不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/08/29
※2025/08/29 更新
マルウェア感染させると考えられるURLを検知（2025/08/29）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://178[.]16[.]55[.]189/files/8322977947/ZAO2RQc[.]exe hxxp://91[.]206[.]178[.]27/vbnh[.]pdf hxxps://capexzo[.]top/wqox hxxps://carowf[.]top/edsz hxxp://178[.]16[.]55[.]189/files/7559408112/jI3j2iL[.]exe hxxp://178[.]16[.]55[.]189/files/8052963817/LUQfGzv[.]exe |
Lumma Stealer |
| URL | hxxp://188[.]245[.]105[.]73/second[.]html | KongTuke |
| URL | hxxp://107[.]174[.]212[.]72/emmmmmmmmbig[.]txt hxxp://107[.]174[.]212[.]72/scriptDON[.]hta |
Agent Tesla |
| URL | hxxp://176[.]65[.]134[.]11/lol[.]mips hxxp://176[.]65[.]134[.]11/skid[.]mips hxxp://185[.]121[.]13[.]159/skid[.]mips hxxp://185[.]121[.]13[.]159/lol[.]mips hxxp://185[.]121[.]13[.]159/tmips hxxp://185[.]121[.]13[.]159/wg[.]sh hxxp://176[.]65[.]134[.]11/r[.]sh hxxp://185[.]121[.]13[.]159/wget[.]sh hxxp://176[.]65[.]134[.]11/wget[.]sh hxxp://176[.]65[.]134[.]11/n[.]sh hxxp://176[.]65[.]134[.]11/wg[.]sh hxxp://176[.]65[.]134[.]11/x[.]sh hxxp://185[.]121[.]13[.]159/n[.]sh hxxp://185[.]121[.]13[.]159/x[.]sh hxxp://185[.]121[.]13[.]159/t |
Bashlite |
| URL | hxxp://87[.]106[.]52[.]7:6472/update[.]exe hxxp://87[.]106[.]52[.]7:6472/sparkworkings[.]exe hxxp://87[.]106[.]52[.]7:6472/msi[.]exe |
SparkRAT |
| URL | hxxps://api[.]telegram[.]org/bot8091311912:AAG8i0a5VnB1EIX9bk5LyNgD349nDDOOW2c/sendMessage?chat_id=8110801113 | MASS Logger |
| URL | hxxp://www[.]vetxiu[.]xyz/st29/ hxxp://www[.]vixmedical[.]net/st29/ hxxp://www[.]xoyopa[.]top/d26z/ hxxp://www[.]xrdj6[.]click/d26z/ hxxp://www[.]y488[.]top/st29/ hxxp://www[.]ybx64y[.]top/d26z/ hxxp://www[.]yconadminagent231c[.]vip/st29/ hxxp://www[.]zjiaqi[.]top/st29/ hxxp://www[.]spiringhopetherapy[.]net/st29/ hxxp://www[.]svsku[.]cfd/st29/ hxxp://www[.]telierprive[.]shop/st29/ hxxp://www[.]terators-harmful[.]sbs/st29/ hxxp://www[.]tonano[.]live/d26z/ hxxp://www[.]touvl[.]top/st29/ hxxp://www[.]trckt[.]shop/st29/ hxxp://www[.]utch-lessons-utrecht[.]xyz/d26z/ hxxp://www[.]utiara88slot[.]net/d26z/ hxxp://www[.]v9[.]top/d26z/ hxxp://www[.]vemaci[.]top/d26z/ hxxp://www[.]psrn[.]vip/st29/ hxxp://www[.]pyd290[.]top/st29/ hxxp://www[.]rankie-shop[.]net/st29/ hxxp://www[.]ranscooter[.]shop/st29/ hxxp://www[.]readepagamentodocliente[.]shop/st29/ hxxp://www[.]renagames[.]xyz/st29/ hxxp://www[.]rhalten[.]shop/d26z/ hxxp://www[.]rhamoutreach[.]center/d26z/ hxxp://www[.]rr01h[.]top/d26z/ hxxp://www[.]rysimpson-judgeteam[.]sbs/st29/ hxxp://www[.]sbxn0[.]top/st29/ hxxp://www[.]spgo2[.]top/st29/ hxxp://www[.]omcafe[.]net/d26z/ hxxp://www[.]op-lottery[.]top/st29/ hxxp://www[.]oto[.]africa/d26z/ hxxp://www[.]ourbon[.]beer/st29/ hxxp://www[.]overed-terrace-12433[.]bond/d26z/ hxxp://www[.]peneochub[.]cfd/d26z/ hxxp://www[.]pentomorrow-team[.]top/d26z/ hxxp://www[.]pi0wp[.]top/st29/ hxxp://www[.]pitegromab[.]lat/st29/ hxxp://www[.]plta[.]app/st29/ hxxp://www[.]poe154[.]top/st29/ hxxp://www[.]masilevich[.]net/st29/ hxxp://www[.]netrve[.]xyz/d26z/ hxxp://www[.]nglish-class-in12[.]today/st29/ hxxp://www[.]nline-dating-90203[.]bond/d26z/ hxxp://www[.]nviodigiitaalmail[.]shop/st29/ hxxp://www[.]nviodigitalbox[.]shop/d26z/ hxxp://www[.]o-tci[.]xyz/d26z/ hxxp://www[.]oinlivegoodbusiness[.]shop/d26z/ hxxp://www[.]okhaus[.]shop/st29/ hxxp://www[.]oldsmitglass[.]xyz/d26z/ hxxp://www[.]olimit4[.]shop/st29/ hxxp://www[.]iq0wh[.]top/d26z/ hxxp://www[.]ir-condition-56201[.]bond/d26z/ hxxp://www[.]irtrghhgfgerd[.]xyz/d26z/ hxxp://www[.]j-guiapg[.]win/st29/ hxxp://www[.]j-turismopg[.]pro/d26z/ hxxp://www[.]jyjmm[.]top/d26z/ hxxp://www[.]lackheads-treatment-54469[.]bond/d26z/ hxxp://www[.]lassicaluxe[.]shop/d26z/ hxxp://www[.]layclub-win[.]xyz/d26z/ hxxp://www[.]lobalschoolfinder[.]net/d26z/ hxxp://www[.]loo-meet[.]live/d26z/ hxxp://www[.]hopluxurys[.]shop/d26z/ hxxp://www[.]hoppers[.]bet/d26z/ hxxp://www[.]hy-is-tiktok-back[.]cfd/st29/ hxxp://www[.]hyd309[.]top/st29/ hxxp://www[.]ian450[.]xyz/d26z/ hxxp://www[.]iaurro[.]net/d26z/ hxxp://www[.]iendaneba[.]shop/st29/ hxxp://www[.]ij300[.]top/st29/ hxxp://www[.]ingfengyun[.]net/d26z/ hxxp://www[.]inoro[.]live/d26z/ hxxp://www[.]intechwizard[.]cloud/d26z/ hxxp://www[.]ellogreentechproducts[.]click/d26z/ hxxp://www[.]encentvxug[.]cfd/d26z/ hxxp://www[.]enviodoocorreio[.]shop/st29/ hxxp://www[.]ergki[.]top/st29/ hxxp://www[.]et-simpson-judgehq[.]top/st29/ hxxp://www[.]ewelry-39148[.]bond/d26z/ hxxp://www[.]eylonesports[.]xyz/d26z/ hxxp://www[.]fhtre[.]xyz/st29/ hxxp://www[.]fxk6i[.]top/d26z/ hxxp://www[.]g8[.]top/st29/ hxxp://www[.]gbrfvedc556[.]sbs/d26z/ hxxp://www[.]gyl[.]net/d26z/ hxxp://www[.]ceberg[.]black/st29/ hxxp://www[.]deacloud[.]top/d26z/ hxxp://www[.]e944[.]top/st29/ hxxp://www[.]eabook[.]mobi/st29/ hxxp://www[.]ealmworld563[.]top/d26z/ hxxp://www[.]ecordsuspension[.]services/d26z/ hxxp://www[.]eds-bz[.]sbs/st29/ hxxp://www[.]eet-new-people-35202[.]bond/st29/ hxxp://www[.]eet-new-people-42361[.]bond/st29/ hxxp://www[.]eeyee[.]shop/d26z/ hxxp://www[.]elegcpnm[.]vip/st29/ hxxp://www[.]arkinsons-treatment-15707[.]bond/d26z/ hxxp://www[.]arshaastore[.]pro/st29/ hxxp://www[.]artadecondutorjunho[.]click/st29/ hxxp://www[.]aser-hair-removal-dje[.]sbs/st29/ hxxp://www[.]asorobles[.]pizza/d26z/ hxxp://www[.]attcursor[.]net/d26z/ hxxp://www[.]avddk[.]top/st29/ hxxp://www[.]b811[.]top/st29/ hxxp://www[.]c0679[.]top/d26z/ hxxp://www[.]c4509[.]top/d26z/ hxxp://www[.]c4821[.]top/d26z/ hxxp://www[.]6417968[.]vip/d26z/ hxxp://www[.]73102[.]vip/d26z/ hxxp://www[.]849n7the[.]info/st29/ hxxp://www[.]8622[.]vip/d26z/ hxxp://www[.]8j08o[.]top/d26z/ hxxp://www[.]956[.]ceo/st29/ hxxp://www[.]a-lumiosa[.]net/d26z/ hxxp://www[.]ampiq[.]xyz/st29/ hxxp://www[.]ands[.]services/st29/ hxxp://www[.]anfa[.]net/st29/ hxxp://www[.]angfuji[.]top/st29/ hxxp://www[.]1e1ff22[.]live/d26z/ hxxp://www[.]1sosq[.]top/st29/ hxxp://www[.]1vwud[.]top/st29/ hxxp://www[.]24d9b8e[.]live/d26z/ hxxp://www[.]2yxp0[.]top/d26z/ hxxp://www[.]30cc[.]vip/st29/ hxxp://www[.]3sao[.]top/st29/ hxxp://www[.]3x[.]top/st29/ hxxp://www[.]400forestwood[.]info/d26z/ hxxp://www[.]55501[.]top/st29/ |
Formbook |
| URL | hxxp://79[.]141[.]165[.]202/a9b024dccb2b4f24[.]php hxxp://ebalazhabagadyku[.]icu/faf03cf70f5649e1[.]php hxxp://178[.]16[.]55[.]189/files/7631641590/CAuLv8j[.]exe |
Stealc |
| URL | hxxp://80[.]78[.]23[.]232:8080/TaskFleet[.]exe | AsyncRAT |
| URL | hxxp://149[.]88[.]86[.]47:8080/payload[.]exe hxxp://149[.]88[.]86[.]47:8080/output_64[.]exe hxxp://149[.]88[.]86[.]47:8080/23[.]exe |
ValleyRAT |
| URL | hxxps://nkcomputers[.]rs/js/Tue2608[.]txt | Snake Keylogger |
| URL | hxxp://178[.]16[.]55[.]189/files/1763292343/qi2RH0e[.]exe | Rhadamanthys |
| URL | hxxp://uploadtree[.]com/Setup_v2025[.]dmg | AMOS |
| URL | hxxp://117[.]72[.]83[.]6:5520/02[.]08[.]2022[.]exe hxxp://39[.]100[.]74[.]54/02[.]08[.]2022[.]exe hxxp://47[.]120[.]32[.]72:8069/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxps://151[.]16[.]89[.]128:8443/sda1/AV[.]scr hxxps://151[.]16[.]89[.]128:8443/sda1/32gb/Photo[.]scr hxxps://151[.]16[.]89[.]128:8443/sda1/Video[.]scr hxxps://151[.]16[.]89[.]128:8443/sda1/Photo[.]scr hxxps://151[.]16[.]89[.]128:8443/sda1/32gb/AV[.]scr hxxps://151[.]16[.]89[.]128:8443/sda1/32gb/Video[.]scr |
Coinminer |
