不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2026/01/16
※2026/01/16 更新
マルウェア感染させると考えられるURLを検知（2026/01/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://baretteexpressions[.]com/d[.]js hxxps://qirtewd[.]com/logout/secure-util[.]js hxxps://qirtewd[.]com/logout/redirect-response[.]php hxxps://qirtewd[.]com/logout/dashboard-hook[.]js hxxp://89[.]46[.]38[.]118/lanny hxxps://paikailai[.]com/lanny hxxps://89[.]46[.]38[.]118/auth |
NetSupportManager RAT |
| URL | hxxp://107[.]172[.]135[.]9/KfbTEdBwgn128[.]bin hxxp://107[.]172[.]135[.]9/pBVtpgFjCD147[.]bin hxxp://107[.]172[.]135[.]9/Belaanin[.]psp hxxp://107[.]172[.]135[.]9/Ddpunkt[.]u32 hxxp://107[.]172[.]135[.]9/MCmpsuR206[.]bin hxxp://107[.]172[.]135[.]9/pFiOZuGlv13[.]bin hxxp://107[.]172[.]135[.]9/zyFzHKdU38[.]bin hxxp://107[.]172[.]135[.]9/YfRxEWFEd36[.]bin hxxp://107[.]172[.]135[.]9/Linjeres[.]ocx hxxp://107[.]172[.]135[.]9/Biblio[.]rar hxxp://107[.]172[.]135[.]9/Indfle[.]pcx hxxp://107[.]172[.]135[.]9/Enke[.]dsp hxxp://172[.]245[.]95[.]59/nnKVMr44[.]bin hxxp://172[.]245[.]95[.]59/AFGohjJa146[.]bin hxxp://172[.]245[.]95[.]59/QxeXNeZddr46[.]bin hxxp://172[.]245[.]95[.]59/KqKtBvWpZxKFHiSwBJhtxRaX43[.]bin hxxp://172[.]245[.]95[.]59/qHHClEbTZg63[.]bin hxxp://172[.]245[.]95[.]59/rpzsrPH79[.]bin |
CloudEyE |
| URL | hxxp://45[.]144[.]212[.]54/BIN/eaz[.]ps1 hxxp://45[.]144[.]212[.]54/BIN/eazyy[.]ps1 hxxp://45[.]144[.]212[.]54/BIN/EASY[.]ps1 hxxp://45[.]144[.]212[.]54/BIN/eazyyyyyyy[.]ps1 |
AsyncRAT |
| URL | hxxps://zyhunkenya[.]co[.]ke/arquivo_20260114083005[.]txt hxxp://87[.]121[.]84[.]189/deals/yuxworm2026will[.]txt hxxps://news4me[.]xyz/protector/davidxworm[.]txt |
XWorm |
| URL | hxxp://91[.]92[.]243[.]254:7777/91[.]92[.]243[.]254/ugoone/ENCRYPTED[.]ps1 hxxps://proestimating[.]us/INV123243254/ENCRYPTED[.]ps1 hxxp://91[.]92[.]243[.]254:7777/91[.]92[.]243[.]254/ugotwos/2hwoFfgGDgDEGHgt[.]js |
MASS Logger |
| URL | hxxp://91[.]92[.]243[.]254:7777/91[.]92[.]243[.]254/plugmantwo/GjghfgGDgDEGHgt[.]js | Snake Keylogger |
| URL | hxxp://91[.]92[.]243[.]254:7777/91[.]92[.]243[.]254/sarahtwo/sarahz[.]js hxxp://45[.]144[.]212[.]54/BIN/richard[.]ps1 hxxps://api[.]telegram[.]org/bot8179620426:AAF3lJfFdIqYD5pgfnAT-57DbX2TRIY8rbA/sendMessage?chat_id=7989332944 |
Stealerium |
| URL | hxxps://neccgroup[.]com/arquivo_20260114000902[.]txt hxxps://neccgroup[.]com/assets/img/optimized_MSI[.]png hxxp://45[.]144[.]212[.]54/BIN/STEINFTPP[.]ps1 |
Agent Tesla |
