不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/02/09
※2023/02/09 更新
マルウェア感染させると考えられるURLを検知（2023/02/09）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://104[.]168[.]45[.]119/me[.]exe hxxp://84[.]21[.]172[.]55/bl[.]exe hxxps://emailhosts[.]shop/files/kroxxpop[.]exe hxxps://emailhosts[.]shop/files/maya[.]exe |
Agent Tesla |
| URL | hxxp://62[.]204[.]41[.]251/mi/lenta[.]exe | Amadey |
| URL | hxxps://fintran[.]site/cr/any[.]exe hxxps://www[.]fintran[.]site/fl/968 |
AsyncRAT |
| URL | hxxp://167[.]172[.]89[.]28/zehir/z3hir[.]arm7 | Bashlite |
| URL | hxxp://jlmusiklearn[.]com/est/api[.]php hxxp://rxnovelapps[.]info/pikachu/vis[.]php |
Bitter RAT |
| URL | hxxp://megookbpnq[.]cf/Uninter[.]thn hxxp://megookbpnq[.]cf/cva[.]jpb |
CloudEyE |
| URL | hxxp://thefirstupd[.]com:443/jquery-3[.]3[.]1[.]min[.]js hxxp://106[.]75[.]85[.]32:443/en_US/all[.]js hxxp://100[.]42[.]70[.]27:234/cx hxxp://101[.]43[.]122[.]222/push hxxp://107[.]172[.]208[.]88/ca hxxp://108[.]165[.]178[.]42/push hxxp://116[.]62[.]168[.]211/cm hxxp://124[.]223[.]173[.]83/en_US/all[.]js hxxp://124[.]223[.]22[.]86/dot[.]gif hxxp://143[.]42[.]19[.]99/j[.]ad hxxp://163[.]197[.]211[.]154/cm hxxp://172[.]81[.]62[.]92/owa/ hxxp://47[.]90[.]244[.]75/dot[.]gif hxxp://war3[.]u2pic[.]us:666/fwlink hxxps://107[.]172[.]208[.]88/ga[.]js hxxps://159[.]253[.]120[.]205:8443/espoint hxxps://213[.]252[.]246[.]35/ptj hxxps://37[.]220[.]87[.]31/en_US/all[.]js hxxps://43[.]156[.]34[.]251:42424/api/QueryUsersInfo hxxps://didimutele[.]com/trouble[.]webm hxxps://lelele[.]barycallebaut[.]co/jquery-3[.]3[.]1[.]min[.]js hxxps://microsoft-edu[.]com/espoint hxxps://pj[.]flyvpncrack[.]com/ca |
Cobalt Strike |
| URL | hxxp://151[.]248[.]117[.]210/8api/windows3vmlow/ProviderPython[.]php hxxp://92[.]63[.]96[.]83/ProviderPythonJavascriptbasetest[.]php |
DCRat |
| URL | hxxps://18ef8[.]samples[.]muzikcitysound[.]com/subscribeEvent hxxps://3d378[.]samples[.]muzikcitysound[.]com/subscribeEvent hxxps://433de[.]samples[.]muzikcitysound[.]com/subscribeEvent hxxps://4bb4b[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://acdcb[.]samples[.]muzikcitysound[.]com/subscribeEvent hxxps://ed798[.]samples[.]muzikcitysound[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://103[.]232[.]54[.]88/office365/vbc[.]exe hxxp://104[.]168[.]46[.]125/file/hjf[.]exe |
Formbook |
| URL | hxxp://62[.]204[.]41[.]88/lend/6456547_2023-02-05_15-22[.]exe | Laplas |
| URL | hxxp://171[.]22[.]30[.]164/kung/five/fre[.]php hxxp://hghfe[.]tk/Sameed/PWS/fre[.]php hxxp://103[.]167[.]85[.]37/kung/GG18[.]exe hxxp://192[.]3[.]223[.]114/478/vbc[.]exe hxxp://192[.]3[.]223[.]114/78[.]doc hxxp://202[.]55[.]134[.]52/office365/smss[.]exe hxxp://202[.]55[.]135[.]112/office365/csrss[.]exe hxxp://84[.]38[.]134[.]58/275/vbc[.]exe |
