不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/09/17
※2025/09/17 更新
マルウェア感染させると考えられるURLを検知（2025/09/17）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://www[.]4sync[.]com/web/directDownload/4oGDw4Kh/4W5DbszB[.]6954deb64a68ff4558b02a4eb3ea5edb hxxps://mikhail-bulgakov[.]su/login hxxp://178[.]16[.]54[.]200/files/6491397189/fCUE4cF[.]exe hxxps://faspub[.]asia/wqdh hxxps://greued[.]asia/atii hxxps://strmuc[.]asia/atnn hxxps://maiwau[.]asia/xajh hxxps://rosajd[.]asia/tewq hxxps://reformd[.]asia/aooz hxxps://mannewd[.]shop/wqkx hxxps://stozft[.]asia/xakd hxxps://bouyeit[.]asia/akwe hxxps://github[.]com/maddire/FortniteSpoofer/raw/refs/heads/main/TempSpoofer[.]exe hxxps://github[.]com/lawwyerss/FiveM-Spoofer/raw/refs/heads/main/CFXBypass[.]exe hxxps://github[.]com/shammei/Temp-Spoofer-LifeTime/raw/refs/heads/main/TempSpoofer[.]exe hxxps://swifew[.]asia/xawe |
Lumma Stealer |
| URL | hxxps://apn-state-upd2[.]com/goN9Z2In7mYQmN92dzX11CQL[.]php hxxps://apn-state-upd2[.]com/p5Pss34GvX21pxO0bz25vLqU[.]php |
StrongPity |
| URL | hxxps://com-auth[.]live-on[.]net/?naps | Kimsuky |
| URL | hxxps://95[.]164[.]53[.]109/f8nus4b/Login[.]php hxxps://microsoft-telemetry[.]at/cvdfnaFJBmC0/Login[.]php hxxps://195[.]10[.]205[.]137/h9dkSfjhacM/index[.]php hxxps://178[.]16[.]54[.]200/du4ko7hd/index[.]php hxxps://95[.]164[.]53[.]109/f8nus4b/index[.]php hxxps://91[.]238[.]50[.]169/f8nus4b/Login[.]php hxxps://178[.]16[.]54[.]200/du4ko7hd/Login[.]php hxxp://microsoft-telemetry[.]at/cvdfnaFJBmC0/Login[.]php |
Amadey |
| URL | hxxps://webrat[.]uk/login/ | SalatStealer |
| URL | hxxps://45[.]88[.]105[.]102/16f0dab394a3d6f7[.]php hxxp://178[.]16[.]54[.]175/e9762ff07e084dbb[.]php hxxp://178[.]16[.]54[.]200/files/5876083921/iYKA8yB[.]exe |
Stealc |
| URL | hxxps://clajal[.]vendendosonhos[.]yachts/?77815105734632928 | Astaroth |
| URL | hxxp://ardt[.]info/tmp/ hxxp://e-bonds[.]ru/tmp/ hxxp://cobyrose[.]com/tmp/ hxxp://dfbdw3tyge[.]info/tmp/ hxxp://cusnick[.]com/tmp/ hxxp://es-koerier[.]nl/tmp/ hxxp://solanges[.]info/tmp/ hxxp://udlg[.]nl/tmp/ |
SmokeLoader |
| URL | hxxps://incitysteel[.]top/Paro[.]snp hxxps://incitysteel[.]top/sgqmgU172[.]bin |
CloudEyE |
| URL | hxxp://110[.]42[.]139[.]169/1[.]exe | Ghost RAT |
| URL | hxxp://154[.]23[.]243[.]186:9966/TrGP | Cobalt Strike |
| URL | hxxp://45[.]61[.]134[.]233/new/remcos_alit_encoded[.]txt hxxp://45[.]61[.]134[.]233/new/remcos_aade_encoded[.]txt hxxp://107[.]175[.]246[.]22/466/clearpicture________00995868689494859699969966556[.]PHP hxxp://172[.]245[.]4[.]220/img/optimized_MSI[.]png hxxps://www[.]logpasta[.]com/paste/raw/fe3475c3-e2f6-418d-a375-82d2baedd021[.]txt hxxps://www[.]logpasta[.]com/paste/raw/5f5ec968-7da5-41db-9cab-6497c131ab4c[.]txt hxxp://96[.]44[.]159[.]216/244/clearpicture________003594589435898968549698[.]PHP hxxp://107[.]175[.]246[.]22/img/brz/module_table_bottom___0004045005033454555555[.]PHP |
