不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/02/06
※2023/02/06 更新
マルウェア感染させると考えられるURLを検知（2023/02/06）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://103[.]171[.]1[.]26/dashh/psftp[.]exe hxxps://fumigueg[.]tk/QptBamkr154[.]lpk |
Agent Tesla |
| URL | hxxp://193[.]233[.]20[.]3/nors/flow[.]exe hxxp://193[.]233[.]20[.]3/puta/rocku[.]exe hxxp://62[.]204[.]41[.]248/is/zhiga[.]exe hxxp://62[.]204[.]41[.]248/li/flow[.]exe hxxp://62[.]204[.]41[.]4/Gol478Ns/Plugins/clip64[.]dll hxxp://62[.]204[.]41[.]4/Gol478Ns/Plugins/cred64[.]dll hxxp://62[.]204[.]41[.]5/Bu58Ngs/Plugins/clip64[.]dll hxxp://62[.]204[.]41[.]5/Bu58Ngs/Plugins/cred64[.]dll hxxp://62[.]204[.]41[.]4/Gol478Ns/index[.]php hxxp://62[.]204[.]41[.]5/Bu58Ngs/index[.]php |
Amadey |
| URL | hxxp://detail-booking[.]com[.]br/127[.]0[.]0[.]1[.]htm hxxps://plazaboulevard[.]com[.]br/argentina[.]jpg hxxp://109[.]172[.]45[.]94/qyBZEkiQGTjr[.]exe |
AsyncRAT |
| URL | hxxp://185[.]225[.]74[.]3/x-8[.]6-[.]Fourloko hxxp://31[.]42[.]186[.]52/a-r[.]m-5[.]SNOOPY hxxp://31[.]42[.]186[.]52/a-r[.]m-6[.]SNOOPY hxxp://31[.]42[.]186[.]52/a-r[.]m-7[.]SNOOPY hxxp://31[.]42[.]186[.]52/i-5[.]8-6[.]SNOOPY hxxp://31[.]42[.]186[.]52/m-6[.]8-k[.]SNOOPY hxxp://31[.]42[.]186[.]52/m-i[.]p-s[.]SNOOPY hxxp://31[.]42[.]186[.]52/m-p[.]s-l[.]SNOOPY hxxp://31[.]42[.]186[.]52/s-h[.]4-[.]SNOOPY hxxp://31[.]42[.]186[.]52/x-3[.]2-[.]SNOOPY hxxp://31[.]42[.]186[.]52/x-8[.]6-[.]SNOOPY hxxp://45[.]9[.]148[.]154/586 hxxp://45[.]9[.]148[.]154/arm61 hxxp://45[.]9[.]148[.]154/co hxxp://45[.]9[.]148[.]154/dc hxxp://45[.]9[.]148[.]154/dss hxxp://45[.]9[.]148[.]154/i686 hxxp://45[.]9[.]148[.]154/m68k hxxp://45[.]9[.]148[.]154/mips hxxp://45[.]9[.]148[.]154/mipsel hxxp://45[.]9[.]148[.]154/ppc hxxp://45[.]9[.]148[.]154/sh4 |
Bashlite |
| URL | hxxp://81[.]69[.]4[.]32/en_US/all[.]js hxxp://107[.]174[.]27[.]242:5556/g[.]pixel hxxp://103[.]149[.]200[.]79:9530/ptj hxxp://103[.]149[.]200[.]79:9530/dpixel hxxp://120[.]77[.]18[.]249:55555/ptj hxxp://103[.]215[.]81[.]189:6688/fwlink hxxp://103[.]67[.]191[.]89:8080/updates[.]rss hxxp://103[.]87[.]240[.]167/ga[.]js hxxp://103[.]96[.]129[.]49/load hxxp://104[.]207[.]152[.]82:82/dpixel hxxp://106[.]75[.]227[.]134/search/ hxxp://107[.]151[.]203[.]95:20000/jquery-3[.]3[.]1[.]min[.]js hxxp://107[.]174[.]186[.]22:6666/load hxxp://108[.]163[.]207[.]38/ga[.]js hxxp://114[.]115[.]135[.]149:50050/cx hxxp://120[.]27[.]94[.]139:62080/activity hxxp://124[.]70[.]92[.]91/dpixel hxxp://139[.]177[.]146[.]20/en_US/all[.]js hxxp://141[.]98[.]10[.]124/updates[.]rss hxxp://154[.]204[.]43[.]31/dpixel hxxp://162[.]19[.]155[.]49:8008/updates[.]rss hxxp://176[.]124[.]211[.]37:8080/ptj hxxp://177[.]135[.]180[.]180/match hxxp://179[.]60[.]147[.]196/bm[.]html hxxp://199[.]195[.]251[.]23/j[.]ad hxxp://20[.]211[.]120[.]220/Upload/v9[.]6/NSUL07BW4V hxxp://209[.]141[.]36[.]163/css/jquery[.]min[.]js hxxp://212[.]118[.]39[.]116/ptj hxxp://216[.]127[.]164[.]252/g[.]pixel hxxp://23[.]105[.]214[.]171:8080/j[.]ad hxxp://23[.]234[.]41[.]225:8081/ga[.]js hxxp://23[.]234[.]41[.]225:81/fwlink hxxp://3[.]139[.]62[.]192/updates[.]rss hxxp://3[.]90[.]213[.]150/license/eula hxxp://34[.]197[.]227[.]138:8082/category/research-2/ hxxp://34[.]197[.]227[.]138:8083/discussion/ hxxp://34[.]197[.]227[.]138:8084/discussion/ hxxp://43[.]129[.]158[.]87:8082/fwlink