不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様19社 -
2025/10/23
※2025/10/23 更新
マルウェア感染させると考えられるURLを検知（2025/10/23）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://tq[.]9b9-7[.]ru/gz0o5ab6 hxxps://q5[.]lb3091[.]online/wg0c1oqdj6[.]js hxxps://z1[.]9b9-7[.]ru/f6qpxxmh hxxps://q5[.]lb3091[.]online/noh8prmn1y[.]js hxxps://g[.]9b9-7[.]ru/ep[.]google?t=o2o0s60z hxxps://g[.]9b9-7[.]ru/gli2gcg4 hxxps://k9r[.]8d9691[.]online/ncdcat1bzl[.]js hxxps://m2[.]3x6-7[.]ru/261q6t97 hxxps://t04m[.]lb3091[.]online/7ljpxk2qhi[.]js hxxps://pl[.]3x6-7[.]ru/zsi8qsor hxxps://b[.]lb3091[.]online/6tdmft4y6g[.]js hxxps://h3[.]3x6-7[.]ru/xp1pbgka hxxps://v9x2[.]lb3091[.]online/dl81uf1rm6[.]js hxxps://x8[.]9b9-7[.]ru/ibh5yi85 hxxps://h1z[.]lb3091[.]online/y0f7crpzg4[.]js hxxps://pv[.]2f8-2[.]ru/vrpv8k96 hxxps://l8k[.]zm6392[.]online/ujhv41jqla[.]js hxxps://zt[.]2f8-2[.]ru/rxk2spj4 hxxps://s3[.]zm6392[.]online/7z1ld72nbx[.]js hxxps://n3[.]2f8-2[.]ru/cxl3378x hxxps://y2[.]lb3091[.]online/nq3or6bldm[.]js hxxps://e[.]2f8-2[.]ru/oxifdj0c hxxps://y2[.]lb3091[.]online/a43eey69n1[.]js hxxps://q7[.]v-bua0[.]ru/3kwbysvt hxxps://d1[.]zm6392[.]online/qut4inwnw6[.]js hxxps://xq[.]2f8-2[.]ru/3x0k468w hxxps://wq0n[.]zm6392[.]online/hfykw0gr8z[.]js hxxps://h7[.]2f8-2[.]ru/jfqg80bo hxxps://wq0n[.]zm6392[.]online/mdmi3gteg9[.]js hxxps://x[.]v-bua0[.]ru/954lq4q2 hxxps://a9[.]zm6392[.]online/zm0whx29oe[.]js hxxps://x[.]v-bua0[.]ru/w2n[.]google?t=oyybrv9x hxxps://z1[.]v-bua0[.]ru/ruggp2bs hxxps://x7p4[.]zm6392[.]online/o4woote4bc[.]js hxxps://a[.]x-ceu8[.]ru/bwbkjpa7 hxxps://r2t[.]bl8205[.]online/benn8c9qh0[.]js hxxps://k0[.]f-xiu4[.]ru/m40qts4a hxxps://c4[.]bl8205[.]online/p7q51u7s9t[.]js hxxps://wz[.]f-xiu4[.]ru/wkcug9d1 hxxps://c4[.]bl8205[.]online/9bn0dfxuc9[.]js hxxps://y[.]bl8205[.]online/m9hetyifpe[.]js hxxps://2wpx[.]28ae00i7[.]ru/32ccqoi98h[.]sh hxxps://r9[.]x-ceu8[.]ru/zm[.]check?t=xa4mcyns hxxps://d3j7[.]28ae00i7[.]ru/slnxp66c58[.]sh hxxps://x2[.]x-ceu8[.]ru/ab3[.]check?t=0o2ybpuj hxxps://m8[.]x-ceu8[.]ru/w95zhu4j hxxps://m5q1[.]bl8205[.]online/wqp9k80z75[.]js hxxps://p0[.]t-pay3[.]ru/2ppifkn7 hxxps://qk8[.]bl8205[.]online/kza7gv4s9l[.]js hxxps://0z[.]t-pay3[.]ru/d7m[.]check?t=deu9js0u hxxps://sr5b[.]28ae00i7[.]ru/51vbtkhon0[.]sh hxxps://sr5b[.]28ae00i7[.]ru/4zm0yyzgma[.]sh hxxps://v3[.]t-pay3[.]ru/l2[.]google?t=1dnatuyg