LokiBot |
| URL | hxxps://aradcapital[.]com/MpD8Yk/00[.]gif hxxps://laoitserv[.]com/Vos/00[.]gif hxxps://vielagroglobal[.]com/Yto/00[.]gif |
Matanbuchus |
| URL | hxxp://34[.]29[.]127[.]135/EMKT_CURSO_775-5693/47940[.]024663/ hxxp://35[.]226[.]160[.]162/EMKT_CURSO_775-5693/47940[.]024663/ |
Mekotio |
| URL | hxxp://123[.]4[.]168[.]212:55145/Mozi[.]m | Mozi |
| URL | hxxp://www[.]ingetic[.]cl/wp-content/themes/seotheme/neovolt2[.]1[.]exe | Nanocore RAT |
| URL | hxxp://seolinkmarket[.]com/idx[.]php hxxp://liststitch[.]com/link[.]php hxxp://closedir[.]com/hotlink/img[.]php hxxp://closedir[.]com/hotlink/pics[.]php |
Pony |
| URL | hxxp://146[.]59[.]43[.]159/vodka[.]dat hxxp://154[.]7[.]253[.]191/vodka[.]dat hxxp://174[.]139[.]150[.]45/vodka[.]dat hxxp://185[.]231[.]204[.]245/vodka[.]dat hxxp://213[.]169[.]148[.]78/vodka[.]dat hxxp://216[.]120[.]201[.]100/vodka[.]dat hxxp://45[.]77[.]63[.]210/vodka[.]dat hxxp://45[.]86[.]231[.]23/vodka[.]dat hxxp://5[.]42[.]221[.]117/vodka[.]dat hxxp://85[.]239[.]41[.]55/vodka[.]dat hxxp://87[.]236[.]146[.]155/vodka[.]dat hxxp://87[.]236[.]146[.]31/vodka[.]dat hxxp://98[.]142[.]254[.]89/vodka[.]dat hxxps://famille2point0[.]com/oghHO/01[.]png hxxps://ozcontests[.]com/tE3xt/01[.]png hxxps://qualityrepairatdoor[.]com/lmSQNui/01[.]png hxxps://sahifatinews[.]com/jZbaw/01[.]png hxxps://shifa365[.]com/hgxU5/01[.]gif hxxps://starcomputadoras[.]com/lt2eLM6/01[.]gif hxxps://thetwindollar[.]com/L7PJjN/01[.]png hxxps://jewishlabourbundarchive[.]net/zdtK9c/01[.]gif |
QakBot |
| URL | hxxp://167[.]235[.]69[.]31/client-umciavi64[.]exe | Raccoon |
| URL | hxxp://79[.]137[.]248[.]136/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://79[.]137[.]248[.]136/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://79[.]137[.]248[.]136/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://79[.]137[.]248[.]136/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://79[.]137[.]248[.]136/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://79[.]137[.]248[.]136/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://79[.]137[.]248[.]136/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://109[.]206[.]240[.]64/WSS[.]exe | Remcos |
| URL | hxxp://80[.]85[.]241[.]98/s[.]exe | SmokeLoader |
| URL | hxxp://192[.]3[.]193[.]148/112/vbc[.]exe hxxp://38[.]153[.]157[.]57/214/vbc[.]exe |
Snake Keylogger |
| URL | hxxp://65[.]109[.]168[.]175/19 hxxp://65[.]109[.]168[.]175/255 hxxp://94[.]130[.]75[.]1/408 |
Vidar |
| URL | hxxp://209[.]127[.]19[.]155:5870/Vre | Vjw0rm |
