不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様3社 -
2025/10/29
※2025/10/29 更新
マルウェア感染させると考えられるURLを検知（2025/10/29）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://ox[.]g-vox[.]ru/8xf[.]google?t=xs1mu3fl hxxps://k0hs[.]9-32p[.]ru/no44b6jlji[.]sh hxxps://u0b[.]0bj3i[.]ru/32lsmuw2v6[.]map hxxps://my[.]xe-1r[.]ru/5tvag83m hxxps://my[.]xe-1r[.]ru/dje[.]google?t=2hsrtiux hxxps://k0hs[.]9-32p[.]ru/rcz7cbx51v[.]sh hxxps://3dpf[.]9-32p[.]ru/rjjtw6lumk[.]sh hxxps://my[.]p2-om[.]ru/0va[.]check?t=g7zq3dvb hxxps://m7[.]0bj3i[.]ru/ehyj6a9b1a[.]map hxxps://ego[.]p2om[.]ru/aymby8gy hxxps://n6vt[.]9-32p[.]ru/7xen7zgnr3[.]sh hxxps://ego[.]p2om[.]ru/tf[.]google?t=c24o6sue hxxps://n6vt[.]9-32p[.]ru/npxahjbk4w[.]sh hxxps://flx[.]la9q[.]ru/m8j[.]google?t=1u89psqv hxxps://at[.]s4-ti[.]ru/5j1iflau hxxps://k9r2[.]0bj3i[.]ru/oz9bt9dlhc[.]map hxxps://k0hs[.]9-32p[.]ru/ogki8kxu1n[.]sh hxxps://at[.]s4-ti[.]ru/759[.]check?t=8kslvrde hxxps://q3[.]4md69[.]ru/a1e0v6eapx[.]map hxxps://an[.]bo-x2[.]ru/j9e4vo6y hxxps://t2xb[.]7-09f[.]ru/nxof46ypoo[.]sh hxxps://an[.]bo-x2[.]ru/xeb[.]check?t=q2angubh hxxps://uh[.]yq-4n[.]ru/az1t2afp hxxps://t2xb[.]7-09f[.]ru/9gd1zrf1lu[.]sh hxxps://go[.]r0-mx[.]ru/gv[.]google?t=l4wywca0 hxxps://bi[.]hu-7e[.]ru/x44[.]google?t=5tsdyldz hxxps://y9lg[.]9-32p[.]ru/ejehmqk0dh[.]sh hxxps://g1rq[.]7-09f[.]ru/52v3mjywym[.]sh hxxps://do[.]z3-lu[.]ru/xx[.]check?t=cdhzj45b hxxps://a[.]4md69[.]ru/uq7sa5kuui[.]map hxxps://it[.]n2-ke[.]ru/cw7fieod hxxps://it[.]n2-ke[.]ru/9tq[.]google?t=3nf4p4ri hxxps://z8wm[.]7-09f[.]ru/mlasdqv3sw[.]sh hxxps://rot[.]la9q[.]ru/3o[.]check?t=tw20yo7b hxxps://ion[.]v3sa[.]ru/2m5[.]google?t=8cybphfa hxxps://z9k1[.]4md69[.]ru/3uuvdhxi90[.]map hxxps://ion[.]v3sa[.]ru/gv4olquq hxxps://z9k1[.]4md69[.]ru/nxv943nrw9[.]map hxxps://yaw[.]tov4[.]ru/hw48cwk0 hxxps://hit[.]mi4x[.]ru/qj[.]google?t=phj4zy1w hxxps://hit[.]mi4x[.]ru/y52qf5z7 hxxps://if[.]tov-4[.]ru/quu[.]google?t=9ggyy45m hxxps://m7p[.]4md69[.]ru/korrv9bmr8[.]map hxxps://if[.]tov-4[.]ru/htxe0aev hxxps://as[.]g-vox[.]ru/orq[.]google?t=p4wuwo27 hxxps://as[.]g-vox[.]ru/2ouec0co hxxps://t04[.]4md69[.]ru/wkmcsnjeup[.]map hxxps://is[.]xe-1r[.]ru/xt[.]google?t=7s564f8o