hxxps://r9[.]x-ceu8[.]ru/f3cjzvp2 hxxps://7eud[.]97ie88e7[.]ru/0c24c6d759[.]sh hxxps://x7[.]o-a4eu[.]ru/bv9[.]check?t=w3xeufhy hxxps://7eud[.]97ie88e7[.]ru/z836bacwj0[.]sh hxxps://pt[.]o-a4eu[.]ru/0a1[.]google?t=0d3pub65 hxxps://z1[.]o-a4eu[.]ru/qd7[.]check?t=acrk306s hxxps://lx0c[.]97ie88e7[.]ru/4apbatx7zy[.]sh hxxps://z1[.]o-a4eu[.]ru/yf6vgsc2 hxxps://n0[.]rv6324[.]online/6nfsk2glew[.]js hxxps://lx0c[.]97ie88e7[.]ru/1ggv1oj7gc[.]sh hxxps://z1[.]o-a4eu[.]ru/qd7[.]check?t=0kc4tc6k hxxps://4[.]o-a4eu[.]ru/m5[.]google?t=fq1d6fnq hxxps://f1y6[.]97ie88e7[.]ru/spn0c53qhb[.]sh hxxps://4tqm[.]28ae00i7[.]ru/fugr6y3x5o[.]sh hxxps://1m[.]t-pay3[.]ru/2h[.]google?t=wah1736c hxxps://4tqm[.]28ae00i7[.]ru/dj8ehs8wdv[.]sh hxxps://c8[.]t-pay3[.]ru/w1n[.]check?t=a08ykzvn hxxps://c8[.]t-pay3[.]ru/2frcbnnd hxxps://qk8[.]bl8205[.]online/8oyd79wywz[.]js hxxps://r7[.]y-o7uu[.]ru/wytio0cg hxxps://w[.]rv6324[.]online/a22l3gk4ve hxxps://r7[.]y-o7uu[.]ru/twig205q hxxps://w[.]rv6324[.]online/6vfeg618d8 hxxps://vk[.]y-o7uu[.]ru/b03hgs6u hxxps://deepo[.]res4ev7oy1[.]online/prbg4w4z9b[.]sh hxxps://vk[.]y-o7uu[.]ru/1d2[.]google?t=ltdfjnyh hxxps://p7z1[.]rv6324[.]online/mi8pm9fnmw hxxps://qx2m[.]97ie88e7[.]ru/iemeo490tl[.]sh hxxps://m8[.]y-o7uu[.]ru/0zr[.]check?t=e555pr3t hxxps://s[.]y-o7uu[.]ru/7akyobfy hxxps://s[.]y-o7uu[.]ru/fe[.]google?t=qevsh66o hxxps://qx2m[.]97ie88e7[.]ru/q5wsb9mmzl[.]sh hxxps://g3c[.]rv6324[.]online/xqxgur6b4o hxxps://a5v9[.]97ie88e7[.]ru/73ox10l394[.]sh hxxps://q9[.]o-a4eu[.]ru/yc0[.]google?t=lwb5law8 hxxps://x[.]o-y3ii[.]ru/4kheec7q hxxps://able[.]k4tem[.]ru/s4b896wrkr hxxps://x[.]o-y3ii[.]ru/ab03[.]google?t=yuuax72w hxxps://wi1do[.]res4ev7oy1[.]online/ikrap2nob7[.]sh hxxps://gent1e[.]res4ev7oy1[.]online/z9xu2li4vm[.]sh hxxps://t1[.]o-y3ii[.]ru/rv9[.]check?t=bim9le8k hxxps://zc[.]o-y3ii[.]ru/0q[.]google?t=5ijmbeh4 hxxps://dust5[.]res4ev7oy1[.]online/afaznxm58r[.]sh hxxps://zc[.]o-y3ii[.]ru/3m6exxom hxxps://t2m4[.]rv6324[.]online/5qwnzny8rm hxxps://flow3[.]res4ev7oy1[.]online/c48oi1db9z[.]sh hxxps://n3[.]o-y3ii[.]ru/2m1[.]check?t=mwikdqil hxxps://n3[.]o-y3ii[.]ru/mzlsxzkv hxxps://kx6[.]rv6324[.]online/boz4q8j594 hxxps://cinomp[.]ci6ef[.]ru/sinkers hxxps://q1[.]y-o7uu[.]ru/w3a[.]google?t=skhbrjcy hxxps://mi1d[.]res4ev7oy1[.]online/lv1urcuzmc[.]sh hxxps://m4v[.]99y401874[.]online/it6dqy4pc9[.]sh