不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/02/14
※2023/02/14 更新
マルウェア感染させると考えられるURLを検知（2023/02/14）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://megookbpnq[.]cf/jernha[.]dsp hxxp://megookbpnq[.]cf/sun[.]pfb hxxp://superbtanzaniasafaris[.]com/wiz/note[.]exe hxxps://genesisffastmeal[.]com[.]ng/plane/QEY7SJavDxp6dIT[.]exe hxxp://catknock[.]com//inc/2455818bc570ff[.]php hxxp://dropbuyinc[.]ga/aust/inc/289191b0208dd6[.]php |
Agent Tesla |
| URL | hxxp://176[.]113[.]115[.]176/pi/cent[.]exe hxxp://77[.]73[.]134[.]66/0bjdn2Z/index[.]php |
Amadey |
| URL | hxxps://app-bluedogpayements[.]com/downloads/install[.]exe | Aurora |
| URL | hxxps://betterwithvytro[.]com/?gclid=EAIaIQobChMIyamR3dqS_QIVGvvICh1IGQuOEAAYASAAEgL9tfD_BwE hxxps://download-soft[.]software/CPU-Z_IIS[.]msi hxxps://fllqq[.]us/AdobePDF[.]msi hxxps://fllqq[.]us/LibreOfficeSetup[.]msi hxxps://lidrueowfice[.]us/?__sid=c710828f-6e5b-4e00-bb37-8a1829883831 |
BATLOADER |
| URL | hxxps://euro-test[.]ro/loads/MqzhYy155[.]deploy | CloudEyE |
| URL | hxxp://45[.]77[.]174[.]98:50053/IE9CompatViewList[.]xml hxxp://0xx1[.]kaspenskyupdates[.]com/css/jquery[.]min[.]js hxxp://101[.]42[.]89[.]186:8888/ptj hxxp://101[.]43[.]198[.]94/dpixel hxxp://103[.]96[.]129[.]49/dot[.]gif hxxp://104[.]237[.]149[.]115:8082/hubcap/mayo-clinic-radio-full-shows/ hxxp://104[.]237[.]149[.]115:8088/discussion/ hxxp://106[.]52[.]163[.]222:30003/pixel[.]gif hxxp://107[.]174[.]186[.]22:6666/g[.]pixel hxxp://109[.]172[.]45[.]85:801/na hxxp://116[.]205[.]178[.]32:8899/j[.]ad hxxp://116[.]205[.]178[.]32:9999/ptj hxxp://118[.]194[.]252[.]253:9000/en_US/all[.]js hxxp://119[.]91[.]148[.]9/en_US/all[.]js hxxp://120[.]76[.]205[.]155:8090/fwlink hxxp://121[.]4[.]138[.]158:3535/submit[.]php hxxp://121[.]4[.]138[.]158:3535/visit[.]js hxxp://121[.]4[.]154[.]240:4000/cx hxxp://121[.]4[.]88[.]169:6699/api/x hxxp://124[.]220[.]198[.]212/ca hxxp://124[.]70[.]92[.]91/dot[.]gif hxxp://128[.]199[.]60[.]130/load hxxp://139[.]177[.]146[.]20/cm hxxp://139[.]9[.]5[.]151/pixel[.]gif hxxp://140[.]143[.]232[.]178:8089/visit[.]js hxxp://146[.]19[.]173[.]90/demo/v7[.]71/CMVGA1F7NM hxxp://146[.]19[.]173[.]90/Fabricate/safety/DV1BCN05J9G hxxp://147[.]78[.]47[.]141/lu hxxp://150[.]158[.]160[.]247:9588/pixel hxxp://152[.]136[.]104[.]49:8080/admin/login hxxp://152[.]136[.]227[.]216:65432/ptj hxxp://152[.]136[.]227[.]216:6767/push hxxp://154[.]7[.]179[.]245/dot[.]gif hxxp://162[.]241[.]115[.]71/c/msdownload/update/others/2021/10/WrMpi6zkKnH6tSdDsbNimX hxxp://164[.]92[.]138[.]223:8888/fwlink hxxp://179[.]43[.]175[.]220/_/scs/mail-static/_/js/ hxxp://185[.]246[.]221[.]128:886/activity hxxp://185[.]254[.]37[.]251/jquery-3[.]3[.]1[.]min[.]js hxxp://192[.]211[.]55[.]118:82/__utm[.]gif hxxp://194[.]87[.]46[.]87/j[.]ad hxxp://198[.]148[.]104[.]213:40000/visit[.]js hxxp://198[.]251[.]68[.]79/activity hxxp://212[.]193[.]30[.]15:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://27[.]124[.]40[.]214/ca hxxp://31[.]44[.]184[.]232/ca hxxp://37[.]220[.]87[.]31/IE9CompatViewList[.]xml hxxp://39[.]106[.]45[.]206:8090/ga[.]js