不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/02/15
※2023/02/15 更新
マルウェア感染させると考えられるURLを検知（2023/02/15）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://107[.]175[.]202[.]151/3243/vbc[.]exe hxxp://23[.]95[.]122[.]244/60/aet[.]exe |
Agent Tesla |
| URL | hxxp://62[.]204[.]41[.]245/lebro[.]exe hxxp://77[.]73[.]134[.]66/0bjdn2Z/Plugins/clip64[.]dll hxxp://77[.]73[.]134[.]66/0bjdn2Z/Plugins/cred64[.]dll |
Amadey |
| URL | hxxp://107[.]173[.]80[.]75/nb/VwWBl[.]exe | Ave Maria |
| URL | hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]arm4 hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]arm5 hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]arm6 hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]arm7 hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]mips hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]mpsl hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]ppc hxxp://107[.]189[.]7[.]202/fuckjewishpeople[.]sparc hxxp://136[.]175[.]200[.]55/networkrip[.]arm4 hxxp://136[.]175[.]200[.]55/networkrip[.]arm5 hxxp://136[.]175[.]200[.]55/networkrip[.]arm6 hxxp://136[.]175[.]200[.]55/networkrip[.]armv7l hxxp://136[.]175[.]200[.]55/networkrip[.]mips hxxp://136[.]175[.]200[.]55/networkrip[.]mpsl hxxp://136[.]175[.]200[.]55/networkrip[.]ppc hxxp://136[.]175[.]200[.]55/networkrip[.]sparc hxxp://185[.]225[.]73[.]197/arm5 hxxp://185[.]225[.]73[.]197/arm7 hxxp://185[.]225[.]73[.]197/m68k hxxp://185[.]225[.]73[.]197/mips hxxp://185[.]246[.]220[.]200/kray[.]arm4 hxxp://185[.]246[.]220[.]200/kray[.]arm5 hxxp://185[.]246[.]220[.]200/kray[.]arm6 hxxp://185[.]246[.]220[.]200/kray[.]armv7l hxxp://185[.]246[.]220[.]200/kray[.]mips hxxp://185[.]246[.]220[.]200/kray[.]mpsl hxxp://185[.]246[.]220[.]200/kray[.]ppc hxxp://185[.]246[.]220[.]200/kray[.]sparc hxxp://209[.]141[.]37[.]70/Demon[.]arm4 hxxp://209[.]141[.]37[.]70/Demon[.]arm5 hxxp://209[.]141[.]37[.]70/Demon[.]arm6 hxxp://209[.]141[.]37[.]70/Demon[.]arm7 hxxp://209[.]141[.]37[.]70/Demon[.]i586 hxxp://209[.]141[.]37[.]70/Demon[.]i686 hxxp://209[.]141[.]37[.]70/Demon[.]m68k hxxp://209[.]141[.]37[.]70/Demon[.]mips hxxp://209[.]141[.]37[.]70/Demon[.]mpsl hxxp://209[.]141[.]37[.]70/Demon[.]ppc hxxp://209[.]141[.]37[.]70/Demon[.]sh4 hxxp://209[.]141[.]37[.]70/Demon[.]sparc hxxp://23[.]147[.]230[.]11/armv4 hxxp://23[.]147[.]230[.]11/armv5 hxxp://23[.]147[.]230[.]11/armv6 hxxp://23[.]147[.]230[.]11/i586 hxxp://23[.]147[.]230[.]11/i686 hxxp://23[.]147[.]230[.]11/m86k hxxp://23[.]147[.]230[.]11/mips hxxp://23[.]147[.]230[.]11/mipsel hxxp://23[.]147[.]230[.]11/powerpc hxxp://23[.]147[.]230[.]11/sh4 hxxp://23[.]147[.]230[.]11/sparc hxxp://37[.]44[.]238[.]192/Demon[.]arm4 hxxp://37[.]44[.]238[.]192/Demon[.]arm5 hxxp://37[.]44[.]238[.]192/Demon[.]arm6 hxxp://37[.]44[.]238[.]192/Demon[.]arm7 hxxp://37[.]44[.]238[.]192/Demon[.]i586 hxxp://37[.]44[.]238[.]192/Demon[.]i686 hxxp://37[.]44[.]238[.]192/Demon[.]m68k