hxxps://h2v[.]4md69[.]ru/cbnptwmm4h[.]map hxxps://is[.]xe-1r[.]ru/17zdc9xx hxxps://h2v[.]4md69[.]ru/9n7a6qhfyc[.]map hxxps://of[.]p2-om[.]ru/twtqsqk9 hxxps://of[.]p2-om[.]ru/9y[.]google?t=zmjfd3bm hxxps://f1le[.]da5v[.]online/sje7b19eqw[.]sh hxxps://ye[.]fy-7a[.]ru/8v[.]google?t=r3yk3dnq hxxps://v1[.]6cm81[.]ru/e5x5z9qovb[.]map hxxps://ye[.]fy-7a[.]ru/9qeftwqc hxxps://f1le[.]da5v[.]online/anazwyejyt[.]sh hxxps://nu[.]n2-ke[.]ru/2e[.]check?t=zupfo97v hxxps://v1[.]6cm81[.]ru/ui8o92221z[.]map hxxps://nu[.]n2-ke[.]ru/fnuuhd79 hxxps://f15h[.]da5v[.]online/omi0lm0684[.]sh hxxps://nu[.]ra-9x[.]ru/0r[.]google?t=x1niqsdc hxxps://f15h[.]da5v[.]online/b821bej3te[.]sh hxxps://no[.]r0-mx[.]ru/ru[.]check?t=mqmr54t2 hxxps://ha[.]hu-7e[.]ru/w5r[.]check?t=48aworuc hxxps://xq8[.]6cm81[.]ru/vm5twj8k3v[.]map hxxps://flat[.]da5v[.]online/lqrdzzl6ab[.]sh hxxps://kld[.]tov4[.]ru/0ays6y0p hxxps://kld[.]tov4[.]ru/d8w[.]google?t=0pnpya2s hxxps://flat[.]da5v[.]online/4w1dcv3kz7[.]sh hxxps://xl[.]tov-4[.]ru/fcp[.]google?t=77ikmnni hxxps://am[.]q-len[.]ru/po[.]check?t=ch1f4ipx hxxps://f1rm[.]da5v[.]online/t2avf9v6r6[.]sh hxxps://ex[.]j5-ol[.]ru/h8[.]check?t=9gm04aga hxxps://f1rm[.]da5v[.]online/xyh88pmy08[.]sh hxxps://la[.]xe-1r[.]ru/mye8rjbn hxxps://flip[.]da5v[.]online/zkzqk1r3z3[.]sh hxxps://la[.]xe-1r[.]ru/gn[.]google?t=og56vzh7 hxxps://flip[.]da5v[.]online/isgh8w6f0l[.]sh hxxps://ya[.]p2-om[.]ru/1g[.]google?t=ler5ui1v hxxps://b0t[.]6cm81[.]ru/vbmyp61izk[.]map hxxps://act[.]la9q[.]ru/i2p6jkjj hxxps://1n[.]z3-lu[.]ru/c1[.]check?t=f0h8gqxd hxxps://gear[.]k8li[.]online/6zhpxtb2dy[.]sh hxxps://1n[.]z3-lu[.]ru/mlx2rq0j hxxps://d5[.]6cm81[.]ru/f7oodt6kcq[.]map hxxps://gear[.]k8li[.]online/asium307cm[.]sh hxxps://do[.]r0-mx[.]ru/wqy[.]google?t=h6l6kbm4 hxxps://d5[.]6cm81[.]ru/uby0og185g[.]map hxxps://do[.]r0-mx[.]ru/693uhhre hxxps://w7k2[.]6cm81[.]ru/s25bcsbnag[.]map hxxps://by[.]hu-7e[.]ru/3cxiso9r hxxps://fawn[.]k8li[.]online/lzst1ulfnd[.]sh hxxps://by[.]hu-7e[.]ru/iy[.]google?t=9jmug1nm hxxps://w7k2[.]6cm81[.]ru/eiarexm5ii[.]map hxxps://1f[.]g-vox[.]ru/flpeaxnw hxxps://1f[.]g-vox[.]ru/n7[.]check?t=wlgz85qc