hxxps://bd[.]i924ao[.]ru/0l4[.]google?t=5jwou24l hxxps://q4[.]i924ao[.]ru/pmtp5b3b hxxps://area[.]k4tem[.]ru/p9t6vzhq0k hxxps://g[.]i924ao[.]ru/bbbsieyi hxxps://also[.]k4tem[.]ru/ox2oy4wc5q hxxps://caim7[.]res4ev7oy1[.]online/zo4rmg4oe8[.]sh hxxps://h7[.]o-y3ii[.]ru/kd[.]check?t=hmjro0ir hxxps://h3[.]i261au[.]ru/9rz[.]check?t=vcqdiyk2 hxxps://z7hd[.]99y401874[.]online/g5de6tzq32[.]sh hxxps://h3[.]i261au[.]ru/91mo1j5p hxxps://back[.]k4tem[.]ru/rvamhh7siw hxxps://s[.]i261au[.]ru/cwvgpmga hxxps://back[.]k4tem[.]ru/50temaupvd hxxps://p1kx[.]99y401874[.]online/8sw5ma90xp[.]sh hxxps://x8[.]i924ao[.]ru/2a09[.]google?t=7aeozzrz hxxps://h9[.]i924ao[.]ru/by26fs8u hxxps://baby[.]k4tem[.]ru/v1ta29fo0x hxxps://h9[.]i924ao[.]ru/7vb[.]check?t=ysw4o6jt hxxps://tq[.]i924ao[.]ru/m0q[.]google?t=bojkx0vz hxxps://j8r2[.]99y401874[.]online/xvk0dzgl31[.]sh hxxps://z1[.]i924ao[.]ru/7w1scqb4 hxxps://away[.]k4tem[.]ru/hfpycteu0t hxxps://z1[.]i924ao[.]ru/ks[.]check?t=49jzr7ap hxxps://j8r2[.]99y401874[.]online/9qaut2z0gf[.]sh hxxps://z1[.]i924ao[.]ru/gi0w9q9z hxxps://pl[.]i261au[.]ru/8vikqb6i hxxps://ball[.]k4tem[.]ru/jnnl00syer hxxps://z7hd[.]99y401874[.]online/pflszhtahz[.]sh hxxps://pl[.]i261au[.]ru/0a7[.]google?t=34ohbrug hxxps://x[.]i261au[.]ru/tm2[.]check?t=pi3cekon hxxps://z7hd[.]99y401874[.]online/rgsmnml0kv[.]sh hxxps://x[.]i261au[.]ru/vsclhuad hxxps://ball[.]k4tem[.]ru/rki6bzrwd3 hxxps://qb[.]i261au[.]ru/1n7[.]check?t=nalxs9lj hxxps://t0uq[.]99y401874[.]online/afhw0vzsxa[.]sh hxxps://m2[.]i261au[.]ru/4q[.]google?t=isv0kqfx hxxps://z7hd[.]99y401874[.]online/bl8gtmv9gg[.]sh hxxps://m2[.]i261au[.]ru/d0dtqx7t hxxps://ball[.]k4tem[.]ru/jk7xub4d5z hxxps://r2qm[.]08u073852[.]online/v0dr6v5fhx[.]sh hxxps://a1[.]y742au[.]ru/m4d[.]check?t=z9sidwbw hxxps://n3yl[.]08u073852[.]online/wkaa6agcfq[.]sh hxxps://e[.]y742au[.]ru/fek74pcs hxxps://n3[.]y742au[.]ru/q7p[.]check?t=fpreg2l2 hxxps://j2[.]sne-4-p[.]ru/73rfqehbis hxxps://c9w5[.]08u073852[.]online/gv8aado156[.]sh hxxps://z9[.]i261au[.]ru/ya03[.]google?t=ilr8yva5 hxxps://b6tj[.]11u812580[.]online/rvo6k1urqm[.]sh hxxps://bd[.]yxb-au[.]ru/m3[.]google?t=vdvfqdnt hxxps://b6tj[.]11u812580[.]online/h6krnfugxm[.]sh hxxps://q7[.]yxb-au[.]ru/4ta[.]check?t=cs1ackwp hxxps://g[.]yxb-au[.]ru/qa27lp1u hxxps://x0v4[.]sne-4-p[.]ru/jjj2wpoaim