hxxp://43[.]129[.]88[.]120:63011/Uploads/images/malleables/001[.]png hxxp://43[.]138[.]111[.]120:7788/IE9CompatViewList[.]xml hxxp://43[.]140[.]252[.]193/g[.]pixel hxxp://45[.]145[.]230[.]248:8090/visit[.]js hxxp://45[.]88[.]221[.]91:808/image/ hxxp://49[.]4[.]88[.]243/load hxxp://5[.]188[.]86[.]194:8088/dpixel hxxp://5[.]188[.]86[.]194:88/IE9CompatViewList[.]xml hxxp://69[.]176[.]94[.]39:6666/image/ hxxp://70[.]39[.]93[.]88/g[.]pixel hxxp://8[.]130[.]9[.]56/fwlink hxxp://81[.]69[.]4[.]32:80/en_US/all[.]js hxxp://82[.]157[.]63[.]28/ga[.]js hxxp://88[.]214[.]27[.]53:50001/push hxxp://89[.]188[.]222[.]22/match hxxp://91[.]213[.]50[.]75:8010/fwlink hxxp://appdevtechnology[.]com:801/massaction hxxp://aspnetcenter[.]com/da[.]html hxxp://thxx[.]link/pixel[.]gif hxxp://updatespiceworksservice[.]xyz/_/scs/mail-static/_/js/ hxxp://www[.]google-dns[.]cloud:2053/j[.]ad hxxps://10[.]104[.]128[.]97:4430/dot[.]gif hxxps://103[.]241[.]73[.]58/cx hxxps://107[.]173[.]111[.]16/ga[.]js hxxps://107[.]174[.]186[.]22:8091/g[.]pixel hxxps://107[.]174[.]186[.]22:8091/updates[.]rss hxxps://108[.]163[.]207[.]38/dpixel hxxps://13[.]48[.]54[.]61:4432/image/type/appimage[.]png hxxps://154[.]26[.]192[.]11/g[.]pixel hxxps://157[.]90[.]240[.]174:63443/updates[.]rss hxxps://175[.]178[.]40[.]166/ca hxxps://20[.]239[.]161[.]221/include/template/isx[.]php hxxps://23[.]94[.]255[.]18:4431/ikklmsubgfmsaswge/ hxxps://54[.]210[.]2[.]63/updates/ hxxps://54[.]237[.]85[.]77:8888/cm hxxps://88[.]119[.]161[.]139/dot[.]gif hxxps://91[.]215[.]85[.]143/jquery-3[.]3[.]1[.]min[.]js hxxps://aspnetcenter[.]com/ch hxxps://cs45[.]meiiqia[.]com/www/handle/doc hxxps://dns-google[.]net:2096/push hxxps://dns-google[.]net:8443/updates[.]rss hxxps://easy-dns[.]lol:2083/cx hxxps://f495b6ab9dcf8d3b[.]info:2083/j[.]ad hxxps://getsafeblog[.]com/c/msdownload/update/others/2020/10/29136388_ hxxps://hayneselden[.]com/match hxxps://nxsimdevelop[.]com/cs[.]js hxxps://playfish[.]fun:6001/visit[.]js hxxps://www[.]microsofe[.]xyz:8443/en_US/all[.]js |
Cobalt Strike |
| URL | hxxp://185[.]215[.]113[.]66/pei[.]exe hxxp://twizt[.]org/newtpp[.]exe |
Coinminer |
| URL | hxxp://104[.]234[.]118[.]34/13333[.]exe hxxp://5[.]252[.]178[.]60/Aurora[.]exe |
DanaBot |
| URL | hxxp://109[.]172[.]44[.]182/javascriptlongpoll/CdncentralEternal0/Mariadb2/3BigloadDownloads/70Update8/Process3/JavascriptCdn7Protect/Low/UpdateDatalifecentral[.]php hxxp://178[.]250[.]158[.]55/Temp52Linux/8/temp/SecurewpToprocessor/Publiclinux/1LineDefault/Packet/Image/2process/hxxpGeoBettercdn/processJs/1/SqlPython/wp2Public/asyncVmBigload/providerphpAuth[.]php hxxp://178[.]250[.]159[.]206/externalimagePythonApi[.]php hxxp://188[.]120[.]225[.]216/testimageDefaultexternal/DbGeneratorWordpress2/5line/5asyncLocalPrivate/AsyncasyncFlower/RequestGame[.]php hxxp://195[.]133[.]75[.]27/Cpu4testgeo/sqlLinux/toJsVm/dlewordpressDownloadsCentral/2pythonProvider8/downloads7/eternalBigloadwp[.]php hxxp://62[.]109[.]9[.]201/3dev/externallinePolldefaultTest[.]php hxxp://77[.]55[.]208[.]121/static/Private/Api/Images/ProvidereternalbigloadTracktemp[.]php |
DCRat |
| URL | hxxps://ingramjapan[.]com/h9XwHYQu/ | Emotet |
| URL | hxxps://2f24d[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://61ed2[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://94786[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://f069f[.]signing[.]unitynotarypublic[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://107[.]189[.]5[.]161/Loader[.]exe hxxp://38[.]153[.]157[.]57/76/vbc[.]exe |
