不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/02/03
※2023/02/03 更新
マルウェア感染させると考えられるURLを検知（2023/02/03）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://38[.]153[.]157[.]57/212/vbc[.]exe hxxp://198[.]98[.]55[.]114/ifex/inc/b06a1d19725a84[.]php |
Agent Tesla |
| URL | hxxp://185[.]215[.]113[.]204/g9TTnd3bS/index[.]php | Amadey |
| URL | hxxps://munnajupitor[.]store/wondershare/filmora[.]exe | AsyncRAT |
| URL | hxxp://193[.]233[.]20[.]134/auth hxxp://45[.]15[.]156[.]54/auth hxxp://94[.]142[.]138[.]4/auth hxxp://94[.]142[.]138[.]6/auth |
Aurora Stealer |
| URL | hxxp://0xx3[.]kaspenskyupdates[.]com/css/jquery[.]min[.]js hxxp://104[.]243[.]143[.]71/dot[.]gif hxxp://108[.]166[.]220[.]43:7001/en_US/all[.]js hxxp://109[.]172[.]45[.]85/favicon hxxp://170[.]39[.]214[.]187/ca hxxp://192[.]3[.]127[.]174:51001/push hxxp://192[.]3[.]127[.]174:51003/updates[.]rss hxxp://192[.]3[.]127[.]174:51004/ca hxxp://20[.]7[.]201[.]45/match hxxp://42[.]193[.]23[.]91/IE9CompatViewList[.]xml hxxp://45[.]95[.]67[.]211/ca hxxp://54[.]210[.]2[.]63/updates/ hxxp://79[.]141[.]169[.]220/g[.]pixel hxxp://79[.]141[.]169[.]220/match hxxp://k597s[.]cn110[.]xyz:2095/fwlink hxxp://nxsimdevelop[.]com/ku[.]js hxxps://10[.]104[.]128[.]97/dpixel hxxps://103[.]227[.]117[.]45:8443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://103[.]87[.]240[.]167/dot[.]gif hxxps://179[.]43[.]187[.]185:4444/us/ky/louisville/312-s-fourth-st[.]html hxxps://185[.]254[.]37[.]224/as[.]css hxxps://194[.]165[.]16[.]95:4444/visualize[.]html hxxps://20[.]7[.]201[.]45/en_US/all[.]js hxxps://209[.]141[.]36[.]163/css/jquery[.]min[.]js hxxps://216[.]146[.]25[.]49:8443/updates hxxps://45[.]61[.]186[.]108:4433/activity hxxps://81[.]161[.]229[.]134/updates[.]rss hxxps://appdevtechnology[.]com/template[.]css hxxps://as[.]svcshosvt[.]com/bn hxxps://fb1[.]me:2053/match hxxps://fb1[.]me:2087/ga[.]js hxxps://playfish[.]fun:6001/dot[.]gif hxxps://qw[.]svcshosvt[.]com/bn hxxps://redir1[.]nevergonnagiveyouup[.]us/g[.]pixel hxxps://rubanojeansup[.]com/visualize[.]html hxxps://submitgoogleurl[.]com/restore/how/3RG4G5T87 hxxps://vpn-pulsesecure[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://www[.]fzupdate[.]com/preload hxxps://zx[.]svcshosvt[.]com/ky |
Cobalt Strike |
| URL | hxxp://62[.]204[.]41[.]88/lend/m00[.]exe | Coinminer |
| URL | hxxp://193[.]233[.]49[.]109:7766/DCRatBuild04[.]10[.]exe hxxp://62[.]109[.]23[.]37/ProcessTraffic[.]php |
DCRat |
| URL | hxxps://alarmascancun[.]com[.]mx/wp-content/themes/vw-security-guard/template-parts/header/dvhW3tqNnyOlf[.]php | Dridex |
| URL | hxxp://sourceintership[.]com/vendor/rZnJL9pPUjA9pU/ hxxp://www[.]thebeginningstore[.]in/0202498070/m2x8inU7TSiuO3px/ hxxp://www[.]angloextrema[.]com[.]br/assets/mQVRrHu7o0eJXxTFu/ hxxp://alvaovillagecamping[.]pt/wp-content/Ra9iwOPb6uLf/ |
Emotet |
| URL | hxxps://0447e[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://81004[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://bcf87[.]fate[.]truelance[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://155[.]94[.]209[.]44:7121/give-me-chpv hxxp://155[.]94[.]209[.]44:7121/give-me-ffpv hxxp://155[.]94[.]209[.]44:7121/ie hxxp://155[.]94[.]209[.]44:7121/is-ready hxxp://155[.]94[.]209[.]44:7121/moz-sdk |
Houdini |
| URL | hxxp://195[.]74[.]86[.]227/lap[.]exe hxxp://195[.]74[.]86[.]227/video[.]exe hxxp://62[.]204[.]41[.]88/lend/svhost[.]exe |
Laplas |
| URL | hxxp://lazarovs[.]ga/PWS/fre[.]php | LokiBot |
| URL | hxxp://134[.]0[.]119[.]118/385111/setup[.]exe hxxp://194[.]110[.]203[.]101/puta/brazilx86[.]exe hxxps://nordic-food[.]ro/systems/ChromeSetup[.]exe |
PrivateLoader |
| URL | hxxps://kosmikband[.]com/wtrash/dfv[.]exe | PureCrypter |
| URL | hxxp://94[.]142[.]138[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://94[.]142[.]138[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://94[.]142[.]138[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://94[.]142[.]138[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://94[.]142[.]138[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://94[.]142[.]138[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://94[.]142[.]138[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxps://oiartzunirratia[.]eus/install/clean/Lcovlccdxd[.]exe hxxp://193[.]233[.]20[.]3/dell/franc[.]exe hxxp://193[.]233[.]20[.]3/dell/franc1[.]exe hxxp://193[.]233[.]49[.]109:7766/redof2401[.]exe hxxps://hgjjytjyuk[.]site/Cry[.]exe |
RedLine Stealer |
| URL | hxxp://212[.]193[.]30[.]4/293/vbc[.]exe | Remcos |
| URL | hxxp://amazingtodaynotsaidhimherwhathe[.]com/dope2[.]exe | Rhadamanthys |
| URL | hxxp://38[.]153[.]157[.]57/138/vbc[.]exe | Snake Keylogger |
| URL | hxxp://116[.]203[.]6[.]107/439 hxxp://135[.]181[.]41[.]147/562 hxxp://135[.]181[.]41[.]147/698 hxxp://65[.]109[.]168[.]191/19 hxxp://65[.]109[.]168[.]191/20 hxxp://65[.]109[.]168[.]191/408 hxxp://65[.]109[.]168[.]191/439 hxxp://65[.]109[.]168[.]191/890 hxxp://95[.]217[.]240[.]157/498 hxxp://95[.]217[.]240[.]157/562 |
Vidar |