hxxps://g[.]yxb-au[.]ru/yn[.]google?t=que64k77 hxxps://v4sz[.]08u073852[.]online/pcxvfxhedv[.]sh hxxps://v4sz[.]08u073852[.]online/g0wh91ezz4[.]sh hxxps://xq[.]y742au[.]ru/w1m3[.]google?t=dlrj7pmm hxxps://g8k1[.]08u073852[.]online/8g1en5dfjg[.]sh hxxps://h7[.]y742au[.]ru/t39[.]check?t=cbfm84x2 hxxps://g8k1[.]08u073852[.]online/3qrmo6hu7t[.]sh hxxps://pv[.]y742au[.]ru/0xq[.]google?t=rreeztgz hxxps://b[.]owp-oo[.]ru/w83xjmff hxxps://u9q[.]sne-4-p[.]ru/h47vdqqgdi[.]pyd hxxps://b[.]owp-oo[.]ru/q6[.]google?t=p4jb4gdm hxxps://h9wl[.]11u812580[.]online/cc1wn2d4qx[.]sh hxxps://x[.]yxb-au[.]ru/w2n[.]google?t=0ktcxnkf hxxps://q5ya[.]11u812580[.]online/rtu8maq20s[.]sh hxxps://h9[.]yxb-au[.]ru/ra0[.]check?t=nkm1eteh hxxps://q5ya[.]11u812580[.]online/135hl830ag[.]sh hxxps://h9[.]yxb-au[.]ru/ycnkiy7x hxxps://bw6[.]sne-4-p[.]ru/3uesu05fdo hxxps://tq[.]yxb-au[.]ru/48fpah3o hxxps://tq[.]yxb-au[.]ru/0v9[.]google?t=pq0od8e2 hxxps://x0dn[.]11u812580[.]online/38q1ow3e0s[.]sh hxxps://t5[.]sne-4-p[.]ru/yc4xekbpck hxxps://z1[.]yxb-au[.]ru/pk2[.]check?t=bt3unu2p hxxps://x0dn[.]11u812580[.]online/4b8hy8a6ip[.]sh hxxps://a[.]ahz-ya[.]ru/15381e1r hxxps://m5x[.]uht-3-o[.]ru/nh5wh9xhcu hxxps://y4np[.]60e533569[.]online/m6mbhozp6l[.]sh hxxps://a[.]ahz-ya[.]ru/7t[.]google?t=06f853ko hxxps://k0[.]owp-oo[.]ru/pq14[.]google?t=atg3l0vc hxxps://y4np[.]60e533569[.]online/p1njdcb2mv[.]sh hxxps://wz[.]owp-oo[.]ru/3r[.]check?t=sdpz1ofd hxxps://s1vr[.]60e533569[.]online/qteouqe9uf[.]sh hxxps://h2[.]owp-oo[.]ru/ryx0nv1x hxxps://r2[.]uht-3-o[.]ru/lg83hyftzh hxxps://s1vr[.]60e533569[.]online/1yt50l0huo[.]sh hxxps://h2[.]owp-oo[.]ru/zz7[.]google?t=7zybazc1 hxxps://k7fx[.]60e533569[.]online/fvdxjrt58a[.]sh hxxps://q[.]owp-oo[.]ru/5c8devow hxxps://q[.]owp-oo[.]ru/1za[.]check?t=ulhcy8cu hxxps://k4w3[.]uht-3-o[.]ru/3f3t8dgw6p hxxps://xt[.]owp-oo[.]ru/j52cg7sv hxxps://y8n[.]uht-3-o[.]ru/udlg7m5rct hxxps://xt[.]owp-oo[.]ru/v8[.]google?t=aqsnmix2 hxxps://e3pz[.]11u812580[.]online/a2vsq3utly[.]sh hxxps://t1[.]ahz-ya[.]ru/x1taqwvv hxxps://f6[.]jg-7-ra[.]ru/yq1s5plfie hxxps://bq[.]ahz-ya[.]ru/w769g2vm hxxps://q0h[.]uht-3-o[.]ru/2k7nnpbo1r hxxps://x2[.]ahz-ya[.]ru/ab3[.]check?t=14lrviw3 hxxps://w6qc[.]60e533569[.]online/qlv23q5e54[.]sh hxxps://x2[.]ahz-ya[.]ru/z3eweqc4 hxxps://q0h[.]uht-3-o[.]ru/e9zlp11swz hxxps://d0mu[.]60e533569[.]online/032xex8881[.]sh