不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2025/09/03
※2025/09/03 更新
マルウェア感染させると考えられるURLを検知（2025/09/03）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://11[.]jujosuu4[.]ru/21uongoyfh[.]flac hxxps://11[.]jujosuu4[.]ru/4hhxl4lurk[.]flac hxxps://11[.]jujosuu4[.]ru/4ijo6750oo[.]flac hxxps://11[.]jujosuu4[.]ru/5pynqb9iar[.]flac hxxps://11[.]jujosuu4[.]ru/kp84kc3r49[.]flac hxxps://11[.]jujosuu4[.]ru/8oy0k2uzuc[.]flac hxxps://11[.]jujosuu4[.]ru/eb45o1zs97[.]flac hxxps://11[.]jujosuu4[.]ru/g5xxph5ro7[.]flac hxxps://11[.]jujosuu4[.]ru/pxclrm3fvg[.]flac hxxps://11[.]jujosuu4[.]ru/z9lujizy6k[.]flac hxxps://avast[.]cucy[.]ru/2dc065f62ee8774c2517bf4c4d2c1211 hxxps://11[.]jujosuu4[.]ru/barto6hjd3[.]flac hxxps://11[.]jujosuu4[.]ru/cr5a6a6yhn[.]flac hxxps://11[.]jujosuu4[.]ru/ett53dyyis[.]flac hxxps://11[.]jujosuu4[.]ru/05rjuxlo2f[.]flac hxxps://11[.]jujosuu4[.]ru/z9u149ukkk[.]flac hxxps://11[.]jujosuu4[.]ru/e0iihi33n9[.]flac hxxps://11[.]jujosuu4[.]ru/7phl383vg5[.]flac hxxps://11[.]jujosuu4[.]ru/ba6vt2tsq9[.]flac hxxps://11[.]jujosuu4[.]ru/seorzx2evi[.]flac hxxps://11[.]jujosuu4[.]ru/ws37ln2kaf[.]flac hxxps://11[.]jujosuu4[.]ru/cullb7ppki[.]flac hxxps://11[.]jujosuu4[.]ru/u78ykfw1fz[.]flac hxxps://11[.]jujosuu4[.]ru/68ezt49qav[.]flac hxxps://11[.]jujosuu4[.]ru/aewqxlhlv3[.]flac hxxps://11[.]jujosuu4[.]ru/9d0fznfi2e[.]flac hxxps://11[.]jujosuu4[.]ru/5rqzq95kft[.]flac hxxps://11[.]jujosuu4[.]ru/2l4vkay5s8[.]flac hxxps://crisp[.]cucy[.]ru/2dc065f62ee8774c2517bf4c4d2c1211 hxxps://ewg[.]jujosuu4[.]ru/f4foz2wnw8[.]flac hxxps://loe[.]jujosuu4[.]ru/2z3hrty6il[.]flac hxxps://ewg[.]jujosuu4[.]ru/knzrzmc64w[.]flac hxxps://ewg[.]jujosuu4[.]ru/c6vp1olqk4[.]flac hxxps://loe[.]jujosuu4[.]ru/8akauxvv5a[.]flac hxxps://loe[.]jujosuu4[.]ru/bcqus1s9o0[.]flac hxxps://loe[.]jujosuu4[.]ru/3igsu5jmw7[.]flac hxxps://loe[.]jujosuu4[.]ru/xmfrdcbt1q[.]flac hxxps://loe[.]jujosuu4[.]ru/bxkh0d6en7[.]flac hxxps://loe[.]jujosuu4[.]ru/r665regiq0[.]flac hxxps://loe[.]jujosuu4[.]ru/wu2hkmdkqc[.]flac |
ClearFake |
| URL | hxxp://178[.]16[.]55[.]70/v3434[.]exe hxxp://178[.]16[.]55[.]189/files/784403925/K8kGyaj[.]exe |
Vidar |
| URL | hxxp://178[.]16[.]55[.]189/files/8434554557/2c8FJYQ[.]exe | PureLogs Stealer |
| URL | hxxp://196[.]251[.]73[.]58/H2/JAY[.]zip hxxp://107[.]175[.]243[.]133/Veddooood[.]txt |
Agent Tesla |
