不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2026/03/13
※2026/03/13 更新
マルウェア感染させると考えられるURLを検知（2026/03/13）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://158[.]94[.]210[.]6/6872baa3ee2b46f6[.]php | Stealc |
| URL | hxxps://mantaina[.]com/js[.]php hxxps://seahorsemethod[.]com/global hxxps://mantaina[.]com/5h2s[.]js hxxps://elenviel[.]com/4s2h[.]js hxxps://elenviel[.]com/js[.]php hxxps://seahorsemethod[.]com/customer hxxps://salelegalsteroids[.]com/enterprise/IWkkAiQbHycFEXkIKAgCLTASCwUTXS0YMl13Q3EaNFEKaTsRRx9wBy08VBwNFjNQCgo6LDEDBiQCLxBBCzQbSlB1USwfM3QCEABSHzklFwgmKicFPHcVLiEsDzwUEx0DVQFSekVpdkJIdwdrTn5hU1RvRnVGAWlHf1hzQXZXUANVAVI= hxxp://zrd6omm630kx5p7[.]top/1[.]php hxxps://salelegalsteroids[.]com/enterprise |
KongTuke |
| URL | hxxp://91[.]219[.]23[.]145/predator-varying | ACR Stealer |
| URL | hxxps://7o9ige3i[.]documentarygo[.]digital/?=check&&actmn=vzwgFGeCVWLhdCNI hxxps://fxtlp6so[.]eyedmerlushka[.]digital/?=check&&actmn=FaOSZWMSjcYBfpmX |
ClearFake |
| URL | hxxp://82[.]146[.]48[.]233/Processorbigload[.]php | DCRat |
| URL | hxxps://api[.]telegram[.]org/bot7954414643:AAFXkW1GI1wusrWmH9gD_yPwAhi75Z0wU-c/ hxxp://209[.]54[.]102[.]132/Sexister[.]hhk hxxp://209[.]54[.]102[.]132/ILitOryfRMXTjathX140[.]bin hxxp://209[.]54[.]102[.]132/Granad244[.]pcz |
Agent Tesla |
| URL | hxxp://158[.]94[.]208[.]7/files/gop/random[.]exe hxxp://158[.]94[.]208[.]7/files/7453936223/KAQ8PQ5[.]exe hxxp://158[.]94[.]208[.]7/files/oblivora/random[.]exe hxxp://158[.]94[.]208[.]7/files/1424975206/grFJpUR[.]exe hxxp://158[.]94[.]208[.]7/files/5900855435/eNLe4nm[.]exe hxxp://158[.]94[.]208[.]7/files/rdx/random[.]exe |
Vidar |
| URL | hxxp://158[.]94[.]208[.]7/files/7411337060/ZCGm9Ky[.]exe hxxp://196[.]251[.]107[.]24/v4343[.]exe |
NjRAT |
| URL | hxxp://107[.]173[.]47[.]137/177/ceo/wellthingsformebest[.]js hxxp://186[.]169[.]43[.]64/a[.]exe |
Remcos |
| URL | hxxp://158[.]94[.]208[.]7/files/unique2/random[.]exe | GCleaner |
| URL | hxxp://130[.]12[.]181[.]60/iat[.]exe | Coinminer |
| URL | hxxp://158[.]94[.]208[.]7/files/8548282130/O43GJVa[.]exe | Quasar RAT |
| URL | hxxps://23[.]152[.]0[.]240:3957/835a189ccf9d6badf60eacc/mcgw458i[.]fre2n | Rhadamanthys |
| URL | hxxps://gharnt[.]com/poss5645/ENCRYPT[.]Ps1 | Snake Keylogger |
| URL | hxxp://www[.]teslasuit[.]to/img_012505yubtcc[.]png hxxp://teslasuit[.]to/optimized_MSIyu[.]png hxxps://tradingmastery[.]info/txt/king[.]txt |
XWorm |
| URL | hxxp://valfanto[.]com/somthids/ejgddFd[.]txt | DarkCloud |
| URL | hxxp://107[.]175[.]246[.]3/35/seethebstoptionforbetterwyasto[.]js | PureRAT |
| URL | hxxp://209[.]54[.]102[.]132/ZFSkDn73[.]bin | CloudEyE |
| URL | hxxps://api[.]telegram[.]org/bot8590459638:AAGU3iEpSYCxuV6N1j7kyN1lNN_JTsDtqZk/sendMessage?chat_id=8273418545 | Stealerium |