hxxps://pc[.]ahz-ya[.]ru/0w4n[.]google?t=bvdcxd93 hxxps://d0mu[.]60e533569[.]online/8jwb0mydm1[.]sh hxxps://m8[.]ahz-ya[.]ru/q3k[.]check?t=yifcf2lf hxxps://m8[.]ahz-ya[.]ru/iv98fwwd hxxps://m5x[.]uht-3-o[.]ru/00pnc0xpod hxxps://c8[.]imm-yi[.]ru/hf70rru8 hxxps://z7t2[.]jg-7-ra[.]ru/kr0faknzd9 hxxps://c8[.]imm-yi[.]ru/w1n[.]check?t=aziqiy2j hxxps://m3zy[.]54o477354[.]online/v7f34p62xo[.]sh hxxps://p0[.]imm-yi[.]ru/2vzbjq65 hxxps://p1a[.]jg-7-ra[.]ru/lqftksbzky hxxps://a9wt[.]54o477354[.]online/tdfvgq3m47[.]sh hxxps://p0[.]imm-yi[.]ru/e4[.]google?t=whmsh7tt hxxps://h1[.]imm-yi[.]ru/9fa[.]check?t=36do89du hxxps://u2kh[.]54o477354[.]online/uzleyisnqa[.]sh hxxps://y2sk[.]30u241207[.]online/7is0rpcp6g[.]sh hxxps://b2z7r5k[.]ru/3he[.]google?t=6qljd3tz hxxps://t4c6yx8[.]ru/eru[.]google?t=8017hu6v hxxps://l8rd[.]30u241207[.]online/4ouvuz9ogb[.]sh hxxps://t4c6yx8[.]ru/25aa11z9 hxxps://hn3[.]jg-7-ra[.]ru/rlcme4cx3f hxxps://qw59f3d[.]ru/4lvnwt45 hxxps://hn3[.]jg-7-ra[.]ru/cn9ila7olw hxxps://qw59f3d[.]ru/1l[.]check?t=okcnypg4 hxxps://z1pc[.]30u241207[.]online/d1oxag9p63[.]sh hxxps://l2b9nzt[.]ru/txc7e71h hxxps://c9[.]jg-7-ra[.]ru/h747ht456e hxxps://f0rq[.]54o477354[.]online/7b7hjfueh1[.]sh hxxps://l2b9nzt[.]ru/ud[.]check?t=pjkc9lbz hxxps://x9k4f2q[.]ru/q8x[.]check?t=pf290rff hxxps://t6bn[.]54o477354[.]online/1wu7cyuj2j[.]sh hxxps://t6bn[.]54o477354[.]online/ukzq6tz7b4[.]sh hxxps://1m[.]imm-yi[.]ru/2h[.]google?t=b7tjraif |
ClearFake |
| URL | hxxps://213[.]209[.]157[.]234/host/ttesttt[.]ps1 | RedLine Stealer |
| URL | hxxps://globaltechbilling[.]com/cmsjj hxxps://charityjs[.]com/xss/index[.]php hxxps://charityjs[.]com/xss/bof[.]js hxxps://charityjs[.]com/xss/buf[.]js hxxps://xeljson[.]com/xss/buf[.]js hxxps://xeljson[.]com/xss/index[.]php hxxps://xeljson[.]com/xss/bof[.]js hxxps://powerbrokermagazine[.]com/soncu hxxps://stgeorgelight[.]org/jsoming[.]zip |
NetSupportManager RAT |
| URL | hxxps://70[.]36[.]99[.]253:15888/gateway/pdxuoitj[.]e3nx5 hxxp://176[.]46[.]152[.]21/xiobv[.]exe hxxp://178[.]16[.]55[.]189/files/7906804494/JgmnuwO[.]exe |
Rhadamanthys |
| URL | hxxps://178[.]16[.]54[.]200/f8nus4b/Login[.]php | Amadey |
| URL | hxxps://178[.]16[.]54[.]37/fire/wormb[.]txt | XWorm |
| URL | hxxps://api[.]telegram[.]org/bot7935758674:AAH95_d7w0xIF5M0RFiO5fSag9ljKrN-Guk/sendMessage?chat_id=7254005295 | MASS Logger |