hxxps://foam[.]da5v[.]online/cbeef1xvk0[.]sh hxxps://golf[.]k8li[.]online/4ajmkbsp2e[.]sh hxxps://ha[.]q-len[.]ru/50h[.]check?t=ukw2vfq7 hxxps://of[.]j5-ol[.]ru/ker[.]google?t=l22ff06c hxxps://goat[.]k8li[.]online/0ni6fgyxup[.]sh hxxps://n4[.]8ds98[.]ru/cnxv5dtesk[.]map hxxps://bi[.]fy-7a[.]ru/x829qyu8 hxxps://bi[.]fy-7a[.]ru/uh[.]google?t=67einoy6 hxxps://goat[.]k8li[.]online/dpenib3sng[.]sh hxxps://ho[.]n2-ke[.]ru/qim[.]google?t=nqxsuo9f hxxps://girl[.]k8li[.]online/9dv3xrpx6u[.]sh hxxps://at[.]ra-9x[.]ru/qh[.]check?t=1oq7057i hxxps://girl[.]k8li[.]online/8zthojt7ae[.]sh hxxps://key[.]la9q[.]ru/9e[.]google?t=i9n3xfzi hxxps://brim[.]n4ym[.]online/908yf2z7nq[.]sh hxxps://g7m[.]8ds98[.]ru/0ij2bul7f1[.]map hxxps://orb[.]z3lu[.]ru/2yj96uxk hxxps://g7m[.]8ds98[.]ru/ad91flg53d[.]map hxxps://beg[.]tov4[.]ru/sjqz2onc hxxps://beg[.]tov4[.]ru/p0[.]google?t=pz5j5djm hxxps://dew[.]mi4x[.]ru/8d[.]check?t=igon0orc hxxps://glow[.]k8li[.]online/nb223ghfr0[.]sh hxxps://go[.]tov-4[.]ru/vmc[.]google?t=lbm0gd6l hxxps://golf[.]k8li[.]online/flohsww4jh[.]sh hxxps://h2c[.]8ds98[.]ru/7x1ny9ltud[.]map hxxps://we[.]g-vox[.]ru/d9f3atto hxxps://we[.]g-vox[.]ru/j2[.]google?t=tx0sbsvq hxxps://cove[.]n4ym[.]online/aingpwgc1k[.]sh hxxps://cove[.]n4ym[.]online/ul3cwpd33m[.]sh hxxps://um[.]xe-1r[.]ru/1ht[.]google?t=iofxkp5v hxxps://y0q9[.]8ds98[.]ru/eplbvnvafn[.]map hxxps://it[.]p2-om[.]ru/z1tjloip hxxps://brim[.]n4ym[.]online/6kxg9k7fgv[.]sh hxxps://it[.]p2-om[.]ru/gvw[.]google?t=qrur5323 hxxps://5age[.]pi6o[.]online/379c5i28dn[.]sh hxxps://at[.]fy-7a[.]ru/4m[.]google?t=lrs455zq hxxps://wave[.]m-4-rj[.]ru/anlxgwqetg[.]map hxxps://at[.]fy-7a[.]ru/rs0v1ogy hxxps://1ris[.]pi6o[.]online/6u3hbyzgr9[.]sh hxxps://hi[.]n2-ke[.]ru/odp[.]google?t=omavdcfo hxxps://1ris[.]pi6o[.]online/68ma18fs8d[.]sh hxxps://to[.]ra-9x[.]ru/q8c[.]google?t=ddocfqf7 hxxps://ho[.]z3-lu[.]ru/3i[.]check?t=163ellh4 hxxps://plum[.]n4ym[.]online/n5q2yvssif[.]sh hxxps://ma[.]r0-mx[.]ru/yfp[.]google?t=i4nv8thc hxxps://gale[.]n4ym[.]online/f5a4lnsn8v[.]sh hxxps://gale[.]n4ym[.]online/uphtjf3rj9[.]sh hxxps://ta[.]hu-7e[.]ru/0p[.]check?t=4c5k8mvn hxxps://coal[.]m-4-rj[.]ru/fdhcnh39jz[.]map hxxps://ra[.]je5w[.]com/b3w9fg6u