不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/02/16
※2023/02/16 更新
マルウェア感染させると考えられるURLを検知（2023/02/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://103[.]190[.]37[.]169/explorer/[.]svchost[.]exe hxxp://107[.]175[.]202[.]151/7713/vbc[.]exe hxxp://107[.]175[.]202[.]151/O[.]DOC hxxp://107[.]175[.]202[.]151/OO[.]DOC hxxp://208[.]67[.]105[.]179/divinezx[.]exe hxxp://superbtanzaniasafaris[.]com/zav/Amgrkdys[.]dll |
Agent Tesla |
| URL | hxxps://myanmarfuturescience[.]com/Python_3-11[.]msi hxxps://opticas30[.]com/java_win64_n1wp7ux1va[.]exe hxxps://python-official[.]com/20download/Expert_dowwloand[.]php |
Aurora Stealer |
| URL | hxxp://37[.]49[.]229[.]52/fuckjewishpeople[.]arm4 hxxp://37[.]49[.]229[.]52/fuckjewishpeople[.]arm5 hxxp://37[.]49[.]229[.]52/fuckjewishpeople[.]arm6 hxxp://37[.]49[.]229[.]52/fuckjewishpeople[.]arm7 hxxp://37[.]49[.]229[.]52/fuckjewishpeople[.]mips hxxp://37[.]49[.]229[.]52/fuckjewishpeople[.]mpsl hxxp://37[.]49[.]229[.]52/fuckjewishpeople[.]ppc |
Bashlite |
| URL | hxxps://aboddepdff[.]us/app/download[.]php?file=download hxxps://downloadsetup[.]us/AdobePDF[.]msi hxxps://veetragropvatika[.]com/?gclid=EAIaIQobChMIpd-m76SY_QIVrsmUCR08WABsEAMYASAAEgJr5vD_BwE |
BATLOADER |
| URL | hxxp://109[.]206[.]240[.]194/cxz/NEW_ORDER[.]exe | CloudEyE |
| URL | hxxp://103[.]30[.]17[.]40/ca hxxp://106[.]12[.]128[.]48/ptj hxxp://106[.]13[.]185[.]55/dot[.]gif hxxp://106[.]13[.]185[.]55/submit[.]php hxxp://112[.]3[.]31[.]147/dist/css/bootstrap[.]min[.]css hxxp://117[.]50[.]184[.]22:6565/load hxxp://117[.]50[.]184[.]22:7676/cm hxxp://117[.]50[.]184[.]22:8686/ga[.]js hxxp://124[.]220[.]198[.]212/IE9CompatViewList[.]xml hxxp://124[.]223[.]96[.]251/cx hxxp://146[.]19[.]173[.]90/Fabricate/bb/ME5KRHZ5T hxxp://146[.]19[.]173[.]90/Mod/v2[.]93/75KW7C3ICJ5 hxxp://154[.]221[.]19[.]62:2323/cm hxxp://155[.]138[.]134[.]252/cx hxxp://162[.]14[.]69[.]252/en_US/all[.]js hxxp://176[.]113[.]115[.]44/push hxxp://185[.]143[.]223[.]38:88/fwlink hxxp://193[.]134[.]209[.]59:8072/cx hxxp://198[.]148[.]102[.]150:4567/fwlink hxxp://218[.]61[.]197[.]137/dist/css/bootstrap[.]min[.]css hxxp://3[.]238[.]187[.]130/ptj hxxp://3[.]89[.]195[.]4/push hxxp://39[.]98[.]57[.]111/audiencemanager[.]js hxxp://45[.]207[.]58[.]57:2090/g[.]pixel hxxp://51[.]79[.]230[.]42/activityi hxxp://61[.]139[.]65[.]249/dist/css/bootstrap[.]min[.]css hxxp://8[.]133[.]236[.]211:42045/IE9CompatViewList[.]xml hxxps://1[.]116[.]3[.]85/www/handle/doc