.]112[.]19:81/Photo[.]scr hxxp://124[.]131[.]187[.]28:8888/AV[.]scr hxxp://124[.]131[.]187[.]28:8888/Video[.]scr hxxp://124[.]131[.]187[.]28:8888/Photo[.]scr hxxp://182[.]143[.]112[.]19:81/Video[.]scr hxxp://177[.]70[.]102[.]228:8070/info[.]zip hxxp://176[.]46[.]157[.]32/files/6335391544/J7PwukD[.]exe hxxp://176[.]46[.]157[.]32/files/6335391544/dcWUoQa[.]exe hxxps://badabyms[.]site/teeeest[.]exe |
Coinminer |
| URL | hxxp://46[.]105[.]34[.]222/svc[.]scr hxxp://196[.]251[.]71[.]46/Adobe%20Acrobat[.]exe hxxp://tjljk[.]info/Adobe%20Acrobat[.]exe |
Quasar RAT |
| URL | hxxps://lebensversicherungvergleich[.]top/jjj/index[.]php hxxps://lebensversicherungvergleich[.]top/jjj/include[.]js hxxps://warpdrive[.]top/jjj/include[.]js hxxps://warpdrive[.]top/jjj/index[.]php hxxps://sos-atlanta[.]com/lal[.]ps1 hxxps://sos-atlanta[.]com/vuzs[.]zip hxxps://warpdrive[.]top/jjj/buffer[.]js hxxp://sos-atlanta[.]com/lal[.]ps1 |
NetSupportManager RAT |
| URL | hxxps://pre-order[.]sodakconcretecoatings[.]com/viewDashboard hxxps://files[.]tucsonrenovationservices[.]com/viewDashboard |
FAKEUPDATES |
| URL | hxxps://dashboard[.]fedor-turin[.]ru/login hxxps://qkiaolnd[.]sasha-solzhenicyn[.]ru/login hxxps://www[.]v1[.]fedor-turin[.]ru/login hxxps://www[.]backup[.]fedor-turin[.]ru/login hxxps://stg[.]fedor-turin[.]ru/login hxxps://144[.]172[.]96[.]106/login hxxp://144[.]172[.]96[.]106/login hxxp://lumma-market[.]ru/login hxxps://resqtk[.]top/adlp hxxps://dimtl[.]top/xadk hxxps://prexn[.]top/qwkd hxxps://teijx[.]lat/bjud hxxps://sopzbd[.]top/gakk hxxps://monkkn[.]top/twud hxxps://siyju[.]pics/anbz hxxps://geczs[.]xyz/xkao hxxps://rayrhs[.]top/aktr hxxps://mcaumnb[.]shop/dpsz hxxps://furwmsx[.]shop/xowq hxxps://daruubs[.]top/griw hxxps://cidtfhh[.]shop/zdik hxxps://moxqk[.]pics/aijd hxxps://shodbj[.]lat/xodk |
Lumma Stealer |
| URL | hxxp://176[.]46[.]157[.]32/files/7853705274/Q4XAm1q[.]exe | SalatStealer |
| URL | hxxp://167[.]160[.]161[.]247/v999f8[.]exe hxxp://52[.]184[.]82[.]90/EdgeUpdateSvc[.]exe |
XWorm |
| URL | hxxp://52[.]184[.]82[.]90/EdgeUpdateSvc1[.]exe hxxp://52[.]184[.]82[.]90/EdgeUpdateSvc2[.]exe |
BlankGrabber |
| URL | hxxps://api[.]telegram[.]org/bot6978440958:AAHh9ryGkwhvScgnyBXNoL8QR-q5X2o_bZk/sendMessage?chat_id=1149967757 | MASS Logger |
| URL | hxxp://179[.]43[.]186[.]224:5900/EZGw hxxp://101[.]126[.]83[.]136:443/jquery-3[.]3[.]2[.]slim[.]min[.]js hxxp://111[.]231[.]19[.]37/jquery-3[.]3[.]2[.]slim[.]min[.]js hxxp://47[.]98[.]151[.]171:2999/RkWI |
Cobalt Strike |
| URL | hxxp://137[.]220[.]171[.]95/386 hxxp://137[.]220[.]171[.]95/linux_386 |
Kaiji |
| URL | hxxp://172[.]245[.]95[.]38/CeChQdtwLjOlIPWa185[.]bin hxxp://104[.]223[.]84[.]4/YKFEKHFiux69[.]bin hxxp://104[.]223[.]84[.]4/uqRohuS37[.]bin hxxp://104[.]223[.]84[.]4/IEqzhgXfZKjPaG249[.]bin hxxp://104[.]223[.]84[.]4/ItLyoqQC213[.]bin hxxp://172[.]245[.]95[.]38/LDsKBGgYpUTpQcxM157[.]bin |
CloudEyE |
| URL | hxxp://137[.]220[.]171[.]95/syn | BillGates |
| URL | hxxp://booknsvrf[.]com/sls/bdxnsmp[.]exe | AsyncRAT |
| URL | hxxp://51[.]15[.]215[.]173/82A7A379-F686-4060-AFA1-B770C5160C55/index[.]php | Azorult |
| URL | hxxp://213[.]202[.]208[.]237/gate[.]php | Arkei Stealer |
| URL | hxxp://162[.]248[.]53[.]119:8000/svhostd[.]exe | Meterpreter |
| URL | hxxps://deathmatchuk[.]com/5l4j[.]js hxxps://deathmatchuk[.]com/js[.]php |
KongTuke |
