不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様58社 -
2026/08/07
※2026/08/07 更新
マルウェア感染させると考えられるURLを検知（2026/08/07）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://91[.]92[.]242[.]236/files-129312398/files/file_e958e6cb554d1c91[.]exe | RemoteX |
| URL | hxxps://download[.]ubua[.]online/agenthype[.]exe hxxps://rcf[.]co[.]mz/Chrome01[.]exe |
PureLogs Stealer |
| URL | hxxp://192[.]162[.]199[.]186/zpzp/get[.]php hxxp://192[.]162[.]199[.]186/stlr[.]exe |
Stealc |
| URL | hxxp://192[.]255[.]159[.]254/70/img_202115[.]png hxxp://192[.]255[.]159[.]254/70/goodthingswithbestsupportforme[.]hta hxxps://grupohenry1[.]com/astillerohenry[.]com/imgnic_165817[.]png hxxps://grupohenry1[.]com/astillerohenry[.]com/nMSI_PRO[.]png hxxp://45[.]9[.]168[.]230/yuoriginsmtp[.]png |
Agent Tesla |
| URL | hxxp://216[.]9[.]224[.]73/33/img_190847[.]png hxxp://216[.]9[.]224[.]73/33/weneedbestmagicalapproachforbesthings[.]hta hxxp://216[.]225[.]206[.]31/56/goodthingswforbestfeelingsfromtheheartsesion[.]hta hxxp://57[.]129[.]23[.]24/8089/crypted[.]ps1 hxxp://216[.]225[.]206[.]31/56/nn/bestgood[.]vbe hxxp://204[.]44[.]93[.]92/70/img_182439[.]png hxxp://204[.]44[.]93[.]92/70/weneedbestthingsfromtheheartformeebest[.]hta hxxp://107[.]173[.]47[.]10/27/blackmagicprotectiononthisfilewhathaving[.]hta hxxp://107[.]173[.]47[.]10/img/img_180754[.]png hxxps://comumvidros[.]com[.]br/city/rcx1[.]exe hxxp://155[.]103[.]69[.]239/img/img_210844[.]png hxxp://155[.]103[.]69[.]239/45/wearebestforeverythingfrommegood[.]hta hxxps://zoredaye[.]com/stego_haamlp2ndi[.]png hxxps://zoredaye[.]com/stego_yzybqoy6im[.]png hxxps://sumiko[.]vu/soldierman/64-Bit-remcos_a[.]bin hxxps://heajost[.]online/img_054840[.]png hxxp://107[.]172[.]172[.]208/72/weneedbestthingsfromthebetterplacesonthis[.]hta hxxp://155[.]103[.]69[.]239/50/img_010818[.]png hxxp://155[.]103[.]69[.]239/50/wegivingbestthingsforbetterplacescoming[.]hta hxxp://107[.]173[.]9[.]105/70/img_231911[.]png hxxp://107[.]173[.]9[.]105/70/goodthingsfromtheheartformebestfeelsgivingforme[.]hta hxxp://172[.]245[.]209[.]133/65/img_234612[.]png hxxp://172[.]245[.]209[.]133/65/goodthingsfromebestthings[.]hta hxxps://pocopaco[.]co[.]za/img_110418[.]png hxxp://172[.]245[.]195[.]208/70/img_014109[.]png hxxp://172[.]245[.]195[.]208/70/wegivingbestthingsfromthebestpeopelsforme[.]hta |
Remcos |
| URL | hxxp://27[.]215[.]126[.]152:33758/Mozi[.]a hxxp://139[.]135[.]46[.]28:55160/Mozi[.]m hxxp://61[.]53[.]8[.]56:50916/Mozi[.]m |
Mozi |
| URL | hxxps://orienttaxtile[.]com/thurs/crypted[.]ps1 hxxps://ryanborn[.]net/BAND/crypted[.]ps1 |
Stealerium |
| URL | hxxps://timestampasa[.]howto[.]rocks/img_081556[.]png hxxp://193[.]104[.]58[.]65/rumpaugust[.]png hxxp://193[.]104[.]58[.]65/yuxwormaugust[.]png hxxps://www[.]hqsblog[.]com/wordpress/wp-content/plugins/zxzxzx/stego_588ean488k[.]png |
XWorm |
| URL | hxxps://timestampasa[.]howto[.]rocks/img_075249[.]png | DarkCloud |
| URL | hxxps://sales[.]ifree[.]page/img_131252[.]png hxxp://216[.]9[.]224[.]48/xz/bin%20(2)upload%20(1)[.]txt hxxp://178[.]16[.]53[.]176/HTTP/kcrypted[.]ps1 hxxps://durakutihs[.]com/[.]well-known/acme-challenge/sma[.]exe hxxps://golvteametvarberg[.]se/wp-content/admin/bin[.]exe |
Formbook |
| URL | hxxp://194[.]59[.]31[.]194:32148/b/kal64 hxxp://194[.]59[.]31[.]194:32148/s/kal64 hxxp://194[.]59[.]31[.]194:32148/b/kswpad hxxp://194[.]59[.]31[.]194:32148/s/kswpad |
BillGates |
| URL | hxxp://58[.]218[.]215[.]67:443/cloud-site/header-and-footer/shopping-cart[.]png hxxp://118[.]112[.]10[.]10:443/common/advertisement/Fixed/float/smile[.]svg hxxp://113[.]113[.]100[.]46:443/cloud-site/header-and-footer/shopping-cart[.]png hxxp://113[.]113[.]100[.]45:443/common/advertisement/Fixed/float/smile[.]svg |
Cobalt Strike |
| URL | hxxps://siege-close[.]com/x9i32md/w1/la02 | IClickFix |
| URL | hxxp://37[.]49[.]227[.]136/pope[.]x86 hxxp://37[.]49[.]227[.]136/pope[.]sparc hxxp://37[.]49[.]227[.]136/pope[.]arm4 hxxp://37[.]49[.]227[.]136/pope[.]arm6 hxxp://37[.]49[.]227[.]136/pope[.]i686 hxxp://37[.]49[.]227[.]136/pope[.]arm5 hxxp://37[.]49[.]227[.]136/pope[.]i386 hxxp://37[.]49[.]227[.]136/pope[.]arm64 hxxp://45[.]135[.]194[.]47/bins/xnxnxnxnxnxnxnxni386xnxn hxxp://45[.]135[.]194[.]47/bins/xnxnxnxnxnxnxnxnx86_64xnxn |
Bashlite |
| URL | hxxp://217[.]60[.]195[.]219/ty/load[.]bat | Quasar RAT |