hxxps://103[.]30[.]17[.]40/cm hxxps://107[.]189[.]1[.]156:50050/ca hxxps://108[.]62[.]141[.]243/Communicate/v1[.]85/H4J1K7PAI5 hxxps://124[.]221[.]246[.]224:4433/ptj hxxps://154[.]39[.]157[.]8/pixel[.]gif hxxps://176[.]113[.]115[.]44/dpixel hxxps://178[.]79[.]157[.]195/zC hxxps://183[.]60[.]255[.]102/dist/css/bootstrap[.]min[.]css hxxps://185[.]143[.]223[.]38/load hxxps://27[.]159[.]90[.]100/dist/css/bootstrap[.]min[.]css hxxps://3[.]236[.]86[.]244/visit[.]js hxxps://47[.]100[.]37[.]216:8888/dpixel hxxps://49[.]119[.]122[.]58/dist/css/bootstrap[.]min[.]css hxxps://5[.]8[.]18[.]112/pixel[.]gif hxxps://58[.]215[.]92[.]78/dist/css/bootstrap[.]min[.]css hxxps://58[.]42[.]56[.]97/dist/css/bootstrap[.]min[.]css hxxps://61[.]172[.]226[.]82/dist/css/bootstrap[.]min[.]css hxxps://64[.]44[.]102[.]195/r-arrow hxxps://86[.]106[.]102[.]135/owa/auth[.]owa hxxps://93[.]115[.]27[.]11/list/hx28/config[.]php hxxps://95[.]168[.]191[.]239/r-arrow hxxps://pj[.]flyvpncrack[.]com:2087/maps/overlaybfpr hxxps://pw[.]sykxbelpzft6[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://rikukof[.]com/Communicate/v1[.]85/H4J1K7PAI5 hxxps://vehucabuc[.]com/af |
Cobalt Strike |
| URL | hxxp://84[.]252[.]121[.]57/Doc/Payment_Advice[.]7z | DBatLoader |
| URL | hxxp://195[.]3[.]223[.]218/PythonPipemultitrack/Game7temporarydatalife/0DownloadsproviderRequest/Eternal/ApiPhp/cdn1/30/75Bettervoiddb/pythonTraffic20/wpprocessor/hxxpwpProton/ApiuploadsGameCpu/lowBaseAsyncPrivateTemp[.]php | DCRat |
| URL | hxxps://2a60c[.]distributor[.]techsavvyauto[.]com/subscribeEvent hxxps://7d29c[.]distributor[.]techsavvyauto[.]com/subscribeEvent hxxps://99550[.]distributor[.]techsavvyauto[.]com/subscribeEvent hxxps://c0263[.]distributor[.]techsavvyauto[.]com/subscribeEvent hxxps://cc904[.]distributor[.]techsavvyauto[.]com/subscribeEvent hxxps://ede78[.]distributor[.]techsavvyauto[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://103[.]170[.]254[.]253/googlesave/vbc[.]exe hxxp://103[.]170[.]254[.]253/spaceX/vbc[.]exe hxxp://109[.]206[.]240[.]194/cxz/DHL[.]exe hxxp://109[.]206[.]240[.]194/cxz/Rektificeres[.]exe hxxp://109[.]206[.]240[.]194/o/vooi[.]exe hxxp://www[.]ingetic[.]cl/wp-content/themes/seotheme/bokledge4[.]1[.]exe |
Formbook |
| URL | hxxps://dterttyt[.]com/retrtrtyty[.]txt | Laplas |
| URL | hxxp://171[.]22[.]30[.]164/yan/five/fre[.]php hxxp://208[.]67[.]105[.]148/okuma/five/fre[.]php hxxp://195[.]133[.]40[.]108/explorer/[.]win32[.]exe hxxp://79[.]110[.]62[.]142/2202/vbc[.]exe hxxp://79[.]110[.]62[.]142/2203/vbc[.]exe |
