不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/01/24
※2023/01/24 更新
マルウェア感染させると考えられるURLを検知（2023/01/24）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://185[.]246[.]220[.]121/vik/bvesec[.]exe hxxp://3[.]65[.]2[.]139/read/Ltrwmpfgvbk[.]exe hxxp://3[.]65[.]2[.]139/read/Phdymmrmanm[.]exe hxxp://jsw[.]co[.]id/system1/c4[.]exe hxxp://jsw[.]co[.]id/system1/crypt2[.]exe hxxp://jsw[.]co[.]id/system1/Hcf4hIfNKVD9T46[.]exe hxxp://jsw[.]co[.]id/system1/supply[.]exe hxxp://185[.]225[.]74[.]69/mad/inc/1c468152070648[.]php |
Agent Tesla |
| URL | hxxp://62[.]204[.]41[.]119/lebro[.]exe hxxp://62[.]204[.]41[.]242/9vZbns/Plugins/clip64[.]dll hxxp://62[.]204[.]41[.]242/9vZbns/Plugins/cred64[.]dll hxxp://62[.]204[.]41[.]27/9djZdj09/Plugins/clip64[.]dll hxxp://62[.]204[.]41[.]27/9djZdj09/Plugins/cred64[.]dll hxxp://62[.]204[.]41[.]88/9vdVVVjsw/Plugins/clip64[.]dll hxxp://62[.]204[.]41[.]88/9vdVVVjsw/Plugins/cred64[.]dll hxxp://62[.]204[.]41[.]88/lend/Amadey[.]exe hxxp://62[.]204[.]41[.]88/lend/meta2[.]exe hxxp://62[.]233[.]51[.]173/jb9sZZZbv7/Plugins/cred64[.]dll hxxps://cleanpcsoft[.]com/race[.]exe hxxp://62[.]204[.]41[.]88/9vdVVVjsw/index[.]php hxxp://62[.]233[.]51[.]173/jb9sZZZbv7/index[.]php hxxp://62[.]233[.]51[.]173/jb9sZZZbv7/index[.]php?scr=1 hxxp://62[.]233[.]51[.]173/jb9sZZZbv7/Login[.]php hxxp://62[.]233[.]51[.]173/jb9sZZZbv7/Plugins/clip64[.]dll |
Amadey |
| URL | hxxp://62[.]204[.]41[.]88/lend/meta1[.]exe | Arkei Stealer |
| URL | hxxp://135[.]181[.]107[.]76/auth hxxp://193[.]188[.]23[.]177/auth hxxp://212[.]192[.]31[.]29/auth hxxp://45[.]15[.]156[.]175/auth hxxp://45[.]15[.]156[.]234/auth hxxp://45[.]15[.]156[.]246/auth hxxp://45[.]15[.]156[.]250/auth hxxp://45[.]151[.]144[.]19/auth hxxp://45[.]61[.]139[.]86/auth hxxp://95[.]215[.]108[.]15/auth hxxp://95[.]217[.]235[.]8/auth |
Aurora Stealer |
| URL | hxxp://172[.]104[.]244[.]136/586 hxxp://172[.]104[.]244[.]136/co hxxp://172[.]104[.]244[.]136/dc hxxp://172[.]104[.]244[.]136/dss hxxp://172[.]104[.]244[.]136/i686 hxxp://172[.]104[.]244[.]136/m68k hxxp://172[.]104[.]244[.]136/ppc hxxp://172[.]104[.]244[.]136/sh4 |
Bashlite |
| URL | hxxp://aimp[.]software/trade[.]gpg hxxps://aimp[.]software/7zip[.]gpg hxxps://aimp[.]software/awesome[.]gpg hxxps://aimp[.]software/filezilla[.]gpg hxxps://aimp[.]software/lightshot[.]gpg hxxps://aimp[.]software/new_tradingview[.]gpg hxxps://aimp[.]software/rufus[.]gpg hxxps://aimp[.]software/vlc[.]gpg hxxps://aimp[.]software/winrar[.]gpg |
BATLOADER |
| URL | hxxp://18[.]117[.]193[.]148//receive[.]php | BlackNET RAT |
| URL | hxxp://mail[.]eec[.]dz/WFvMVEXaMxD168[.]smi | CloudEyE |
| URL | hxxp://137[.]220[.]135[.]199:6789/dot[.]gif hxxp://208[.]67[.]105[.]87:12338/match hxxp://3[.]92[.]113[.]197:8082/hubcap/mayo-clinic-radio-full-shows/ hxxp://3[.]92[.]113[.]197:8084/discussion/mayo-clinic-radio-als/ hxxp://35[.]88[.]90[.]115/dz hxxp://88[.]119[.]175[.]149:9999/cm hxxp://konactoratec[.]xyz/_/scs/mail-static/_/js/ hxxp://vd-ntds[.]com/_/scs/mail-static/_/js/ hxxps://208[.]67[.]105[.]87:13443/pixel[.]gif hxxps://44[.]201[.]225[.]29/cm hxxps://45[.]12[.]253[.]139/favicon[.]js hxxps://77[.]73[.]134[.]51:8888/c/msdownload/update/others/2020/10/29136388_ hxxps://8[.]214[.]108[.]207:14443/activity hxxps://goupdatemic[.]online:8888/c/msdownload/update/others/2020/10/29136388_ hxxps://vd-ntds[.]com/_/scs/mail-static/_/js/ |
Cobalt Strike |
| URL | hxxp://149[.]3[.]170[.]202/romas[.]exe | DanaBot |