hxxps://ra[.]je5w[.]com/98w[.]check?t=xj3zis69 hxxps://dewy[.]tu7q[.]online/g8yandg1m0[.]sh hxxps://bi[.]tov-4[.]ru/bnk[.]check?t=toril6bu hxxps://dewy[.]tu7q[.]online/0m6nvxypj6[.]sh hxxps://glow[.]m-4-rj[.]ru/9ob0zpcfs5[.]map hxxps://ma[.]q-len[.]ru/b08r4l8j hxxps://ma[.]q-len[.]ru/se[.]check?t=9x806rp0 hxxps://dawn[.]tu7q[.]online/qhw0mzejvi[.]sh hxxps://glow[.]m-4-rj[.]ru/v7zoeabisp[.]map hxxps://oh[.]j5-ol[.]ru/o2xxlt2g hxxps://oh[.]j5-ol[.]ru/et[.]check?t=9l62gaj7 hxxps://dawn[.]tu7q[.]online/rad64rdhwt[.]sh hxxps://hark[.]tu7q[.]online/6r5k31wzq8[.]sh hxxps://at[.]je5w[.]com/77w[.]check?t=9drtb95b hxxps://east[.]tu7q[.]online/j0zpukacx1[.]sh hxxps://cow[.]r7va[.]com/hvs[.]google?t=a62ck0fs hxxps://ace[.]je5w[.]com/sh0aumjn hxxps://m0s5[.]m-4-rj[.]ru/0e4qjlv0wy[.]map hxxps://m0s5[.]m-4-rj[.]ru/npn82tbdc4[.]map hxxps://kit[.]r7va[.]com/opd0gsin hxxps://dune[.]tu7q[.]online/4cini4zmvx[.]2sh hxxps://kit[.]r7va[.]com/j41[.]google?t=wfrh66yp hxxps://m0s5[.]m-4-rj[.]ru/px5659ji56[.]map hxxps://kit[.]r7va[.]com/iw6pkln0 hxxps://dock[.]tu7q[.]online/geu2u6gyvp[.]2sh hxxps://f0r[.]je5w[.]com/umg[.]check?t=hiw3xgps hxxps://dock[.]tu7q[.]online/kl0xcmpmkd[.]2sh hxxps://l10n[.]m-4-rj[.]ru/p0yh7z9ha4[.]map hxxps://b1n[.]r7va[.]com/2a[.]google?t=iuhi71si hxxps://f0r[.]je5w[.]com/6ujkgvqe hxxps://s0il[.]s-2-ly[.]ru/k6e61x48tu[.]map hxxps://d1m[.]r7va[.]com/yug7ixg7 hxxps://dove[.]s-2-ly[.]ru/5ffs122kqv[.]map hxxps://ki[.]r7va[.]com/w3ubx7xt hxxps://twig[.]s-2-ly[.]ru/l33adrl07n[.]map hxxps://cow[.]je5w[.]com/wtbr41fr hxxps://piy[.]r7va[.]com/o1[.]google?t=uezkz5ic hxxps://veil[.]m-4-rj[.]ru/az9nbc3wi1[.]map hxxps://piy[.]r7va[.]com/dphks1tt hxxps://etch[.]s-2-ly[.]ru/l369688lbd[.]map hxxps://bu5[.]je5w[.]com/to59h3kk hxxps://z1mv[.]1p-8s[.]ru/sjijvb77o8[.]sh hxxps://bu5[.]je5w[.]com/ws[.]check?t=6wlzf1od hxxps://reed[.]s-2-ly[.]ru/w3rw8nlp72[.]map hxxps://bay[.]r7va[.]com/oo51n1kx hxxps://q5tn[.]1p-8s[.]ru/f9nauh56uw[.]sh hxxps://pan[.]je5w[.]com/y8w[.]check?t=2xnlinkf hxxps://a8lx[.]1p-8s[.]ru/b0xtwmu4q4[.]sh hxxps://ham[.]r9xa[.]ru/jpk[.]google?t=l1em4i3a hxxps://opal[.]do-k-3[.]ru/xm1qjb1h9r[.]map