不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2025/10/21
※2025/10/21 更新
マルウェア感染させると考えられるURLを検知（2025/10/21）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://176[.]65[.]148[.]153/co hxxp://176[.]65[.]148[.]153/x86 hxxp://176[.]65[.]148[.]153/arm61 hxxp://176[.]65[.]148[.]153/sh4 hxxp://176[.]65[.]148[.]153/i686 hxxp://176[.]65[.]148[.]153/dss hxxp://176[.]65[.]148[.]153/586 hxxp://176[.]65[.]148[.]153/mipsel hxxp://176[.]65[.]148[.]153/ppc hxxp://176[.]65[.]148[.]153/m68k hxxp://176[.]65[.]148[.]153/mips hxxp://144[.]172[.]109[.]62/Orbt/Orbt[.]mips |
Bashlite |
| URL | hxxp://178[.]16[.]55[.]189/files/7080596861/fmQn2Zm[.]exe | NetSupportManager RAT |
| URL | hxxp://101[.]35[.]95[.]220:18062/Sem8 | Cobalt Strike |
| URL | hxxps://324[.]5m9081[.]ru/nnrwi0cj hxxps://30951[.]bl8205[.]ru/l2[.]google?t=g82ees8o hxxps://8427[.]bl8205[.]ru/9fa[.]check?t=75b24uqj hxxps://clears[.]syc0aq8uy1[.]online/tahpfa188n[.]sh hxxps://clears[.]syc0aq8uy1[.]online/08ag7rpmdq[.]sh hxxps://501[.]bl8205[.]ru/yk[.]google?t=8l8o2d35 hxxps://4084[.]rv6324[.]ru/1kz[.]check?t=gdbalvee hxxps://219[.]rv6324[.]ru/r8[.]google?t=mf6yu1iz hxxps://034d2[.]bl8205[.]ru/2h[.]google?t=ia5nrja3 hxxps://force5[.]syc0aq8uy1[.]online/88gpq7qmvk[.]sh hxxps://force5[.]syc0aq8uy1[.]online/xfxkhbzl6l[.]sh hxxps://118[.]bl8205[.]ru/w1n[.]check?t=5bvbihh3 hxxps://6901420[.]bl8205[.]ru/e4[.]google?t=dwx67ylh hxxps://spark7[.]syc0aq8uy1[.]online/ggcam5y5or[.]sh hxxps://spark7[.]syc0aq8uy1[.]online/436ipyay7s[.]sh hxxps://777012[.]bl8205[.]ru/d7m[.]check?t=rdw5o651 hxxps://wi1low[.]syc0aq8uy1[.]online/0qpymao2hf[.]sh hxxps://began[.]5-forez-515-o[.]ru/a9r3[.]google?t=tf7mcl9i hxxps://851[.]rv6324[.]ru/7m04[.]google?t=5mitcy2b hxxps://061[.]rv6324[.]ru/vb[.]check?t=zpqwes1f hxxps://7436901[.]rv6324[.]ru/9q1[.]google?t=2xw12eph hxxps://160287[.]rv6324[.]ru/tn[.]check?t=o67wewh1 hxxps://93055[.]rv6324[.]ru/0d4[.]google?t=stzgzx1l hxxps://dawn3[.]syc0aq8uy1[.]online/xia0w91goy[.]sh hxxps://actor[.]1-byhih-05-ey[.]ru/by1x[.]check?t=gfdwbquw hxxps://focus[.]7-doxok-46-eu[.]ru/fu[.]google?t=n3arntfa hxxps://shine0[.]syc0aq8uy1[.]online/0hfclnjbq9[.]sh hxxps://begun[.]7-nenop-38-oy[.]ru/gwq3zqxa hxxps://amber3[.]run-c-you[.]online/sinkers hxxps://oxy7[.]joy-2-way[.]online/sinkers hxxps://cross[.]xiqek-40-ye-8[.]ru/fycvdxqb hxxps://coast0[.]5-forez-515-o[.]ru/o57qpl2b hxxps://delay[.]5-ninet-1-ou[.]ru/2n37awqd hxxps://ox[.]fix-fg[.]online/sinkers hxxps://brown6[.]1-mafus-044-e[.]ru/4igkultf hxxps://7m1a[.]4a8u6[.]online/sinkers hxxps://fairy[.]2-pukeg-36-oy[.]ru/xurx9oik hxxps://z9kq[.]4a8u6[.]online/sinkers hxxps://angle[.]hop-g-3[.]online/sinkers hxxps://event53[.]5-juzeb-0-io[.]ru/0c90kdeh hxxps://q2x8[.]4a8u6[.]online/sinkers hxxps://anger[.]2-pukeg-36-oy[.]ru/1bf7powf hxxps://k3v7[.]9e466[.]online/sinkers hxxps://album[.]0-rohyp-5-yu[.]ru/8edie12u hxxps://n4y2[.]4y328[.]online/sinkers hxxps://essay8[.]5-forez-515-o[.]ru/ivbwy7mu hxxps://x7[.]9e466[.]online/sinkers