不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/09/02
※2025/09/02 更新
マルウェア感染させると考えられるURLを検知（2025/09/02）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://we[.]vupabya1[.]ru/o0qsjf59vy[.]flac hxxps://we[.]vupabya1[.]ru/sofecmhlf2[.]flac hxxps://we[.]vupabya1[.]ru/dstk8z53qi[.]flac hxxps://we[.]vupabya1[.]ru/9e3w70b02m[.]flac hxxps://we[.]vupabya1[.]ru/n7shue6pdi[.]flac hxxps://we[.]vupabya1[.]ru/vs9uyzsfuy[.]flac hxxps://we[.]vupabya1[.]ru/ey7uddit15[.]flac hxxps://we[.]vupabya1[.]ru/i2hw1tz6yr[.]flac hxxps://we[.]vupabya1[.]ru/68ctzoiacm[.]flac hxxps://we[.]vupabya1[.]ru/8l22x71nmh[.]flac hxxps://we[.]vupabya1[.]ru/0k34ftfkh6[.]flac hxxps://we[.]vupabya1[.]ru/obtsiag846[.]flac hxxps://we[.]vupabya1[.]ru/gasm23itpm[.]flac hxxps://we[.]vupabya1[.]ru/9ibvkvosf8[.]flac hxxps://we[.]vupabya1[.]ru/aychdkj68v[.]flac hxxps://we[.]vupabya1[.]ru/d35soxj5qj[.]flac hxxps://we[.]vupabya1[.]ru/dhclttm6i0[.]flac hxxps://we[.]vupabya1[.]ru/i1ws42klhu[.]flac hxxps://we[.]vupabya1[.]ru/zqr59rsdt6[.]flac hxxps://we[.]vupabya1[.]ru/2q7cvv3myo[.]flac hxxps://we[.]vupabya1[.]ru/d6bhkb3zzq[.]flac hxxps://we[.]vupabya1[.]ru/53li63yq0y[.]flac hxxps://we[.]vupabya1[.]ru/9t2k4q27fe[.]flac hxxps://we[.]vupabya1[.]ru/j5o3qw2v5d[.]flac hxxps://we[.]vupabya1[.]ru/7bu463z5pw[.]flac hxxps://we[.]vupabya1[.]ru/7a6bwy0w2f[.]flac hxxps://we[.]vupabya1[.]ru/3h2kk66eyu[.]flac hxxps://ch[.]hekulei5[.]ru/72uj3913bz[.]flac hxxps://ch[.]hekulei5[.]ru/3yiy498aat[.]flac hxxps://ch[.]hekulei5[.]ru/xx9uiz2kqd[.]flac hxxps://ch[.]hekulei5[.]ru/dooj1zwln5[.]flac hxxps://ch[.]hekulei5[.]ru/8prghvyjww[.]flac hxxps://11[.]jujosuu4[.]ru/rgrfo1cqvp[.]flac hxxps://11[.]jujosuu4[.]ru/um0aevxzx3[.]flac hxxps://11[.]jujosuu4[.]ru/6h8s8vmf78[.]flac hxxps://11[.]jujosuu4[.]ru/yqs9wlnllm[.]flac hxxps://11[.]jujosuu4[.]ru/ifv1l2lug7[.]flac hxxps://11[.]jujosuu4[.]ru/47932vkdna[.]flac |
ClearFake |
| URL | hxxp://178[.]16[.]55[.]189/files/5298241443/HAZf8Oy[.]exe hxxps://151[.]16[.]120[.]144:8443/sda1/32gb/AV[.]scr hxxps://151[.]16[.]120[.]144:8443/sda1/Video[.]scr hxxps://151[.]16[.]120[.]144:8443/sda1/Photo[.]scr hxxps://151[.]16[.]120[.]144:8443/sda1/32gb/Video[.]scr hxxps://151[.]16[.]120[.]144:8443/sda1/AV[.]scr hxxps://151[.]16[.]120[.]144:8443/sda1/32gb/Photo[.]scr |
Coinminer |
| URL | hxxp://178[.]16[.]55[.]189/files/6350135267/nGPe7ZU[.]exe hxxps://passagem-aviao[.]com/ConvertedFile[.]txt |
XWorm |
| URL | hxxp://178[.]16[.]55[.]189/files/2096817243/Mhmd4ed[.]exe hxxps://despofe[.]top/zlai hxxp://bypass188v144[.]xyz/zgWAINHyC[.]html hxxp://178[.]16[.]53[.]7/1[.]exe hxxp://176[.]46[.]152[.]47/2[.]exe hxxps://caltpps[.]top/xaor hxxps://savoref[.]top/eotr hxxps://interbk[.]top/login hxxps://caltpps[.]top/login hxxps://comqpru[.]top/login hxxps://ardhpeb[.]top/login hxxps://excufoc[.]top/login hxxps://larpfxs[.]top/login hxxps://parabcn[.]top/wqkd hxxp://178[.]16[.]53[.]7/xx[.]exe |