Formbook |
| URL | hxxps://n8w5[.]c12[.]e2-1[.]dev/oulalaa/test3[.]exe | GCleaner |
| URL | hxxp://176[.]113[.]115[.]177/stilak32[.]rar hxxp://176[.]113[.]115[.]177/stilak64[.]rar hxxp://45[.]11[.]182[.]208/microsoft32[.]zip hxxp://45[.]11[.]182[.]208/microsoft64[.]zip |
Gozi |
| URL | hxxp://helthbrotthersg[.]com/view[.]png | IcedID |
| URL | hxxp://62[.]204[.]41[.]88/lend/redline100[.]exe | Laplas |
| URL | hxxp://rhinestone[.]cc/obino/Panel/five/fre[.]php | LokiBot |
| URL | hxxp://120[.]77[.]18[.]249:55555/UrHM | Metasploit |
| URL | hxxp://115[.]203[.]199[.]60:54697/Mozi[.]m hxxp://115[.]55[.]145[.]63:56357/Mozi[.]m hxxp://117[.]221[.]185[.]91:43785/Mozi[.]m hxxp://117[.]223[.]93[.]27:36253/Mozi[.]m hxxp://202[.]164[.]138[.]197:59577/Mozi[.]m |
Mozi |
| URL | hxxp://lojalstil[.]mk/img/dataimage/gate[.]php hxxp://jp[.]nurtureassociates[.]com/gate[.]php hxxp://cmp[.]com[.]sg/signal/Deffult/gate[.]php |
Pony |
| URL | hxxps://studio3d[.]med[.]ec/TyrlNickh58765421[.]exe | PrivateLoader |
| URL | hxxps://kosmikband[.]com/wtrash/Ygezyi[.]dat hxxp://109[.]172[.]45[.]94/lloaded[.]exe hxxp://3[.]73[.]132[.]53/hz/RFQ_500019433[.]exe |
PureCrypter |
| URL | hxxp://128[.]254[.]207[.]55/vodka[.]dat hxxp://135[.]148[.]144[.]191/vodka[.]dat hxxp://216[.]238[.]76[.]210/vodka[.]dat hxxp://45[.]8[.]191[.]141/vodka[.]dat hxxp://49[.]50[.]84[.]121/71446[.]dat hxxp://79[.]141[.]175[.]208/vodka[.]dat hxxp://87[.]236[.]146[.]112/58329[.]dat hxxps://aixjobsonline[.]net/SFAF[.]php? hxxps://beatup[.]cl/BSIU[.]php? hxxps://boosterfollow[.]com/cS0P74/r[.]png hxxps://chrono-actu[.]com/IASD[.]php? hxxps://ecompany[.]pk/DS[.]php? hxxps://esgiot[.]net/TRN[.]php? hxxps://floridasforgottenfelines[.]org/SII[.]php? hxxps://fudgeys[.]co[.]uk/SR[.]php? hxxps://infrastructure[.]co[.]ug/ELL[.]php? hxxps://israrmarblegranite[.]com/PE[.]php? hxxps://key4academy[.]com/d3sQ3Vz/r[.]png hxxps://koksoftec[.]com/RIQE[.]php? hxxps://pcrog[.]com/TMXI[.]php? hxxps://windsonstaffing[.]com/ULBA[.]php? |
QakBot |
| URL | hxxp://167[.]235[.]233[.]181/8f7f1cf66c99967f3018db2fa4dee31c hxxp://167[.]235[.]233[.]181/aa2d251efa3bd198256931af239d46aa hxxp://167[.]235[.]233[.]181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://167[.]235[.]233[.]181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://167[.]235[.]233[.]181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://167[.]235[.]233[.]181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://167[.]235[.]233[.]181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://167[.]235[.]233[.]181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://167[.]235[.]233[.]181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://78[.]153[.]130[.]132/835ea0bec009a23c4ad1ac4ac9acbcc2 hxxp://78[.]153[.]130[.]132/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://78[.]153[.]130[.]132/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://78[.]153[.]130[.]132/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://78[.]153[.]130[.]132/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://78[.]153[.]130[.]132/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://78[.]153[.]130[.]132/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://78[.]153[.]130[.]132/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://83[.]217[.]11[.]26/209137feb6ef98a1132600a48276981e