hxxp://42[.]193[.]154[.]14:8001/cm hxxp://43[.]138[.]236[.]103:7900/g[.]pixel hxxp://43[.]138[.]251[.]32:1234/IE9CompatViewList[.]xml hxxp://45[.]207[.]58[.]57:2090/load hxxp://45[.]63[.]26[.]240:888/fwlink hxxp://45[.]77[.]117[.]28/cx hxxp://45[.]77[.]117[.]28/dot[.]gif hxxp://47[.]52[.]58[.]121:4545/ptj hxxp://47[.]92[.]122[.]146/www/handle/doc hxxp://47[.]93[.]9[.]242:82/cx hxxp://49[.]233[.]58[.]245:8870/3eA7pjq7AhiYm3zIwY5K/ll_3107lfa[.]js hxxp://65[.]109[.]1[.]49/ptj hxxp://70[.]39[.]93[.]88/dot[.]gif hxxp://70[.]39[.]93[.]88/updates[.]rss hxxp://8[.]142[.]134[.]43:8080/match hxxp://8[.]214[.]23[.]44:8080/ptj hxxp://82[.]156[.]166[.]154:7777/ca hxxp://88[.]214[.]27[.]53:31017/fwlink hxxp://88[.]214[.]27[.]53:50003/cx hxxp://92[.]222[.]172[.]39/push hxxp://92[.]222[.]172[.]39:53/load hxxp://allowedcloud[.]com/profile hxxp://cdn2[.]whereismyip[.]cf:2086/IE9CompatViewList[.]xml hxxp://dobbyisfreeeee[.]com:8080/change hxxp://freetest[.]free[.]idcfengye[.]com/ga[.]js hxxp://rewelab[.]de/conf hxxp://sermifleksiks[.]com:8080/tab_home_active[.]js hxxp://sso[.]sermifleksiks[.]com:8080/tab_home_active[.]js hxxp://war3[.]u2pic[.]us:666/push hxxp://www[.]jquery-cdn[.]cf:8119/en_US/all[.]js hxxp://www[.]sermifleksiks[.]com:8080/tab_home_active[.]js hxxps://0xx1[.]kaspenskyupdates[.]com/css/jquery[.]min[.]js hxxps://1[.]15[.]35[.]104:4445/IE9CompatViewList[.]xml hxxps://104[.]21[.]83[.]106:2083/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://107[.]174[.]186[.]22:8091/__utm[.]gif hxxps://108[.]62[.]118[.]131/Forge/logs/2WP2X20YGPOI hxxps://119[.]45[.]26[.]174:8877/cx hxxps://119[.]91[.]148[.]9/updates[.]rss hxxps://124[.]223[.]173[.]83/activity hxxps://13[.]115[.]21[.]133:448/www/handle/doc hxxps://138[.]197[.]148[.]29:4433/ptj hxxps://139[.]224[.]207[.]208:54443/ptj hxxps://149[.]28[.]129[.]0:2443/ca hxxps://150[.]158[.]152[.]94:30001/cx hxxps://157[.]245[.]105[.]72/messages/q2LfudjiIKIylE8FJEK8JCDrP hxxps://172[.]67[.]223[.]72:2083/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://175[.]178[.]219[.]118:6781/fwlink hxxps://180[.]76[.]154[.]33/load hxxps://182[.]92[.]67[.]97:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://185[.]25[.]119[.]26/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://185[.]254[.]37[.]251/jquery-3[.]3[.]1[.]min[.]js hxxps://188[.]131[.]211[.]152/ca hxxps://194[.]165[.]16[.]60/cx hxxps://198[.]52[.]127[.]146:21989/pixel hxxps://216[.]146[.]25[.]20/updates[.]rss hxxps://23[.]227[.]198[.]246/ce[.]js hxxps://23[.]95[.]67[.]59:8443/ga[.]js hxxps://27[.]124[.]40[.]214/cx hxxps://37[.]220[.]87[.]31/match hxxps://43[.]138[.]68[.]47:8888/g[.]pixel hxxps://45[.]207[.]58[.]57:2080/j[.]ad hxxps://47[.]103[.]36[.]44:8443/pixel hxxps://47[.]240[.]102[.]1:6781/dot[.]gif hxxps://54[.]191[.]108[.]236/cm hxxps://84[.]32[.]131[.]91/br[.]html hxxps://bonsars[.]com/accept hxxps://cdn[.]teucent[.]com/g[.]pixel hxxps://cdn[.]whereismyip[.]cf/IE9CompatViewList[.]xml hxxps://chinamobile[.]space:8443/api/x hxxps://pj[.]flyvpncrack[.]com/maps/overlaybfpr hxxps://player[.]hkdd[.]me/api/3 hxxps://talulime[.]com/Forge/logs/2WP2X20YGPOI hxxps://www[.]edge-chrome[.]com:8443/link[.]html |