hxxps://a5ide[.]1-mafus-044-e[.]ru/4cmeyomm hxxps://p9t[.]9e466[.]online/sinkers hxxps://enjoy[.]2-wafij-3-ue[.]ru/3a0kvxoz hxxps://tz6[.]4y328[.]online/sinkers hxxps://biame[.]7-doxok-46-eu[.]ru/z5qgb0xk hxxps://b7q[.]4y328[.]online/sinkers hxxps://board73[.]0-we-fid-707-i[.]ru/m6hazq9i hxxps://c3k9[.]4y328[.]online/sinkers hxxps://easy57[.]1-byhih-05-ey[.]ru/e66y2kmf hxxps://jumpy[.]5-forez-515-o[.]ru/hbebixwk hxxps://r8[.]4y328[.]online/sinkers hxxps://m01a[.]4y328[.]online/sinkers hxxps://eager[.]7-nenop-38-oy[.]ru/18uxq3bm |
ClearFake |
| URL | hxxps://wrat[.]in/sa1at/8Qhttps:/wrat[.]in/sa1at/V hxxps://wrat[.]in/login/ |
SalatStealer |
| URL | hxxp://178[.]16[.]55[.]189/files/5418417533/mbA3nKV[.]exe | Rhadamanthys |
| URL | hxxps://katyache[.]com/uploads/xxblessingsnow[.]txt hxxp://178[.]16[.]55[.]189/files/7044575709/VwzWum3[.]exe hxxps://activegroup-bd[.]com/arquivo_20251016085750[.]txt |
XWorm |
| URL | hxxp://178[.]16[.]55[.]189/files/emmaruiz238/random[.]exe | Amadey |
| URL | hxxp://178[.]16[.]55[.]189/files/6260444824/2scQQw9[.]exe | Coinminer |
| URL | hxxp://178[.]16[.]55[.]189/files/6231240258/XnMxR27[.]exe hxxps://www[.]sharmanshawls[.]com/omphaloncus[.]exe hxxps://www[.]sharmanshawls[.]com/17[.]mp4 hxxp://178[.]16[.]55[.]189/files/1918352027/fodM6ct[.]exe hxxp://178[.]16[.]55[.]189/files/8350398681/KB6MHZw[.]exe hxxp://81[.]90[.]31[.]181/Documents/chase_10_15_2025[.]lnk hxxp://178[.]16[.]55[.]189/files/6608710704/VG06hNP[.]exe |
Vidar |
| URL | hxxp://178[.]16[.]55[.]189/files/1781548144/YrsGDtx[.]exe hxxp://178[.]16[.]55[.]189/files/6075866260/mJOBEbi[.]bat |
Quasar RAT |
| URL | hxxps://falsapa[.]qpon/taoz hxxps://thujaii[.]pics/api |
Lumma Stealer |
| URL | hxxp://198[.]46[.]173[.]10/580/dfg90erhj34h0g0dfg0cvcv00340sfsdf84fdcv9bv0cv03dfiu3200fdsf23sdfvb90cvb90030gdfg0cvb09c0b0[.]txt hxxp://198[.]46[.]173[.]10/580/dfg90erhj34h0g0dfg0cvcv00340sfsdf84fdcv9bv0cv03dfiu3200fdsf23sdfvb90cvb90030gdfg0cvb09c0b0[.]hta hxxp://96[.]44[.]159[.]189/333/sdof9do4ier9dfd9g3ggiuidf9fd9gcv934jjghdf93d9cxvxc93jjgjdgf9c99vcb89rrtbc99[.]hta hxxp://23[.]95[.]117[.]243/img/kkn/sd99w090xcvjijsei000sdf09w0ef0cdf3iiuif920fs0f0sdf032fisidufiu0v0x9v090diudfg00909dfg00df[.]hta hxxp://213[.]209[.]157[.]234/host/Fore[.]ps1 |
Remcos |
| URL | hxxp://172[.]245[.]246[.]93/MOJOCUMServer_Encrypted[.]jpg hxxp://213[.]209[.]157[.]234/host/cashhhh[.]ps1 hxxp://213[.]209[.]157[.]234/host/stein[.]ps1 hxxp://213[.]209[.]157[.]234/host/sirdee[.]ps1 hxxp://213[.]209[.]157[.]234/host/slyxx[.]ps1 hxxp://213[.]209[.]157[.]234/host/air[.]ps1 hxxp://tehnomag[.]rs/Wheatw[.]pfm hxxps://tehnomag[.]rs/Wheatw[.]pfm |
Agent Tesla |
| URL | hxxps://api[.]telegram[.]org/bot8085178248:AAGAe7Pwr8VYxNJMlTM_c5GuuVT1qTayc1w/sendMessage?chat_id=1294259049 | Snake Keylogger |
| URL | hxxp://213[.]209[.]157[.]234/host/ttesttt[.]ps1 | RedLine Stealer |
| URL | hxxp://213[.]209[.]157[.]234/host/sea[.]ps1 | Formbook |
| URL | hxxp://2[.]58[.]56[.]58/5617e28fdebc443a[.]php | Stealc |