Lumma Stealer |
| URL | hxxp://178[.]16[.]55[.]189/files/5254702106/FaPJWth[.]exe hxxps://68[.]183[.]108[.]129/6259fdc16222e061[.]php hxxp://178[.]16[.]55[.]189/files/5254702106/kdK1YiK[.]exe |
Stealc |
| URL | hxxps://download01[.]pdfscraper[.]site/0?cid=gpP103tyQbYfk6MvV5 | TamperedChef |
| URL | hxxp://178[.]16[.]53[.]7/8[.]exe hxxp://178[.]16[.]53[.]7/a[.]exe hxxps://77[.]90[.]153[.]62/cvdfnaFJBmC0/index[.]php hxxps://178[.]16[.]53[.]7/cvdfnaFJBmC1/index[.]php hxxps://196[.]251[.]85[.]220/E3jv8fS9b/Login[.]php hxxps://178[.]16[.]53[.]7/cvdfnafjbmc1/login[.]php hxxps://77[.]90[.]153[.]62/cvdfnaFJBmC0/Login[.]php hxxps://193[.]233[.]20[.]25/buh5n004d/index[.]php |
Amadey |
| URL | hxxps://mohamedayesh[.]com/IZ[.]txt hxxp://shipping[.]xo[.]je/arquivo_20250901011247[.]txt |
Formbook |
| URL | hxxp://shipping[.]xo[.]je/arquivo_20250901011803[.]txt | Remcos |
| URL | hxxps://tmello[.]com/9y4s[.]js hxxps://tmello[.]com/js[.]php hxxp://85[.]209[.]129[.]105:2020/19 |
KongTuke |
| URL | hxxps://api[.]telegram[.]org/bot8465215406:AAF3ysxzQJJIRH2W3C8FFiAFqPOT-ARsLFQ/sendMessage?chat_id=5061956073 hxxps://api[.]telegram[.]org/bot8276519013:AAEwAXep-GSs1g7rvrhtPdVTDu6x1TeBu9c/sendMessage?chat_id=5485275217 hxxps://api[.]telegram[.]org/bot8404989010:AAH02umxxz9UQSYsvBClKaajvkY_YwEzrmc/sendMessage?chat_id=2129776756 |
Snake Keylogger |
| URL | hxxps://futurenaturallistic[.]com/res/groceryarm hxxps://poertywindow[.]com/ajax/pixi[.]min[.]js hxxps://futurenaturallistic[.]com/bracket[.]sym hxxps://futurenaturallistic[.]com/assets/img/6957b95c3[.]res hxxps://cf-2-up[.]com/assets/img/9952e53658b97e85[.]txt |
NetSupportManager RAT |
| URL | hxxp://89[.]197[.]167[.]116:7700/xt89 hxxp://101[.]43[.]94[.]35:8081/02[.]08[.]2022[.]exe hxxp://20[.]2[.]220[.]82:42666/02[.]08[.]2022[.]exe hxxp://156[.]238[.]243[.]107/02[.]08[.]2022[.]exe hxxp://129[.]28[.]180[.]115:8081/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxps://udadu[.]org/Granadilla[.]rar | CloudEyE |
| URL | hxxp://pony[.]gsghost[.]pro/panel/shit[.]exe hxxp://pony[.]gsghost[.]pro/panel/gate[.]php |
Pony |
| URL | hxxps://api[.]telegram[.]org/bot6999938748:AAG8HM9iKj0Uks7A3Zj_uk_1u1EuLqsP_og/ | Agent Tesla |
| URL | hxxps://www[.]krista-tur[.]ru/login/ | SalatStealer |
| URL | hxxp://109[.]172[.]6[.]232/todb/line4/PythonDle57/PipeDbTemp/Pipesecure/LinuxCpuEternalprocess/Http/Generator/2/Track7Asynccentral/universal7mariadbphp/ExternalPipeBigloadflowertestDleCentraluploads[.]php | DCRat |
| URL | hxxps://185[.]241[.]208[.]92/ready[.]apk | SpyNote |
| URL | hxxps://kgprotool[.]com/KGPROTOOL[.]rar | PureCrypter |
| URL | hxxp://152[.]53[.]209[.]147/arm4 | Bashlite |
| URL | hxxp://fuckyou[.]com:443/is-ready | WSHRAT |
| URL | hxxps://api[.]telegram[.]org/bot8028813049:AAH5shqrvL3u0a9Wi_2_sWA9S704IGsaQtc/sendMessage?chat_id=7209796451 | DarkCloud |