| URL | hxxps://step-ksa[.]org/ENCRYPTED[.]ps1 hxxps://aggrowtlh[.]com/KEN[.]ps1 hxxps://aggrowtlh[.]com/ENCRYPTED[.]ps1 hxxps://almacensantangel[.]com/ENCRYPTED[.]ps1[.]ps1 hxxp://45[.]144[.]212[.]54/BIN/SECOND[.]ps1 hxxp://45[.]144[.]212[.]54/BIN/CU[.]ps1 hxxps://aggrowtlh[.]com/OWEN[.]ps1 |
Formbook |
| URL | hxxp://45[.]144[.]212[.]54/BIN/ikmero[.]ps1 hxxps://dialkwik[.]in/j1/ENCRYPTED[.]ps1 |
PureLogs Stealer |
| URL | hxxp://119[.]29[.]162[.]146:99/buding/dbghelp[.]dll | KrBanker |
| URL | hxxp://130[.]12[.]180[.]71/cd4wtp0w0yza/assets/js/h9s78k5pry hxxp://130[.]12[.]180[.]71/cd4wtp0w0yza/assets/js/di7n0tmrr5 hxxp://130[.]12[.]180[.]71/cd4wtp0w0yza/assets/js/7vjkteq40g |
Bashlite |
| URL | hxxp://212[.]38[.]88[.]162/Client[.]exe | DCRat |
| URL | hxxp://172[.]86[.]123[.]222/Petuhon[.]zip hxxp://172[.]86[.]123[.]222/Smokest120[.]zip |
Amadey |
| URL | hxxps://cerkery[.]com/7y7y[.]js hxxps://cerkery[.]com/js[.]php hxxps://meeller[.]com/7h4s[.]js hxxps://meeller[.]com/js[.]php |
KongTuke |
| URL | hxxp://www[.]marketing[.]bebe9mayotte[.]com/cgi-tmp/Host9271[.]exe | Lumma Stealer |
| URL | hxxps://101[.]127[.]184[.]185:8443/sda1/Video[.]scr hxxps://101[.]127[.]184[.]185:8443/sda1/Photo[.]scr hxxps://101[.]127[.]184[.]185:8443/sda1/AV[.]scr hxxps://94[.]164[.]44[.]117:8443/sda1/GOT/AV[.]scr hxxps://94[.]164[.]44[.]117:8443/sda1/GOT/Video[.]scr hxxps://94[.]164[.]44[.]117:8443/sda1/GOT/Photo[.]scr hxxps://115[.]131[.]219[.]91:8443/sda5/AV[.]scr hxxps://115[.]131[.]219[.]91:8443/sda5/Photo[.]scr hxxps://115[.]131[.]219[.]91:8443/sda5/Video[.]scr hxxps://94[.]165[.]19[.]116:8443/sda1/IMG001[.]exe hxxp://89[.]125[.]152[.]38/xmss |
Coinminer |
| URL | hxxp://38[.]76[.]194[.]131:10000/02[.]08[.]2022[.]exe hxxp://20[.]124[.]236[.]185/02[.]08[.]2022[.]exe hxxp://101[.]201[.]180[.]191:4444/02[.]08[.]2022[.]exe hxxp://39[.]105[.]193[.]156:4444/02[.]08[.]2022[.]exe hxxp://165[.]245[.]143[.]128/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://202[.]61[.]139[.]34:65532/linux_mipsel hxxp://202[.]61[.]139[.]34:65532/linux_aarch64 hxxp://202[.]61[.]139[.]34:65532/linux_mips64 hxxp://202[.]61[.]139[.]34:65532/linux_arm6 hxxp://202[.]61[.]139[.]34:65532/linux_mips64el hxxp://202[.]61[.]139[.]34:65532/linux_arm5 hxxp://202[.]61[.]139[.]34:65532/linux_arm7 hxxp://202[.]61[.]139[.]34:65532/linux_amd64 hxxp://202[.]61[.]139[.]34:65532/linux_386 hxxp://202[.]61[.]139[.]34:65532/linux_mips |
Kaiji |
| URL | hxxp://45[.]93[.]20[.]34/124d0720183846ba[.]php | Stealc |