hxxps://ham[.]r9xa[.]ru/r4hs9s45 hxxps://u3kd[.]1p-8s[.]ru/flyqoiil0i[.]sh hxxps://rye[.]m4ze[.]ru/mz[.]google?t=e1bl3d3l hxxps://c7wp[.]1p-8s[.]ru/vgmsb5wp60[.]sh hxxps://bow[.]k8li[.]ru/xs[.]google?t=bo5i5p8p hxxps://day[.]vo3n[.]ru/om3[.]check?t=0im5gkhx hxxps://h9r[.]1p-8s[.]ru/z15sgj0igy[.]sh hxxps://mend[.]s-2-ly[.]ru/vgky7jua26[.]map hxxps://up[.]je5w[.]com/i4kky4f7 hxxps://sage[.]do-k-3[.]ru/dfh22r0pfo[.]map hxxps://pit[.]n4ym[.]ru/i8ah9qsl hxxps://sage[.]do-k-3[.]ru/fe2y5opc8q[.]map hxxps://fin[.]je9r[.]ru/tlyzasgv hxxps://fin[.]je9r[.]ru/ea3[.]google?t=iphc21rc hxxps://v9tc[.]7l-0b[.]ru/ababqmij33[.]2sh hxxps://rum[.]da5v[.]ru/ya[.]google?t=uxwxu35n hxxps://m4qy[.]7l-0b[.]ru/yvxejqgfdv[.]2sh hxxps://onyx[.]do-k-3[.]ru/xvglgak70p[.]map hxxps://hot[.]x2lu[.]ru/8o5rvj9h hxxps://onyx[.]do-k-3[.]ru/539ygo2taf[.]map hxxps://hot[.]x2lu[.]ru/9gd[.]check?t=s04v9u5u hxxps://rub[.]pi6o[.]ru/ax1bg1hb hxxps://a8lx[.]1p-8s[.]ru/m5uw81j417[.]sh hxxps://c0re[.]do-k-3[.]ru/p69yv67ukg[.]map hxxps://bus[.]x2lu[.]ru/2jdzwc4r hxxps://b3vf[.]9ha-t[.]ru/v6low2rzge[.]3sh hxxps://bus[.]x2lu[.]ru/sn[.]check?t=l5ubfvn2 hxxps://b3vf[.]9ha-t[.]ru/e4lvoyika6[.]3sh hxxps://fro[.]pi6o[.]ru/6z8[.]google?t=192xl8px hxxps://10ta[.]do-k-3[.]ru/pdtp7wkuyz[.]map hxxps://fro[.]pi6o[.]ru/fgcaar6m hxxps://y6nb[.]7l-0b[.]ru/h55n5492sz[.]2sh hxxps://asp[.]r9xa[.]ru/too[.]check?t=wtjlftc3 hxxps://r2px[.]7l-0b[.]ru/7yi1qzbzau[.]2sh hxxps://dud[.]tu7q[.]ru/7a9[.]check?t=gsmosye3 hxxps://k7w[.]7l-0b[.]ru/u35nrmt4in[.]2sh hxxps://nag[.]m4ze[.]ru/ylt[.]check?t=2wh390nq hxxps://d1hs[.]7l-0b[.]ru/xnp9b84y32[.]2sh hxxps://pop[.]k8li[.]ru/dd4[.]check?t=8m9bh9gp hxxps://ant[.]vo3n[.]ru/c3ezkyww hxxps://s1ne[.]do-k-3[.]ru/s1afts9kev[.]map hxxps://x9sr[.]9ha-t[.]ru/at2mexn80b[.]3sh hxxps://bra[.]k8li[.]ru/1w[.]google?t=qxqpdhou hxxps://x9sr[.]9ha-t[.]ru/n2ubtvljh7[.]3sh hxxps://cap[.]vo3n[.]ru/qnu[.]check?t=syzm88c8 hxxps://had[.]n4ym[.]ru/5lgfe5io hxxps://t0qm[.]9ha-t[.]ru/jbfuwd1h90[.]3sh hxxps://q1[.]4qua0[.]ru/y5rb7wd7if[.]map hxxps://may[.]je9r[.]ru/qy2ozqtu hxxps://may[.]je9r[.]ru/rs[.]google?t=dq2kkdz1 hxxps://q1[.]4qua0[.]ru/w3qi5j21o5[.]map hxxps://has[.]da5v[.]ru/emoqdr9u hxxps://has[.]da5v[.]ru/8c[.]check?t=ivw6smcg hxxps://t0qm[.]9ha-t[.]ru/hc2h4z1rsg[.]3sh |