| URL | hxxp://107[.]174[.]212[.]72/nativeee[.]txt hxxp://107[.]174[.]212[.]72/optimized_MSI[.]png |
DarkCloud |
| URL | hxxp://178[.]16[.]55[.]70/v19239[.]exe | Venom RAT |
| URL | hxxps://api[.]telegram[.]org/bot7968139020:AAHz3SN_Tjts4yOHRR6feYYwCQX7wzZ3Nbw/sendMessage?chat_id=7406080547 | Prynt Stealer |
| URL | hxxps://128[.]199[.]113[.]162/panel/index[.]php | Amadey |
| URL | hxxp://85[.]209[.]129[.]105:2020/test112 hxxp://188[.]245[.]167[.]86/second[.]html hxxps://vcsinfo[.]com/4r6y[.]js hxxps://vcsinfo[.]com/js[.]php |
KongTuke |
| URL | hxxp://185[.]39[.]207[.]39:8080/file/sw[.]msi | MetaStealer |
| URL | hxxps://wesyjzn[.]top/zalr hxxps://185[.]102[.]115[.]69/48e[.]lim hxxp://185[.]102[.]115[.]69/48e[.]lim hxxp://muriaspetin[.]es/wp-load/Solana%203[.]0[.]exe hxxp://muriaspetin[.]es/wp-load/Kmahjongg[.]exe |
Lumma Stealer |
| URL | hxxp://www[.]vahaca[.]top/fa27/ hxxp://www[.]wn6do[.]top/fa27/ hxxp://www[.]ye6cvdg[.]top/fa27/ hxxp://www[.]ystems2beyond[.]tech/fa27/ hxxp://www[.]zborderfree[.]net/fa27/ hxxp://www[.]0632[.]club/fa27/ hxxp://www[.]povamu[.]top/fa27/ hxxp://www[.]rownandcleatco[.]shop/fa27/ hxxp://www[.]s667788[.]xyz/fa27/ hxxp://www[.]sy644[.]top/fa27/ hxxp://www[.]sy897[.]top/fa27/ hxxp://www[.]tudygym[.]net/fa27/ hxxp://www[.]udness[.]art/fa27/ hxxp://www[.]utihslote[.]cfd/fa27/ hxxp://www[.]olikujyh990[.]sbs/fa27/ hxxp://www[.]omeradar[.]top/fa27/ hxxp://www[.]oofwaterproofing462[.]click/fa27/ hxxp://www[.]orytharothis[.]sbs/fa27/ hxxp://www[.]ososo[.]tech/fa27/ hxxp://www[.]osteam[.]net/fa27/ hxxp://www[.]oticiasdamanha[.]shop/fa27/ hxxp://www[.]ove678i[.]app/fa27/ hxxp://www[.]oviesnn[.]pro/fa27/ hxxp://www[.]livinski[.]pro/fa27/ hxxp://www[.]lossbossclean[.]pro/fa27/ hxxp://www[.]lphageek[.]app/fa27/ hxxp://www[.]mvv34z[.]top/fa27/ hxxp://www[.]ngimg[.]vip/fa27/ hxxp://www[.]ockscrm[.]xyz/fa27/ hxxp://www[.]ogw159[.]top/fa27/ hxxp://www[.]oisturizee[.]shop/fa27/ hxxp://www[.]ghhfy[.]xyz/fa27/ hxxp://www[.]hysicians-to-women[.]cfd/fa27/ hxxp://www[.]ian485[.]xyz/fa27/ hxxp://www[.]itaslotk[.]cfd/fa27/ hxxp://www[.]iveroad[.]xyz/fa27/ hxxp://www[.]ivn[.]website/fa27/ hxxp://www[.]jc169[.]app/fa27/ hxxp://www[.]lhet[.]net/fa27/ hxxp://www[.]eet-new-people-21453[.]bond/fa27/ hxxp://www[.]eetmoonbuggy[.]click/fa27/ hxxp://www[.]ellgreensportseducation[.]info/fa27/ hxxp://www[.]eople-search-65430[.]bond/fa27/ hxxp://www[.]etchelpgovtw[.]top/fa27/ hxxp://www[.]etnow[.]sbs/fa27/ hxxp://www[.]etworkmodel[.]net/fa27/ hxxp://www[.]excol[.]vip/fa27/ hxxp://www[.]g-899b9[.]xyz/fa27/ hxxp://www[.]astplay[.]click/fa27/ hxxp://www[.]atchbox[.]exchange/fa27/ hxxp://www[.]attoosbymatt[.]studio/fa27/ hxxp://www[.]c0824[.]top/fa27/ hxxp://www[.]c1302[.]top/fa27/ hxxp://www[.]c2751[.]top/fa27/ hxxp://www[.]c4589[.]top/fa27/ hxxp://www[.]dfsewq[.]xyz/fa27/ hxxp://www[.]earches[.]dev/fa27/ hxxp://www[.]0llhs[.]sbs/fa27/ hxxp://www[.]1tnsf[.]top/fa27/ hxxp://www[.]77-matraca777[.]win/fa27/ hxxp://www[.]ablu[.]pro/fa27/ hxxp://www[.]alloffameopen1[.]net/fa27/ hxxp://www[.]anktl[.]net/fa27/ hxxp://www[.]apital-a[.]group/fa27/ hxxp://www[.]arewajan[.]xyz/fa27/ |
Formbook |
| URL | hxxp://194[.]26[.]192[.]129:8000/win64[.]exe | Sliver |
| URL | hxxp://194[.]26[.]192[.]129:8000/payload[.]exe hxxp://100[.]27[.]187[.]56/ujjwal[.]exe hxxp://100[.]27[.]187[.]56/deepanshu[.]exe |
Meterpreter |
| URL | hxxp://185[.]241[.]208[.]92/ready[.]apk | SpyNote |
| URL | hxxp://172[.]245[.]4[.]220/45/images=PNGgooodformatePDF=Docxnotreallygood[.]hta | Remcos |
| URL | hxxps://peerless-support[.]org/Unbran[.]ocx hxxps://peerless-support[.]org/Stadsarkitekternes[.]dsp hxxps://mrsitvm[.]org/qWyJTjmbYMtBbd86[.]bin |
CloudEyE |
| URL | hxxp://logistics[.]xo[.]je/arquivo_20250902093656[.]txt | Snake Keylogger |
| URL | hxxps://info-2go[.]com/ajax/pixi[.]min[.]js hxxps://wood-simple[.]com/res/dampthere hxxps://wood-simple[.]com/drip[.]sym hxxps://wood-simple[.]com/assets/img/1957b95c3[.]res |
NetSupportManager RAT |
| URL | hxxps://samples[.]salondeguitaredemontreal[.]com/pixel[.]png | FAKEUPDATES |
| URL | hxxp://91[.]224[.]92[.]14/sh4 hxxp://91[.]224[.]92[.]14/mpsl hxxp://91[.]224[.]92[.]14/mips hxxp://91[.]224[.]92[.]14/hmips |
Bashlite |
| URL | hxxp://8[.]135[.]13[.]184:8888/02[.]08[.]2022[.]exe hxxp://156[.]244[.]56[.]37/02[.]08[.]2022[.]exe hxxp://203[.]9[.]150[.]250:8081/02[.]08[.]2022[.]exe hxxp://193[.]112[.]206[.]250:24635/02[.]08[.]2022[.]exe hxxp://23[.]95[.]227[.]215:56874/02[.]08[.]2022[.]exe hxxp://91[.]210[.]108[.]135/02[.]08[.]2022[.]exe hxxp://81[.]68[.]95[.]163:8080/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://45[.]153[.]34[.]30/dad3a40e52e74806[.]php | Stealc |
| URL | hxxp://newhousepanel[.]info/too/five/fre[.]php | LokiBot |