| URL | hxxp://178[.]16[.]55[.]189/files/5917492177/u5T0tvf[.]exe hxxp://176[.]46[.]152[.]21/Stealc[.]exe hxxp://193[.]151[.]108[.]232/f23206eafc7f4b9f[.]php |
Stealc |
| URL | hxxp://103[.]96[.]75[.]2:17705/64[.]exe hxxp://47[.]110[.]67[.]64/02[.]08[.]2022[.]exe hxxp://42[.]51[.]34[.]56:8021/02[.]08[.]2022[.]exe hxxp://139[.]155[.]143[.]78/02[.]08[.]2022[.]exe hxxp://101[.]132[.]148[.]165:8085/02[.]08[.]2022[.]exe hxxp://45[.]118[.]144[.]151:8888/02[.]08[.]2022[.]exe hxxp://222[.]255[.]214[.]236/02[.]08[.]2022[.]exe hxxp://159[.]223[.]66[.]231/02[.]08[.]2022[.]exe hxxp://43[.]142[.]91[.]82:443/02[.]08[.]2022[.]exe hxxp://123[.]60[.]52[.]128:14444/02[.]08[.]2022[.]exe hxxp://198[.]55[.]109[.]241/02[.]08[.]2022[.]exe hxxp://106[.]14[.]0[.]238/02[.]08[.]2022[.]exe hxxp://119[.]94[.]50[.]160:5555/02[.]08[.]2022[.]exe hxxp://83[.]229[.]125[.]175/02[.]08[.]2022[.]exe hxxp://107[.]172[.]44[.]183:49011/02[.]08[.]2022[.]exe hxxp://185[.]195[.]65[.]55:53/02[.]08[.]2022[.]exe hxxp://143[.]198[.]82[.]16/02[.]08[.]2022[.]exe hxxp://47[.]120[.]70[.]161:6666/02[.]08[.]2022[.]exe hxxp://81[.]70[.]97[.]41:8089/02[.]08[.]2022[.]exe hxxp://45[.]58[.]56[.]34:8880/02[.]08[.]2022[.]exe hxxp://176[.]233[.]252[.]31:443/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://196[.]251[.]81[.]216:8080/Pulsar-Client[.]exe hxxps://mzgscripts[.]xyz/uploads/svchost[.]exe hxxps://188[.]132[.]197[.]88/Client-built[.]exe |
Quasar RAT |
| URL | hxxps://api[.]telegram[.]org/bot8414232995:AAHYV-2SaCdIFmDVQ5gA_fCb2MZ0gj-3RM8/sendMessage?chat_id=7282830258 | Snake Keylogger |
| URL | hxxps://clientes[.]3wpublicidade[.]com[.]br/casadorefratario/wp-content/plugins/wp-operating-programs/index[.]php?r=bD1odHRwczovL2ZyZWVtb3ZpZS10dndhbGxwYXBlci5jb20vP2NpZD1OekkyTmpNeCZlbT1hVzVtYjBCcmJHOXZjeTFrWlhOcFoyNHVaR1U9 hxxps://slequip[.]com/?cid=NzI2NjMx&em=d2llYmtlLnBhc2xpZ2hAbmFidS1ybHAuZGU= |
Latrodectus |
| URL | hxxp://47[.]108[.]28[.]35:8000/360_install[.]exe | MimiKatz |
| URL | hxxp://110[.]42[.]12[.]18:1999/%E8%A1%A5%E4%B8%81/client/ijl11[.]dll hxxp://123[.]99[.]197[.]140:88/A001/items[.]dll hxxp://110[.]42[.]52[.]4:98/8090/139Assicc[.]dll hxxp://110[.]42[.]52[.]4:98/8090/mytexdl[.]dll hxxp://192[.]140[.]182[.]25:99/898xylbd/139Assicc[.]dll |
KrBanker |