ClearFake |
| URL | hxxp://176[.]46[.]152[.]62:5858/8e80f7c2f9fd401690d18a13bd88ea39_crypted_build[.]exe hxxp://176[.]46[.]152[.]62:5858/11bcdfb61ed64e4bbf952803fb5c26c6_crypted_build[.]exe hxxp://176[.]46[.]152[.]62:5858/f3fa46ca3afc4d9fa1fd900f983dbbe4_crypted_build[.]exe hxxp://176[.]46[.]152[.]62:5858/4c729290b4914c0297f2c0f2e4b5706a_crypted_build[.]exe hxxp://176[.]46[.]152[.]62:5858/4c2b67a0d3d04d028f22b48b46e0265a_crypted_build[.]exe hxxp://176[.]46[.]152[.]62:5858/8bd0ebb69bd14edcbbc84237dd9555a4_crypted_build[.]exe hxxp://178[.]16[.]53[.]7/dfdsvc[.]exe hxxp://178[.]16[.]53[.]7/xiobv[.]exe hxxp://176[.]46[.]152[.]62:5858/985d5479181846d4ad1c9efdd6d9d780_build[.]exe hxxp://178[.]16[.]53[.]7/rh_0[.]9[.]3[.]exe |
Rhadamanthys |
| URL | hxxp://178[.]16[.]55[.]189/files/7044575709/ZFDBVcB[.]exe | SalatStealer |
| URL | hxxp://178[.]16[.]55[.]189/files/5917492177/lh16kdu[.]exe hxxp://178[.]16[.]53[.]7/Stealc[.]exe hxxps://194[.]50[.]153[.]23/9af57c9106bf2c01[.]php hxxp://178[.]16[.]55[.]189/files/5917492177/9C8mKUO[.]exe hxxp://178[.]16[.]55[.]189/files/5917492177/mZQKmUx[.]exe |
Stealc |
| URL | hxxps://access[.]dragongolf[.]com/20250804[.]7z | StormKitty |
| URL | hxxps://nsbko[.]com/TEEKPBFU[.]msi | HijackLoader |
| URL | hxxps://pastebin[.]com/raw/4dSYh9sw hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/Ltosrxcpildaybi[.]exe hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/RFQ_45830092025_PDF[.]exe hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/Factura[.]exe hxxps://raw[.]githubusercontent[.]com/yumichaeltd/supplier/refs/heads/main/Factura[.]exe hxxp://spinmaha[.]com/POO[.]exe |
AsyncRAT |
| URL | hxxp://162[.]252[.]198[.]162:7777/codebase5533 hxxps://rodriggez[.]com/js[.]php hxxps://rodriggez[.]com/5h7h[.]js hxxps://hlherb[.]com/js[.]php hxxps://hlherb[.]com/6h8d[.]js hxxp://162[.]252[.]198[.]162:7777/test6633 |
KongTuke |
| URL | hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/purchase%20list_0878[.]js hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/Purchase%20samples%20and%20specification_Pdf%20file[.]exe hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/pteroid[.]exe hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/flagellum[.]exe |