LokiBot |
| URL | hxxp://182[.]31[.]135[.]238:37101/Mozi[.]m hxxp://202[.]83[.]41[.]127:45257/Mozi[.]m hxxp://27[.]215[.]84[.]7:55215/Mozi[.]m |
Mozi |
| URL | hxxp://www[.]ingetic[.]cl/wp-content/themes/seotheme/febono2[.]3[.]exe | Nanocore RAT |
| URL | hxxp://185[.]215[.]113[.]66/newpinf[.]exe hxxp://twizt[.]ru/newtpp[.]exe |
Phorpiex |
| URL | hxxp://www[.]arki[.]com:8080/ponyb/gate[.]php hxxp://arki[.]com:8080/ponyb/gate[.]php hxxp://50[.]57[.]185[.]72:8080/ponyb/gate[.]php hxxp://deltadazeresort[.]net/ponyb/gate[.]php hxxp://arki[.]com/ponyb/gate[.]php hxxp://www[.]arki[.]com/ponyb/gate[.]php |
Pony |
| URL | hxxp://192[.]3[.]27[.]140/3232/vbc[.]exe | PureCrypter |
| URL | hxxp://104[.]225[.]129[.]162/797/vodka[.]dat hxxp://104[.]236[.]1[.]43/YXF/150223[.]gif hxxp://134[.]209[.]218[.]144/Nhum5N/vodka[.]gif hxxp://139[.]99[.]253[.]179/464/vodka[.]dat hxxp://144[.]202[.]127[.]44/403/vodka[.]dat hxxp://144[.]202[.]127[.]44/vodka[.]dat hxxp://159[.]89[.]156[.]49/uvqD/vodka[.]gif hxxp://167[.]99[.]231[.]18/tAMJMSm/vodka[.]gif hxxp://198[.]44[.]140[.]32/467/vodka[.]dat hxxp://209[.]182[.]225[.]137/714/vodka[.]dat hxxp://209[.]182[.]225[.]137/vodka[.]dat hxxp://216[.]146[.]25[.]26/883/vodka[.]dat hxxp://5[.]182[.]38[.]20/724/vodka[.]dat hxxp://64[.]225[.]32[.]197/mIoJy2/vodka[.]gif hxxp://77[.]91[.]122[.]13/536/vodka[.]dat hxxp://77[.]91[.]122[.]13/vodka[.]dat hxxp://79[.]141[.]169[.]121/293/101476[.]dat hxxp://79[.]141[.]169[.]121/293/vodka[.]dat hxxp://79[.]141[.]169[.]121/vodka[.]dat hxxp://87[.]236[.]146[.]141/662/vodka[.]dat hxxp://etctrucks[.]ro/adobedoc/vodka[.]dll hxxp://farmaciazuccarini[.]it/adobedoc/vodka[.]dll hxxp://farmaciazuccarini[.]it/adobedoc/yca8krAb[.]dll hxxp://tempsolutionsde[.]com/images/1[.]gif |
QakBot |
| URL | hxxp://metkilit[.]com/iletisimcontent/iduhfnsjn[.]exe | Quasar RAT |
| URL | hxxp://77[.]73[.]134[.]35/chrome[.]exe | RecordBreaker |
| URL | hxxp://176[.]113[.]115[.]176/sokr/inga[.]exe | RedLine Stealer |
| URL | hxxp://195[.]178[.]120[.]24/lowkeyEncrypted[.]exe | Snake Keylogger |
| URL | hxxps://panelco[.]su:60963/okesNntABMqQXGIS/GAHQKaIxBCmtXghr[.]html#VCqpPX3kg5KGYDRajlZtBAnWNQxIc2sLHUr769zSyhEfFbJTM1wm40u8eovidO+/= hxxp://116[.]202[.]30[.]165/764 hxxp://116[.]202[.]30[.]165/888 hxxp://162[.]55[.]40[.]72/255 hxxp://195[.]201[.]44[.]125/713 hxxp://23[.]88[.]36[.]149/14 |
Vidar |