Cobalt Strike |
| URL | hxxp://194[.]4[.]49[.]243/gate[.]php | Colibri Loader |
| URL | hxxp://172[.]104[.]4[.]99/_Defaultwindows[.]php hxxp://194[.]87[.]186[.]10/linuxLinuxphp/cdnLine7Windows/externallocaltempProcess/Flower4Linux/dbToDump1/MariadbMultiImage/Wordpressimageexternal/Temporary/better/Linelinux/db/0public/sql/1PrivatePrivate/sql6/protecttemporaryCpu/requestPoll[.]php |
DCRat |
| URL | hxxps://9129d[.]distributor[.]techsavvyauto[.]com/subscribeEvent hxxps://9f4a6[.]distributor[.]techsavvyauto[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://www[.]ingetic[.]cl/wp-content/themes/seotheme/fransh2[.]1[.]exe | Formbook |
| URL | hxxps://powerz[.]co/upload/Payment%20Confirmation[.]zip | Kutaki |
| URL | hxxp://192[.]210[.]175[.]18/1712/vbc[.]exe hxxp://jsw[.]co[.]id/system1/qqqqq[.]exe |
LokiBot |
| URL | hxxp://45[.]77[.]174[.]98:50053/OTvC | Metasploit |
| URL | hxxp://27[.]43[.]101[.]36:34140/Mozi[.]m | Mozi |
| URL | hxxp://hotelexcelsior[.]com[.]np/cli/panelnew/gate[.]php | Pony |
| URL | hxxps://casualscollection[.]com/l2iy4Dn/09[.]gif hxxps://gulailstudio[.]com/mq3HCa7/09[.]gif hxxps://microbraintechnology[.]com/p2Egzpf/09[.]gif hxxps://softozen[.]net/SzU86f6/09[.]gif hxxps://yathratours[.]com/38lz/09[.]gif |
QakBot |
| URL | hxxp://206[.]166[.]251[.]230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://206[.]166[.]251[.]230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://206[.]166[.]251[.]230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://206[.]166[.]251[.]230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://206[.]166[.]251[.]230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://206[.]166[.]251[.]230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://206[.]166[.]251[.]230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://65[.]109[.]165[.]65/wlidfdp[.]exe hxxp://95[.]216[.]143[.]153/wlidfdp[.]exe |
RedLine Stealer |
| URL | hxxp://198[.]46[.]174[.]165/297/vbc[.]exe hxxp://cardiozono[.]com/wp-admin/images/Jmtbiyyp[.]png hxxps://chegaacores[.]com/systems/ChromeSetup[.]exe hxxps://flytourchip[.]com[.]br/systems/ChromeSetup[.]exe hxxps://odontografica[.]com[.]br/systems/ChromeSetup[.]exe |
SmokeLoader |
| URL | hxxp://23[.]94[.]99[.]117/5428/vbc[.]exe hxxp://38[.]153[.]157[.]57/412/vbc[.]exe |
Snake Keylogger |
| URL | hxxp://bihsy[.]com/test2/get[.]php | STOP |
| URL | hxxp://116[.]202[.]30[.]165/19 hxxp://195[.]201[.]44[.]125/683 hxxp://195[.]201[.]44[.]125/907 hxxp://23[.]88[.]36[.]149/255 hxxp://23[.]88[.]36[.]149/408 hxxp://23[.]88[.]36[.]149/546 hxxp://23[.]88[.]36[.]149/589 hxxp://23[.]88[.]36[.]149/645 hxxp://23[.]88[.]36[.]149/670 hxxp://23[.]88[.]36[.]149/683 hxxp://23[.]88[.]36[.]149/698 hxxp://23[.]88[.]36[.]149/713 hxxp://23[.]88[.]36[.]149/888 hxxp://23[.]88[.]36[.]149/897 hxxp://23[.]88[.]36[.]149/901 hxxp://23[.]88[.]36[.]149/902 hxxp://23[.]88[.]36[.]149/903 hxxp://23[.]88[.]36[.]149/907 hxxp://23[.]88[.]36[.]149/911 hxxp://23[.]88[.]36[.]149/912 |
Vidar |