XWorm |
| URL | hxxps://github[.]com/yumichaeltd/supplier/raw/refs/heads/main/Chreceoimxmzuue[.]exe | RedLine Stealer |
| URL | hxxp://144[.]172[.]109[.]216/img/kko/sdf09sd09djisjg0s909230090d9f09g090g0df0g90s9g09c0v909d0saf90as90f90s9d[.]hta hxxp://186[.]169[.]46[.]112/sostener[.]vbs hxxp://186[.]169[.]46[.]112/andre[.]vbs hxxp://109[.]248[.]151[.]100/90/pwei090230sdf0f230sdf923090dsfjkjkkdsjof02303090ewsdf902099fs0f9[.]hta |
Remcos |
| URL | hxxps://h2vx[.]1s-1n[.]ru/2di9cytgxg[.]sh hxxps://r4yd[.]1s-1n[.]ru/m9pk4i2ynj[.]sh hxxps://r4yd[.]1s-1n[.]ru/j0udvfdzcm[.]sh hxxps://m7qc[.]1s-1n[.]ru/ecueq866bl[.]sh hxxps://d6aw[.]1s-1n[.]ru/d8ivokcaw1[.]sh hxxps://q9lt[.]1s-1n[.]ru/40qpzg0w5o[.]sh hxxps://q9lt[.]1s-1n[.]ru/q9fhrpljr0[.]sh hxxps://x3pn[.]1s-1n[.]ru/hwcur32hm2[.]sh |
AMOS |
| URL | hxxps://api[.]telegram[.]org/bot8463509866:AAE8QgYjoATxf5_qOoTK098AXh9e2tFR940/ | Agent Tesla |
| URL | hxxps://ventagl[.]cyou/api | Lumma Stealer |
| URL | hxxps://api[.]telegram[.]org/bot7778290192:AAGWVuHwDC3JlK1Ff-z3wm4rodjIUNQBKWU/sendMessage?chat_id=7025772106 | Snake Keylogger |
| URL | hxxps://codmw[.]ru/content/files/CoD4x_21_3[.]zip | Ghost RAT |
| URL | hxxp://117[.]72[.]197[.]178:443/02[.]08[.]2022[.]exe hxxp://8[.]137[.]149[.]67/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxps://191[.]235[.]242[.]43/servidor%20de%20texto[.]txt | NjRAT |
| URL | hxxps://themccoyhome[.]com/dsfcnotufy[.]zip hxxps://www[.]pantallaleds[.]com/pops[.]php hxxps://prajsm[.]com/xss/bof[.]js hxxps://prajsm[.]com/xss/index[.]php hxxps://prajsm[.]com/xss/buf[.]js |
NetSupportManager RAT |
| URL | hxxps://browsertools[.]shop/api/live hxxps://opencamping[.]shop/api/live hxxps://browsertools[.]shop/api/send hxxps://browsertools[.]shop/api/conf |
Aura Stealer |