| URL | hxxp://194[.]67[.]87[.]32/Securetrafficdatalife[.]php hxxp://neverchurka[.]ml/lineMultiFlower[.]php |
DCRat |
| URL | hxxps://www[.]manchesterot[.]co[.]uk/about-us/BfumrDFaSvt/ hxxps://www[.]manchesterot[.]co[.]uk/about-us/GNN9Fh9PyTtem3QjNJ/ |
Emotet |
| URL | hxxps://f47ac[.]rendezvous[.]tophandsome[.]gay/subscribeEvent | FAKEUPDATES |
| URL | hxxp://djqnef[.]gives/RuntimeWorker3[.]exe | Ficker Stealer |
| URL | hxxp://akeadparis[.]com/agenzia/azienda/verificare[.]zip hxxp://ancien[.]7tv-live[.]com/agenzia/online/index[.]php hxxp://dexpertspro[.]com/headers/azienda/avviso[.]zip hxxp://fortdelgres[.]com/headers/online/index[.]php hxxp://ginoscratch[.]com/agenzia/azienda/modulo[.]zip hxxp://globesecure[.]de/agenzia/online/index[.]php hxxp://inthbc[.]com/agenzia/azienda/Agenzia[.]zip hxxp://inthbc[.]com/agenzia/azienda/agenzia_delle_entrate[.]zip hxxp://inthbc[.]com/agenzia/azienda/Agenzia_Entrate[.]zip hxxp://inthbc[.]com/agenzia/azienda/AgenziaEntrate[.]zip hxxp://inthbc[.]com/agenzia/azienda/avviso[.]zip hxxp://inthbc[.]com/agenzia/azienda/contabilita[.]zip hxxp://inthbc[.]com/agenzia/azienda/contratto[.]zip hxxp://inthbc[.]com/agenzia/azienda/documento[.]zip hxxp://inthbc[.]com/agenzia/azienda/modulo[.]zip hxxp://inthbc[.]com/agenzia/azienda/verificare[.]zip hxxp://kiengiang24h[.]com/agenzia/azienda/contabilita[.]zip hxxp://kitdigital[.]tecoinfor[.]com/agenzia/azienda/modulo[.]zip hxxp://lanrungnamtau[.]com/agenzia/azienda/Agenzia_Entrate[.]zip hxxp://nhachannuoi[.]vn/agenzia/online/index[.]php hxxp://wynecare[.]com/static/azienda/contabilita[.]zip hxxps://enmillenium[.]com/agenzia/azienda/contratto[.]zip hxxps://gite-randonnee-ardeche[.]com/testWP/wp-content/themes/sketch/online/index[.]php hxxps://www[.]lasikofmichigan[.]com/wp-content/themes/azienda/Agenzia_Entrate[.]zip hxxps://www[.]lasikofmichigan[.]com/wp-content/themes/azienda/contratto[.]zip |
Gozi |
| URL | hxxp://193[.]0[.]178[.]235/drew/ hxxp://31[.]41[.]44[.]27/drew/ hxxp://62[.]173[.]149[.]10/drew/ |
ISFB |
| URL | hxxp://62[.]204[.]41[.]88/lend/redline4[.]exe | Laplas |
| URL | hxxp://192[.]210[.]160[.]133/79/vbc[.]exe | LokiBot |
| URL | hxxp://198[.]23[.]172[.]90/invoice12[.]exe | NetWire RC |
| URL | hxxp://altairsoftware[.]link/InstallSetup3[.]exe | PrivateLoader |
| URL | hxxp://chatgigi2[.]com/file/2 | Quasar RAT |
| URL | hxxp://116[.]203[.]30[.]135/qthw6l/rpilag[.]exe | Raccoon |
| URL | hxxp://45[.]93[.]201[.]114/docs/ANRqHejJ64GKfA0BubGNOdUqivC3Kr[.]txt hxxp://62[.]204[.]41[.]119/poka/nesto[.]exe hxxp://62[.]204[.]41[.]119/poka/nesto1[.]exe hxxp://62[.]204[.]41[.]119/taha/love[.]exe hxxp://62[.]204[.]41[.]119/troma/stown[.]exe hxxp://62[.]204[.]41[.]119/troma/stown1[.]exe hxxp://62[.]204[.]41[.]176/putingod[.]exe hxxp://62[.]204[.]41[.]88/lend/700K[.]exe hxxp://62[.]204[.]41[.]88/lend/install[.]exe hxxp://62[.]204[.]41[.]88/lend/redline1[.]exe hxxp://asfamilystyle[.]ru/attachments/65/ hxxps://nftmus[.]art/Museum[.]exe hxxps://nftmus[.]art/NFTMuseum[.]exe |
RedLine Stealer |
| URL | hxxp://62[.]204[.]41[.]119/taha/love1[.]exe | Rhadamanthys |
| URL | hxxp://116[.]202[.]0[.]132/784 hxxp://195[.]201[.]251[.]109/15 hxxp://195[.]201[.]251[.]109/682 hxxp://195[.]201[.]251[.]109/701 hxxp://65[.]109[.]208[.]140/20 hxxp://65[.]109[.]208[.]142/19 hxxp://65[.]109[.]208[.]142/237 hxxp://65[.]109[.]208[.]142/580 hxxp://65[.]109[.]208[.]142/701 hxxp://65[.]109[.]208[.]142/851 hxxp://65[.]109[.]208[.]142/862 hxxp://65[.]21[.]58[.]6/784 |
Vidar |