| URL | hxxp://178[.]16[.]55[.]189/files/6382108206/CWoABca[.]exe hxxp://178[.]16[.]55[.]189/files/6382108206/zV8CDrW[.]exe hxxps://218[.]212[.]2[.]95:8443/sda1/Photo[.]scr hxxps://218[.]212[.]2[.]95:8443/sda1/UPG/Video[.]scr hxxps://218[.]212[.]2[.]95:8443/sda1/AV[.]scr hxxps://218[.]212[.]2[.]95:8443/sda1/UPG/AV[.]scr hxxps://218[.]212[.]2[.]95:8443/sda1/Video[.]scr hxxps://218[.]212[.]2[.]95:8443/sda1/UPG/Photo[.]scr hxxp://116[.]87[.]55[.]210:8082/sda1/Photo[.]scr hxxp://116[.]87[.]55[.]210:8082/sda1/AV[.]scr hxxp://116[.]87[.]55[.]210:8082/sda1/Video[.]scr hxxp://116[.]87[.]55[.]210:8082/sda1/Android/AV[.]scr hxxp://116[.]87[.]55[.]210:8082/sda1/Android/Video[.]scr hxxp://116[.]87[.]55[.]210:8082/sda1/Android/Photo[.]scr |
Coinminer |
| URL | hxxps://aff1xslavka[.]com/chromatophilic[.]exe | Vidar |
| URL | hxxps://216[.]9[.]227[.]119/251/wec34gb433/ssdf0wejir23090dfg909cvbbre00dfg00g009d0fg0cvkbj009g004300dfg4309dg0f90[.]doc hxxp://213[.]209[.]157[.]234/host/kent[.]ps1 |
Remcos |
| URL | hxxp://178[.]16[.]55[.]189/files/7044575709/Lgnmy9j[.]exe | NjRAT |
| URL | hxxp://213[.]209[.]157[.]234/host/sird[.]ps1 hxxp://213[.]209[.]157[.]234/host/sea2sea[.]ps1 hxxp://213[.]209[.]157[.]234/host/slynewbin[.]ps1 |
Formbook |
| URL | hxxps://api[.]telegram[.]org/bot8402070841:AAHRL8Fa0gXoFLnkAww-SeReimKPZxKH9Xo/ | Agent Tesla |
| URL | hxxps://api[.]telegram[.]org/bot7940826173:AAHgqrax86PPaA3irItaOddTNqmuX6y0Tqw/sendMessage hxxp://178[.]16[.]55[.]189/files/7830357049/LGlUOhl[.]exe |
AsyncRAT |
| URL | hxxps://git[.]zionministry[.]org/ob7/SdqcnCDFnMV7lonTa9OcxWvEyo8u2c2XL8bQkTPW0Isw0tjdNA== | GootLoader |
| URL | hxxps://micsservice[.]xyz/payloads/update[.]exe hxxps://spizdili[.]com/payload/update[.]exe |
Metasploit |
| URL | hxxp://178[.]16[.]55[.]189/files/7582992464/hkcOI9W[.]exe | Venom RAT |
| URL | hxxp://178[.]16[.]55[.]189/beki/zero[.]exe | DarkVision RAT |
| URL | hxxp://178[.]16[.]55[.]189/files/7782139129/GL0ygTD[.]exe hxxps://star[.]mulberriespussies[.]com/city/in[.]exe |
Socks5 Systemz |
| URL | hxxps://cypridy[.]asia/api | Lumma Stealer |
| URL | hxxp://126821cm[.]nyash[.]es/VideotopythonpacketlongpolllinuxFlowerGeneratorwp[.]php | DCRat |
| URL | hxxp://158[.]69[.]214[.]127:8080/Boca%20Socios[.]apk hxxp://158[.]69[.]214[.]127:8080/Boca%20Socios_Dropper[.]apk hxxp://158[.]69[.]214[.]127:8080/Boca%20Socios_Dropper_Signed[.]apk |
SpyNote |
