不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2025/09/18
※2025/09/18 更新
マルウェア感染させると考えられるURLを検知（2025/09/18）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://d1[.]v51o[.]ru/76tqzt53s3[.]webm hxxps://c8[.]526r[.]ru/w1n[.]check?t=mo4w1hcx hxxps://p[.]526r[.]ru/e4[.]google?t=ojcjxt06 hxxps://l[.]v51o[.]ru/8v8mb5edy8[.]webm hxxps://l[.]v51o[.]ru/c4pl3nsikf[.]webm hxxps://0zq[.]802d[.]ru/d7m[.]check?t=q4ovcs3i hxxps://x0r[.]v51o[.]ru/i416qgto9k[.]webm hxxps://u[.]s9i1[.]ru/oty[.]check?t=cko5q9d4 hxxps://x0r[.]v51o[.]ru/1pz1y066py[.]webm hxxps://bq[.]s9i1[.]ru/40[.]google?t=h4x98eui hxxps://x0r[.]v51o[.]ru/q9kneg1fcf[.]webm hxxps://rxe[.]526r[.]ru/gk0[.]check?t=60gr2rt4 hxxps://d1[.]v51o[.]ru/omeh1vf2l6[.]webm hxxps://1m[.]526r[.]ru/2h[.]google?t=2vcjt3b9 hxxps://ac[.]s3i1[.]ru/iy[.]google?t=tpwllc9a hxxps://ab2[.]z-20[.]ru/97y7tk7z3o[.]webm hxxps://ab2[.]z-20[.]ru/ui8dv04jqr[.]webm hxxps://i[.]s9i1[.]ru/09j[.]check?t=a9pdsktv hxxps://k[.]z-20[.]ru/zaz9iyi726[.]webm hxxps://ai[.]s9i1[.]ru/t5x[.]google?t=yurrds6v hxxps://w[.]s3i1[.]ru/v1[.]google?t=x63lkwu3 hxxps://m3[.]g-22[.]ru/zq08pulvp4[.]webm hxxps://v[.]g-22[.]ru/unh6352jmq[.]webm hxxps://ax[.]s3i1[.]ru/hwe[.]check?t=vifsu6n7 hxxps://qz7[.]g-22[.]ru/woz1i3doxj[.]webm hxxps://e[.]s3i1[.]ru/9b[.]check?t=r406zrvo hxxps://r[.]h-18[.]ru/0zff9pw97b[.]webm |
ClearFake |
| URL | hxxps://famixsk[.]shop/oxwi hxxp://178[.]16[.]54[.]200/files/7782139129/TxUgab9[.]exe hxxps://lepidry[.]asia/awxz hxxps://conbjao[.]qpon/xqwr hxxps://mindhlo[.]qpon/xawq hxxps://capitam[.]qpon/zdal hxxps://nerlzi[.]asia/zdje hxxps://bellmnk[.]asia/yoax hxxps://sirhirssg[.]su/ecti hxxps://runjhb[.]asia/ruuw |
Lumma Stealer |
| URL | hxxp://178[.]16[.]54[.]200/files/8434554557/yfUrA3L[.]exe | PureLogs Stealer |
| URL | hxxp://202[.]181[.]148[.]70/sanya[.]php hxxp://726346cm[.]nyash[.]es/Multiwordpress[.]php |
DCRat |
| URL | hxxp://mi[.]raisindispose[.]com/kaWt2QXfpPueNM/index[.]php | Amadey |
| URL | hxxp://loadstopdocs[.]com/carrierpacket/FullCarrierPacket[.]exe hxxps://everyday2gether[.]info/res/longmushroomvirus hxxps://ray2me[.]com/ajax/pixi[.]min[.]js |
NetSupportManager RAT |
| URL | hxxp://178[.]16[.]54[.]200/files/7782139129/Jxco8wM[.]exe | Socks5 Systemz |
| URL | hxxp://178[.]16[.]54[.]200/files/5917492177/NPvvq4k[.]exe hxxp://178[.]16[.]54[.]200/files/5917492177/QTu8SCx[.]exe hxxp://178[.]16[.]54[.]200/files/6637358436/AxISxxH[.]exe hxxp://176[.]46[.]152[.]62:5858/miport[.]exe |
Rhadamanthys |
| URL | hxxps://joebesser[.]com/6n8v[.]js hxxps://joebesser[.]com/js[.]php hxxp://144[.]31[.]221[.]126:6060/capcha9856 |
KongTuke |
| URL | hxxps://api[.]telegram[.]org/bot7557878970:AAFS5LKd9FSTQ5TElP4hSEp3L0G04w4ovM4/sendMessage hxxps://api[.]telegram[.]org/bot7557878970:AAHTDeaOHOrIcOu6X7asxQcRAJ6a4A8OpFA/sendMessage hxxps://api[.]telegram[.]org/bot7796044263:AAGK9WeS-TJOmWb7DUEqftS6yk9CZS3pLGY/sendMessage hxxp://185[.]208[.]158[.]56/testy[.]exe |
AsyncRAT |
| URL | hxxp://91[.]92[.]240[.]220/hiddenbin/mynode[.]sh4 hxxp://91[.]92[.]240[.]220/hiddenbin/mynode[.]ppc_32 hxxp://91[.]92[.]240[.]220/hiddenbin/mynode[.]mpsl_32 hxxp://91[.]92[.]240[.]220/hiddenbin/mynode[.]armv4_32 hxxp://103[.]118[.]28[.]144/hidakibest[.]arm7 hxxp://103[.]118[.]28[.]144/hidakibest[.]x86 hxxp://103[.]118[.]28[.]144/hidakibest[.]sparc hxxp://103[.]118[.]28[.]144/hidakibest[.]mips hxxp://103[.]118[.]28[.]144/hidakibest[.]arm4 hxxp://103[.]118[.]28[.]144/hidakibest[.]ppc hxxp://103[.]118[.]28[.]144/hidakibest[.]mpsl hxxp://103[.]118[.]28[.]144/hidakibest[.]arm6 hxxp://103[.]118[.]28[.]144/hidakibest[.]arm5 |
Bashlite |
| URL | hxxp://zidomasones[.]com/w/Video[.]scr hxxp://zidomasones[.]com/w/Photo[.]scr hxxp://zidomasones[.]com/w/AV[.]scr hxxp://zidomasones[.]com/w/IMG001[.]exe |
Coinminer |
| URL | hxxp://1[.]27[.]60[.]139:5000/%E6%96%B0%E5%9B%9B%E7%A5%9EW10%E5%86%92%E9%99%A9%E5%B2%9B/%E5%B7%A5%E5%85%B7/%E5%B1%80%E5%9F%9F%E7%BD%91%E5%A4%8D%E5%88%B6[.]exe | KrBanker |
| URL | hxxp://185[.]208[.]158[.]56/test[.]exe | Quasar RAT |
| URL | hxxp://45[.]61[.]149[.]68:8000/8[.]exe | Cobalt Strike |
