不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様4社 -
2025/08/28
※2025/08/28 更新
マルウェア感染させると考えられるURLを検知（2025/08/28）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://api[.]telegram[.]org/bot8255940048:AAE4byL4CCBuAdJlT_0J7mlvMfy6hJvqTIs/sendMessage?chat_id=8029948911 | DarkCloud |
| URL | hxxps://bernnaum[.]com/3e2w[.]js hxxps://bernnaum[.]com/js[.]php hxxp://212[.]22[.]86[.]82:2020/19 hxxps://camitel[.]com/js[.]php hxxps://camitel[.]com/3e2w[.]js hxxp://212[.]22[.]86[.]82:2020//test112 |
KongTuke |
| URL | hxxp://45[.]230[.]66[.]113:11201/Mozi[.]a hxxp://117[.]216[.]191[.]12:56415/Mozi[.]m |
Mozi |
| URL | hxxps://climjuw[.]top/qodz hxxps://chifacanton[.]phuyufact[.]com/images/sot/m/git[.]msi hxxps://chifacanton[.]phuyufact[.]com/images/sot/d/CPTuxPN[.]dll hxxp://178[.]16[.]55[.]189/files/5900855435/YXJ9Hvg[.]exe hxxp://178[.]16[.]55[.]189/files/5068161817/sPG7jLw[.]exe hxxps://haggwwb[.]top/xald hxxps://swrcfjlm[.]top/xdki hxxp://178[.]16[.]55[.]189/files/632800492/9aT2q0c[.]exe hxxps://strypgo[.]top/xeoz hxxp://capexzo[.]top/wqox |
Lumma Stealer |
| URL | hxxps://chifacanton[.]phuyufact[.]com/images/sot/e/Xojwecqy[.]exe | PureLogs Stealer |
| URL | hxxps://chifacanton[.]phuyufact[.]com/images/sot/b/QuickCliq32[.]exe | Metasploit |
| URL | hxxp://178[.]16[.]55[.]189/files/6691015685/sQNHMrP[.]exe | Rhadamanthys |
| URL | hxxp://160[.]250[.]134[.]48/massload | Bashlite |
| URL | hxxps://github[.]com/Defeadnn/sgsdgsdasgaa/releases/download/ggagadf/dd1[.]exe hxxps://220[.]244[.]1[.]48:8443/sda1/Photo[.]scr hxxps://220[.]240[.]142[.]135:8443/sda5/AV[.]scr hxxps://220[.]244[.]1[.]48:8443/sda1/AV[.]scr hxxps://151[.]81[.]230[.]191:8443/sda1/Video[.]scr hxxps://151[.]81[.]230[.]191:8443/sda1/2022%20ROMA/Photo[.]scr hxxps://151[.]81[.]230[.]191:8443/sda1/AV[.]scr hxxps://220[.]240[.]142[.]135:8443/sda5/Photo[.]scr hxxps://220[.]240[.]142[.]135:8443/sda5/Installers%20APK/AV[.]scr hxxps://220[.]240[.]142[.]135:8443/sda5/Video[.]scr hxxps://220[.]240[.]142[.]135:8443/sda5/Installers%20APK/Video[.]scr hxxps://220[.]240[.]142[.]135:8443/sda5/Installers%20APK/Photo[.]scr hxxps://220[.]244[.]1[.]48:8443/sda1/loader/Photo[.]scr hxxps://151[.]81[.]230[.]191:8443/sda1/2022%20ROMA/AV[.]scr hxxps://220[.]244[.]1[.]48:8443/sda1/loader/Video[.]scr hxxps://220[.]244[.]1[.]48:8443/sda1/loader/AV[.]scr hxxps://151[.]81[.]230[.]191:8443/sda1/2022%20ROMA/Video[.]scr hxxps://151[.]81[.]230[.]191:8443/sda1/Photo[.]scr |
Coinminer |
| URL | hxxp://117[.]72[.]105[.]10:8080/lAz6 hxxp://106[.]53[.]213[.]113:443/02[.]08[.]2022[.]exe hxxp://118[.]195[.]148[.]180:18081/02[.]08[.]2022[.]exe hxxp://47[.]109[.]178[.]168/02[.]08[.]2022[.]exe hxxp://23[.]158[.]24[.]11:8080/02[.]08[.]2022[.]exe hxxp://47[.]93[.]216[.]2:9553/02[.]08[.]2022[.]exe hxxp://123[.]57[.]177[.]33:8084/02[.]08[.]2022[.]exe hxxp://47[.]120[.]32[.]72/02[.]08[.]2022[.]exe hxxp://8[.]141[.]90[.]104:6666/02[.]08[.]2022[.]exe hxxp://118[.]178[.]184[.]25/02[.]08[.]2022[.]exe hxxp://8[.]213[.]237[.]239/YNCs |
Cobalt Strike |
| URL | hxxp://213[.]209[.]150[.]18/804zKAQl0Ai6Fbr[.]exe hxxp://213[.]209[.]150[.]18/uCoAIgy7ON5dnXN[.]exe hxxp://213[.]209[.]150[.]18/Y1vRMu2SO8U0B5A[.]exe |
MASS Logger |
| URL | hxxps://kflyghtovilodas[.]com/work/ hxxps://draklofsitewebsdrift[.]com/work/ hxxps://kikliloputocrowfly[.]com/work/ hxxps://daestfestifalkrlon43[.]com/work/ |
Latrodectus |
| URL | hxxp://178[.]16[.]55[.]189/files/1781548144/uRvTWg4[.]exe | XWorm |
| URL | hxxp://196[.]251[.]86[.]215/fHOeAmKOj[.]txt | StormKitty |
| URL | hxxp://107[.]174[.]212[.]72/Tuesdaycumday[.]vbs | Agent Tesla |
| URL | hxxps://pets[.]thevoicefordogs[.]org/pixel[.]png | FAKEUPDATES |
| URL | hxxp://220[.]85[.]206[.]156:8080/AnyDesk_vip[.]exe | Quasar RAT |
| URL | hxxps://ahmm[.]ca/d[.]js hxxps://shark-watewer[.]com/ajax/pixi[.]min[.]js hxxps://stradomi[.]com/res/oncebelieve hxxps://stradomi[.]com/solve[.]pdb hxxps://stradomi[.]com/assets/img/fe99357658356062[.]txt |
NetSupportManager RAT |
| URL | hxxp://ab-services[.]ma/font-awesome/css/mercy/Panel/five/fre[.]php | LokiBot |
| URL | hxxps://api[.]telegram[.]org/bot8433672376:AAFf23u88-JzLa0c788Trm1gZRJKhQ8ZiNo/sendMessage?chat_id=8154660619 | Snake Keylogger |