Remcos |
| URL | hxxp://91[.]92[.]240[.]104/gbIM8JUazFGEAPH[.]exe | MASS Logger |
| URL | hxxps://app-ups[.]com/file/api-guide[.]pdf | MetaStealer |
| URL | hxxp://178[.]16[.]54[.]200/files/2108618161/OK1UWyn[.]exe | Coinminer |
| URL | hxxp://81[.]19[.]131[.]66/1[.]exe | Phemedrone Stealer |
| URL | hxxp://90[.]156[.]204[.]164/1[.]exe | DCRat |
| URL | hxxps://api[.]telegram[.]org/bot8141955787:AAGyGZ0901vMZoC8ZpPRY2-leFwqkkwfhS8/sendMessage?chat_id=7941912170 | Snake Keylogger |
| URL | hxxps://mersinet[.]com/3l9a[.]js hxxps://mersinet[.]com/js[.]php |
KongTuke |
| URL | hxxp://alpinreisan1[.]com/CDD[.]exe | BluStealer |
| URL | hxxps://milder-go[.]com/ajax/pixi[.]min[.]js hxxps://4reverinmymind[.]com/res/output |
NetSupportManager RAT |
| URL | hxxps://n[.]l48i[.]ru/7xkog235fi[.]webm hxxps://5n[.]97qm[.]ru/0v3[.]check?t=bj6d51fs hxxps://n[.]l48i[.]ru/pcz9osqkox[.]webm hxxps://k[.]97qm[.]ru/xe[.]google?t=popngo5e hxxps://n[.]l48i[.]ru/zh6iimbvr4[.]webm hxxps://tf[.]hecynya[.]ru/b9keRvhw/F[.]ct/bb48881254196acb722b53b8e8127d1c[.]txt hxxps://a1x[.]81dm[.]ru/y0k[.]check?t=garcecbk hxxps://j[.]29rs[.]ru/rt[.]google?t=lnfyo7li hxxps://wq9[.]l48i[.]ru/7spfppp7k0[.]webm hxxps://wq9[.]l48i[.]ru/lk7nleruyn[.]webm hxxps://z1[.]97qm[.]ru/h2[.]google?t=p52fdp0d hxxps://r[.]k26i[.]ru/p4fvf1zcpe[.]webm hxxps://e2[.]97jt[.]ru/vj2[.]check?t=uz1mtce4 hxxps://r[.]k26i[.]ru/j50o9nqwr8[.]webm hxxps://y[.]97jt[.]ru/q8[.]google?t=t6q2v39b hxxps://r[.]k26i[.]ru/8510y594lq[.]webm hxxps://bzr[.]29rs[.]ru/1v0[.]check?t=mnqgwhsf hxxps://md[.]jaxusoo[.]ru/2dc065f62ee8774c2517bf4c4d2c1211 hxxps://r[.]k26i[.]ru/0mzc1rt0ti[.]webm hxxps://4h[.]97jt[.]ru/n1[.]google?t=2zkfedlw hxxps://g[.]527w[.]ru/ab[.]google?t=t653qd6o hxxps://k3x[.]k26i[.]ru/tehoi9ryyh[.]webm hxxps://a1[.]k26i[.]ru/ukgl0mt8pl[.]webm hxxps://mkt[.]97jt[.]ru/3zx[.]check?t=n3nypvs0 hxxps://z[.]s57o[.]ru/t4ib58ox27[.]webm hxxps://n9[.]527w[.]ru/5qj[.]check?t=29r9uvbe hxxps://v5[.]s57o[.]ru/ef3p1ypig6[.]webm hxxps://s[.]802d[.]ru/yk[.]google?t=y8un1c6e hxxps://v5[.]s57o[.]ru/22jkh98bl5[.]webm hxxps://2w1[.]527w[.]ru/r0p[.]check?t=cg1ri0lo hxxps://v5[.]s57o[.]ru/rdcu4dpgjh[.]webm hxxps://tc[.]527w[.]ru/7n[.]google?t=fb6iylrd hxxps://cm0[.]s57o[.]ru/zff8bkvzin[.]webm hxxps://v3[.]802d[.]ru/l2[.]google?t=31mzb7a1 hxxps://h1[.]802d[.]ru/9fa[.]check?t=glxok4fv hxxps://cm0[.]s57o[.]ru/d7wq6h5mx1[.]webm |
ClearFake |
| URL | hxxps://alfryudabikuta[.]com/work/ hxxps://kutakdokliurio[.]com/work/ |
Latrodectus |
| URL | hxxp://193[.]23[.]200[.]78/api/YTAsODYsODIsOWQsYTEsODgsOTAsOTUsNjUsN2Qs | SmartLoader |
| URL | hxxp://gamesarena[.]gdn/configsettings/winning4cj/fre[.]php | LokiBot |
| URL | hxxp://178[.]16[.]55[.]189/files/7599742358/0GItVIx[.]exe | Quasar RAT |