hxxp://37[.]44[.]238[.]192/Demon[.]mips hxxp://37[.]44[.]238[.]192/Demon[.]mpsl hxxp://37[.]44[.]238[.]192/Demon[.]ppc hxxp://37[.]44[.]238[.]192/Demon[.]sh4 hxxp://37[.]44[.]238[.]192/Demon[.]sparc hxxp://37[.]49[.]229[.]52/Pandora[.]arm4 hxxp://37[.]49[.]229[.]52/Pandora[.]arm6 hxxp://37[.]49[.]229[.]52/Pandora[.]arm7 hxxp://37[.]49[.]229[.]52/Pandora[.]i586 hxxp://37[.]49[.]229[.]52/Pandora[.]mips hxxp://37[.]49[.]229[.]52/Pandora[.]mpsl hxxp://37[.]49[.]229[.]52/Pandora[.]sh4 hxxp://5[.]181[.]80[.]18/apache2 hxxp://5[.]181[.]80[.]18/cron hxxp://5[.]181[.]80[.]18/ftp hxxp://5[.]181[.]80[.]18/ntpd hxxp://5[.]181[.]80[.]18/openssh hxxp://5[.]181[.]80[.]18/pftp hxxp://5[.]181[.]80[.]18/sh hxxp://5[.]181[.]80[.]18/sshd hxxp://5[.]181[.]80[.]18/tftp hxxp://5[.]181[.]80[.]18/wget |
Bashlite |
| URL | hxxp://megookbpnq[.]cf/Accentuat[.]mso | CloudEyE |
| URL | hxxp://1[.]13[.]175[.]57:8081/dpixel hxxp://101[.]34[.]163[.]3:8888/updates[.]rss hxxp://101[.]34[.]163[.]3:9999/cx hxxp://101[.]35[.]148[.]219:1433/cm hxxp://101[.]35[.]198[.]64:60005/api/3 hxxp://103[.]20[.]221[.]83:81/ga[.]js hxxp://104[.]218[.]236[.]112/ca hxxp://104[.]237[.]149[.]115:8082/discussion/mayo-clinic-radio-als/ hxxp://106[.]15[.]78[.]80/load hxxp://108[.]166[.]220[.]43:7443/pixel[.]gif hxxp://110[.]40[.]156[.]53:10086/activity hxxp://110[.]42[.]188[.]52:8199/g[.]pixel hxxp://114[.]115[.]218[.]16:55555/load hxxp://116[.]205[.]134[.]239:10003/pixel[.]gif hxxp://119[.]29[.]82[.]40:8053/g[.]pixel hxxp://119[.]3[.]12[.]54:8081/cm hxxp://119[.]45[.]26[.]174:8383/pixel[.]gif hxxp://119[.]91[.]31[.]246:60088/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://119[.]91[.]74[.]118:7999/g[.]pixel hxxp://120[.]27[.]94[.]139:62080/j[.]ad hxxp://120[.]46[.]199[.]93/visit[.]js hxxp://120[.]48[.]92[.]232:59443/jquery-3[.]3[.]1[.]min[.]js hxxp://120[.]77[.]18[.]249:88/dot[.]gif hxxp://121[.]196[.]108[.]92:5013/dot[.]gif hxxp://121[.]199[.]0[.]54:9988/push hxxp://121[.]4[.]211[.]243:8888/cx hxxp://123[.]249[.]31[.]187:10020/dpixel hxxp://124[.]220[.]0[.]89:35585/ca hxxp://124[.]220[.]185[.]154:8080/api/x hxxp://124[.]221[.]74[.]201:8888/visit[.]js hxxp://124[.]222[.]144[.]23:12510/search/ hxxp://124[.]222[.]3[.]42:4445/pixel hxxp://124[.]223[.]31[.]74:5555/IE9CompatViewList[.]xml hxxp://124[.]70[.]102[.]47:8888/cx hxxp://124[.]70[.]130[.]70:4444/j[.]ad hxxp://149[.]28[.]23[.]113/g[.]pixel hxxp://150[.]95[.]30[.]232:10443/messages/B1fOncrhSeI1hn7Cj6qJmsSz7SYcUuCea8 hxxp://158[.]247[.]196[.]89:8082/dpixel hxxp://171[.]22[.]30[.]252/activity hxxp://182[.]61[.]6[.]63:9999/dpixel hxxp://185[.]143[.]223[.]38/updates[.]rss hxxp://193[.]134[.]209[.]59:8072/__utm[.]gif hxxp://194[.]147[.]98[.]95/ptj hxxp://195[.]189[.]99[.]114/ak[.]css hxxp://198[.]13[.]40[.]190:10086/api/getit hxxp://20[.]187[.]105[.]113:8080/search/ hxxp://23[.]105[.]200[.]192:888/g[.]pixel hxxp://23[.]224[.]42[.]12:8080/_/scs/mail-static/_/js/ hxxp://3[.]234[.]141[.]134/visit[.]js hxxp://31[.]44[.]184[.]232/cx hxxp://43[.]140[.]195[.]36/fwlink hxxp://43[.]163[.]220[.]245:8081/cx hxxp://45[.]76[.]155[.]209/g[.]pixel hxxp://5[.]181[.]159[.]33/dpixel hxxp://70[.]39[.]93[.]88/ca hxxp://79[.]124[.]59[.]134/j[.]ad hxxp://81[.]69[.]96[.]149:8089/visit[.]js hxxp://81[.]71[.]162[.]183/dpixel hxxp://91[.]240[.]118[.]212:82/jquery-3[.]3[.]1[.]min[.]js hxxp://91[.]240[.]118[.]212:84/jquery-3[.]3[.]1[.]min[.]js hxxp://alwaysasusual[.]com:8080/links[.]css hxxp://net[.]googlesupport[.]tk:8880/match hxxp://players[.]u2pic[.]us:9527/updates[.]rss hxxps://103[.]187[.]168[.]153/g[.]pixel hxxps://104[.]218[.]236[.]112/match hxxps://107[.]189[.]1[.]156:50050/pixel[.]gif hxxps://112[.]74[.]177[.]62/visit[.]js hxxps://114[.]115[.]240[.]129:444/ga[.]js hxxps://120[.]48[.]92[.]232:60443/jquery-3[.]3[.]1[.]min[.]js hxxps://124[.]70[.]200[.]2/js/jquery-2[.]4[.]1[.]min[.]js hxxps://147[.]182[.]162[.]157/pixel hxxps://150[.]158[.]75[.]102:14435/g[.]pixel hxxps://152[.]136[.]227[.]216:20443/j[.]ad hxxps://18[.]134[.]98[.]91/dpixel hxxps://185[.]143[.]223[.]38:3389/load hxxps://23[.]108[.]57[.]80:8080/Anticipate/command/4ASA63GX3IX hxxps://27[.]122[.]56[.]137/avatars[.]css hxxps://43[.]135[.]157[.]217:8443/fd/ls/ hxxps://43[.]143[.]133[.]46/j[.]ad hxxps://47[.]240[.]102[.]1:6781/fwlink hxxps://47[.]92[.]198[.]186/ptj hxxps://8[.]210[.]158[.]189/ptj hxxps://81[.]161[.]229[.]119:10443/jquery-3[.]3[.]1[.]min[.]js hxxps://82[.]157[.]173[.]159:7778/en_US/all[.]js hxxps://88[.]218[.]193[.]100/pixel[.]gif hxxps://dobbyisfreeeee[.]com/change hxxps://info[.]bookworld-langchao[.]work:2096/jquery[.]js hxxps://kadltt[.]top/activity hxxps://leshkogrier[.]com/observe hxxps://panamaatyourservice[.]com/restore/how/3RG4G5T87 hxxps://scifihits[.]com/Detect/devs/NJYO2MUY4V hxxps://sso[.]alwaysasusual[.]com:8443/ur[.]html hxxps://www[.]lion3[.]life/www/handle/doc hxxps://zocekah[.]com:8080/Anticipate/command/4ASA63GX3IX |
Cobalt Strike |
| URL | hxxp://94[.]142[.]138[.]30/temporaryPolllocal/SecureauthSqlWindowscdn[.]php hxxp://vbhfghgfjjfgd[.]online/asyncgeneratorDefault/voiddb/2SqlImage/bigload1/protectLine/ProcessorpacketEternaltest/Packet/1hxxp1Dump/geo/lowDownloads_8/privateDatalife/9962/pythonupdateAuthtraffic[.]php |
DCRat |
| URL | hxxps://8dd98[.]samples[.]muzikcitysound[.]com/subscribeEvent hxxps://8e96c[.]distributor[.]techsavvyauto[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://103[.]170[.]254[.]253/spacedata/vbc[.]exe hxxp://103[.]232[.]54[.]88/spacedata/vbc[.]exe hxxp://hard-wall[.]ru/maya[.]exe hxxp://www[.]ingetic[.]cl/wp-content/themes/seotheme/lightfb2[.]1[.]exe |
Formbook |
| URL | hxxp://bestsdealofworld[.]com/twain[.]png hxxp://besttestbrend[.]com/twain[.]png hxxp://breakshoulder[.]com/twain[.]png hxxp://breakyboost[.]com/twain[.]png hxxp://Cloudzippe[.]com/twain[.]png hxxp://greatjbook[.]com/twain[.]png hxxp://ninjahmake[.]com/twain[.]png hxxp://olivnakercheast[.]com/twain[.]png hxxp://omegaweth[.]com/twain[.]png hxxp://resetpswdr[.]com/twain[.]png |