| URL | hxxp://www[.]ullcitytrackclub[.]run/zl28/ hxxp://www[.]umjb2[.]top/zl28/ hxxp://www[.]upkie[.]net/zl28/ hxxp://www[.]urewellnesshub[.]xyz/zl28/ hxxp://www[.]vkugx[.]top/zl28/ hxxp://www[.]vtnvb[.]click/zl28/ hxxp://www[.]vvvt[.]vip/zl28/ hxxp://www[.]ww26510[.]vip/zl28/ hxxp://www[.]ytenode[.]cloud/zl28/ hxxp://www[.]z611[.]top/zl28/ hxxp://www[.]q1kxvb7a02-90x0[.]shop/zl28/ hxxp://www[.]rindcity[.]net/zl28/ hxxp://www[.]rnamentalhub[.]shop/zl28/ hxxp://www[.]rontointerventofabbro[.]net/zl28/ hxxp://www[.]rvxae[.]cfd/zl28/ hxxp://www[.]ryequatureteam[.]top/zl28/ hxxp://www[.]so0un[.]top/zl28/ hxxp://www[.]t222[.]vip/zl28/ hxxp://www[.]tguosheng[.]top/zl28/ hxxp://www[.]trategy-21[.]net/zl28/ hxxp://www[.]offeecoffeecoffeecoffee[.]coffee/zl28/ hxxp://www[.]oftonsonline[.]xyz/zl28/ hxxp://www[.]onfirmacaoenviodigiital[.]shop/zl28/ hxxp://www[.]oodsy[.]design/zl28/ hxxp://www[.]orbiddendreams[.]shop/zl28/ hxxp://www[.]ord-connect[.]net/zl28/ hxxp://www[.]ordsserialli1[.]xyz/zl28/ hxxp://www[.]oweredby[.]dev/zl28/ hxxp://www[.]p6[.]top/zl28/ hxxp://www[.]partments-for-rent-94915[.]bond/zl28/ hxxp://www[.]eshara[.]net/zl28/ hxxp://www[.]hatimage[.]net/zl28/ hxxp://www[.]iatyogrod63[.]shop/zl28/ hxxp://www[.]igiconsulting[.]pro/zl28/ hxxp://www[.]ile[.]live/zl28/ hxxp://www[.]indvyn[.]xyz/zl28/ hxxp://www[.]inhbaokhang[.]website/zl28/ hxxp://www[.]islr[.]tech/zl28/ hxxp://www[.]italideas[.]net/zl28/ hxxp://www[.]marov[.]tech/zl28/ hxxp://www[.]nlyoneserver[.]xyz/zl28/ hxxp://www[.]cciccloud[.]sbs/zl28/ hxxp://www[.]cxzsa[.]xyz/zl28/ hxxp://www[.]d5468338461[.]click/zl28/ hxxp://www[.]echat[.]net/zl28/ hxxp://www[.]edallionroofrepairs[.]xyz/zl28/ hxxp://www[.]egt[.]lat/zl28/ hxxp://www[.]enpercent[.]shop/zl28/ hxxp://www[.]enviro[.]live/zl28/ hxxp://www[.]eonesens[.]cloud/zl28/ hxxp://www[.]aofi[.]net/zl28/ hxxp://www[.]ark-10[.]xyz/zl28/ hxxp://www[.]aystablecoin[.]xyz/zl28/ hxxp://www[.]brj[.]net/zl28/ hxxp://www[.]btwbo[.]top/zl28/ hxxp://www[.]c1723[.]top/zl28/ hxxp://www[.]c1809[.]top/zl28/ hxxp://www[.]c2863[.]top/zl28/ hxxp://www[.]c4895[.]top/zl28/ hxxp://www[.]56837[.]top/zl28/ hxxp://www[.]6n[.]top/zl28/ hxxp://www[.]6w5rfre[.]xyz/zl28/ hxxp://www[.]7684455[.]vip/zl28/ hxxp://www[.]agamentomonave[.]shop/zl28/ hxxp://www[.]annahnoh[.]xyz/zl28/ |
Formbook |
| URL | hxxp://23[.]94[.]145[.]109/Mbjdf8dsh/index[.]php | Amadey |