hxxp://83[.]217[.]11[.]26/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://83[.]217[.]11[.]26/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://83[.]217[.]11[.]26/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://83[.]217[.]11[.]26/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://83[.]217[.]11[.]26/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://83[.]217[.]11[.]26/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://83[.]217[.]11[.]26/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://91[.]215[.]85[.]146/7add1bf8cb1967ef3a3ca10965c36f6a hxxp://94[.]142[.]138[.]9/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://94[.]142[.]138[.]9/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://94[.]142[.]138[.]9/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://94[.]142[.]138[.]9/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://94[.]142[.]138[.]9/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://94[.]142[.]138[.]9/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://94[.]142[.]138[.]9/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://94[.]142[.]138[.]9/b226e5918e73ba220f11ad9a66d16218 hxxp://94[.]142[.]138[.]9/bdca9759e0627ea791c83e5df8e58874 hxxp://94[.]142[.]138[.]9/d5dc166b994a47ecd983f1758af6da99 |
Raccoon |
| URL | hxxp://193[.]233[.]20[.]3/buba/repa[.]exe hxxp://62[.]204[.]41[.]88/lend/meta4[.]exe hxxps://dupont-ingredient[.]ro/systems/ChromeSetup[.]exe hxxps://nordic-food[.]ro/systems/tmp/ChromeSetup[.]exe hxxps://www[.]brancatosnc[.]it/test[.]exe hxxps://ytjyjyjyf[.]site/Ombus[.]exe |
RedLine Stealer |
| URL | hxxp://212[.]193[.]30[.]4/255/vbc[.]exe hxxp://62[.]204[.]41[.]88/lend/redline5[.]exe |
Remcos |
| URL | hxxp://104[.]234[.]118[.]34/ippinstaller[.]exe hxxp://62[.]204[.]41[.]88/lend/meta6[.]exe |
Rhadamanthys |
| URL | hxxp://109[.]172[.]45[.]132/s[.]exe hxxp://62[.]204[.]41[.]88/lend/meta5[.]exe |
SmokeLoader |
| URL | hxxp://3[.]73[.]132[.]53/hz/Etolfsojm[.]exe | Snake Keylogger |
| URL | hxxp://bihsy[.]com/lancer/get[.]php | STOP |
| URL | hxxp://116[.]202[.]181[.]160/15 hxxp://116[.]203[.]6[.]107/15 hxxp://116[.]203[.]6[.]107/498 hxxp://116[.]203[.]6[.]107/562 hxxp://116[.]203[.]6[.]107/589 hxxp://116[.]203[.]6[.]107/862 hxxp://135[.]181[.]41[.]147/824 hxxp://65[.]109[.]136[.]136/255 hxxp://65[.]109[.]136[.]136/258 hxxp://65[.]109[.]136[.]136/408 hxxp://65[.]109[.]136[.]136/498 hxxp://65[.]109[.]136[.]136/562 hxxp://65[.]109[.]136[.]136/812 hxxp://65[.]109[.]7[.]48/19 hxxp://65[.]109[.]7[.]48/255 hxxp://65[.]109[.]7[.]48/408 hxxp://65[.]109[.]7[.]48/498 hxxp://65[.]109[.]7[.]48/562 hxxp://65[.]109[.]7[.]48/635 hxxp://65[.]109[.]7[.]48/736 hxxp://65[.]109[.]7[.]48/813 hxxp://65[.]109[.]7[.]48/831 hxxp://65[.]109[.]7[.]48/865 hxxp://65[.]109[.]7[.]48/881 hxxp://65[.]109[.]7[.]48/887 hxxp://65[.]109[.]7[.]48/888 hxxp://65[.]109[.]7[.]48/889 hxxp://88[.]198[.]95[.]89/15 hxxp://95[.]217[.]240[.]133/255 hxxp://95[.]217[.]240[.]133/408 hxxp://95[.]217[.]240[.]133/831 hxxp://95[.]217[.]240[.]133/892 |
Vidar |
| URL | hxxp://37[.]0[.]14[.]210:8483/Vre | Vjw0rm |
| URL | hxxp://nicoslag[.]ru/asdfg[.]exe | XMRig |