IcedID |
| URL | hxxp://45[.]159[.]189[.]105/bot/regex?key=b208717c54146010ab89e628591e2a7b11493ef1c593e7b3f15b1c06b1778d59 | Laplas |
| URL | hxxp://109[.]206[.]240[.]224/spacedata/[.]wininit[.]exe hxxp://195[.]133[.]40[.]108/spacedata/[.]win32[.]exe |
LokiBot |
| URL | hxxp://45[.]84[.]1[.]117/3477/Wgmpt[.]dll | PureCrypter |
| URL | hxxp://198[.]44[.]140[.]78/210/184/187737[.]dat hxxp://dientienthanh[.]com/crtfc/vodka[.]dll hxxp://drhenrylopez[.]com/crtfc/vodka[.]dll hxxp://er-coolcollection[.]com/crtfc/F67HmXP[.]dll hxxp://er-coolcollection[.]com/crtfc/vodka[.]dll hxxp://gkjdepok[.]org/crtfc/TsCw3rCG[.]dll hxxp://gkjdepok[.]org/crtfc/vodka[.]dll hxxp://man2kolaka[.]sch[.]id/crtfc/vodka[.]dll hxxp://mineramonday[.]com[.]py/crtfc/vodka[.]dll hxxp://mykitchenindonesia[.]com/crtfc/DgOr8LH4[.]dll hxxp://mykitchenindonesia[.]com/crtfc/vodka[.]dll hxxp://planneo[.]com[.]co/crtfc/vodka[.]dll hxxp://rccglp83[.]org/crtfc/vodka[.]dll hxxp://sinergi-cendekiawan[.]org/crtfc/vodka[.]dll hxxp://tatilkosesi[.]com[.]tr/crtfc/vodka[.]dll hxxp://winesforeurope[.]com/crtfc/vodka[.]dll |
QakBot |
| URL | hxxps://metkilit[.]com/iletisimcontent/iduhfnsjn[.]exe | Quasar RAT |
| URL | hxxp://193[.]233[.]20[.]238/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://193[.]233[.]20[.]238/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://193[.]233[.]20[.]238/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://193[.]233[.]20[.]238/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://193[.]233[.]20[.]238/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://193[.]233[.]20[.]238/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://193[.]233[.]20[.]238/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://176[.]113[.]115[.]176/ni/notru[.]exe hxxp://176[.]113[.]115[.]176/sokr/igla[.]exe hxxp://176[.]113[.]115[.]176/ti/truno[.]exe hxxp://62[.]204[.]41[.]245/moytru/hala[.]exe hxxp://62[.]204[.]41[.]245/ni/notru[.]exe hxxp://62[.]204[.]41[.]245/ti/truno[.]exe hxxp://62[.]204[.]41[.]88/lend/boeing[.]exe hxxp://62[.]204[.]41[.]88/lend/key[.]exe hxxps://spacepearl[.]io/SpacePearl_Setup[.]exe |
RedLine Stealer |
| URL | hxxp://13[.]124[.]14[.]174/3343/vbc[.]exe | Remcos |
| URL | hxxp://k0kz[.]ru/i[.]php?i=1 hxxp://k0kz[.]ru/i[.]php?i=12 |
Rhadamanthys |
| URL | hxxp://198[.]46[.]174[.]165/234/vbc[.]exe hxxp://chegaacores[.]com/systems/ChromeSetup[.]exe hxxps://autoacores[.]com/systems/ChromeSetup[.]exe hxxps://chegaacores[.]com/systems/tmp/ChromeSetup[.]exe |
SmokeLoader |
| URL | hxxp://23[.]88[.]36[.]149/package[.]zip hxxp://116[.]202[.]30[.]165/255 hxxp://116[.]202[.]30[.]165/408 hxxp://116[.]202[.]30[.]165/546 hxxp://23[.]88[.]36[.]149/562 |
Vidar |
| URL | hxxp://198[.]12[.]123[.]17:9406/Vre | Vjw0rm |
| URL | hxxp://babfahim[.]co[.]ke/panel/uploads/Bmihtpx[.]dll | XWorm |
