不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/02/27
※2023/02/27 更新
マルウェア感染させると考えられるURLを検知（2023/02/27）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://208[.]67[.]105[.]179/arnoldzx[.]exe hxxp://23[.]94[.]148[.]10/9019/vbc[.]exe hxxp://23[.]94[.]148[.]100/9015/vbc[.]exe hxxp://mosiadomneasca[.]ro/wp-includes/gtt/Tfghtwfqbh[.]dat |
Agent Tesla |
| URL | hxxp://185[.]246[.]221[.]126/bins/Amadey[.]exe hxxp://193[.]233[.]20[.]21/mi/sonto[.]exe hxxp://193[.]233[.]20[.]21/pi/cent[.]exe hxxp://185[.]174[.]137[.]152/jb9sZZZbv7/Login[.]php hxxp://185[.]246[.]221[.]126/i4kvjd3xc/Login[.]php hxxp://192[.]211[.]55[.]118/h9sk3jdSda/Login[.]php hxxp://193[.]42[.]33[.]28/0bjdn2Z/index[.]php hxxp://193[.]42[.]33[.]28/8bmdh3Slb2/Login[.]php hxxp://193[.]42[.]33[.]28/game0ver/Login[.]php hxxp://193[.]42[.]33[.]43/fb73jc3/Login[.]php hxxp://1h3art[.]me/i4kvjd3xc/Login[.]php hxxp://45[.]32[.]200[.]113/mBsjv2swweP/Login[.]php hxxp://45[.]66[.]230[.]123/g8kdkeXs2qL/Login[.]php hxxp://45[.]9[.]74[.]80/0bjdn2Z/Login[.]php hxxp://62[.]204[.]41[.]121/ZxhssZx/Login[.]php hxxp://62[.]204[.]41[.]13/gjend7w/Login[.]php hxxp://62[.]204[.]41[.]182/g9TTnd3bS/Login[.]php hxxp://62[.]204[.]41[.]25/3g4mn5s/Login[.]php hxxp://62[.]204[.]41[.]88/9vdVVVjsw/Login[.]php hxxp://62[.]204[.]41[.]91/8kcnjd3da3/Login[.]php hxxp://77[.]73[.]133[.]72/hfk3vK9/Login[.]php hxxp://77[.]73[.]134[.]27/8bmdh3Slb2/Login[.]php hxxp://77[.]73[.]134[.]66/v7eWcjs/Login[.]php hxxp://79[.]137[.]192[.]6/u83mfdS2/Login[.]php hxxp://80[.]94[.]92[.]35/g9TTnd3bS/Login[.]php hxxp://amazingtodaynotsaidhimherwhathe[.]com/Nmkn5d9Dn/Login[.]php hxxp://bitcoinpricealertexpert[.]com/8bmdh3Slb2/Login[.]php hxxp://coindexalerter[.]com/8bmdh3Slb2/Login[.]php hxxp://crmgloinx[.]com/0mYqX73dk3/Login[.]php hxxp://github[.]gitextensions[.]org/MvwWdj2/Login[.]php hxxp://hellomr[.]observer/7gjD0Vs3d/Login[.]php hxxp://maximumpushtodaynotnowbut[.]com/Nmkn5d9Dn/Login[.]php hxxp://motiontodaynotgogoodnowok[.]com/Nmkn5d9Dn/Login[.]php hxxp://search[.]akamainet[.]org/h8V2cQlbd3/Login[.]php hxxp://smkpro[.]to/0bjdn2Z/Login[.]php hxxp://uniswapdataprice[.]com/8bmdh3Slb2/Login[.]php hxxp://update[.]nodfirewalld[.]org/MvwWdj2/Login[.]php |
Amadey |
| URL | hxxp://95[.]214[.]24[.]244/limetor/Kgilth-LIME-2[.]exe hxxp://95[.]214[.]24[.]244/TPB-2-Links/Ntprfgupx-2[.]exe hxxp://dhdtrading[.]com/wp-admin/images/img[.]png hxxp://dhdtrading[.]com/wp-admin/images/info2[.]txt |
AsyncRAT |
| URL | hxxp://185[.]246[.]221[.]126/bins/bin[.]exe hxxp://141[.]255[.]162[.]222/auth hxxp://45[.]15[.]156[.]182/auth hxxp://45[.]9[.]74[.]156/auth hxxp://82[.]115[.]223[.]135/auth hxxp://94[.]142[.]138[.]71/auth hxxp://94[.]142[.]138[.]84/auth hxxp://94[.]142[.]138[.]94/auth |
Aurora Stealer |
| URL | hxxp://nghfh[.]com/em/index[.]php | Azorult |
| URL | hxxp://162[.]248[.]224[.]11/kray[.]arm4 hxxp://162[.]248[.]224[.]11/kray[.]arm5 hxxp://162[.]248[.]224[.]11/kray[.]arm6 hxxp://162[.]248[.]224[.]11/kray[.]mpsl hxxp://162[.]248[.]224[.]11/kray[.]ppc hxxp://162[.]248[.]224[.]11/kray[.]sparc hxxp://185[.]254[.]37[.]25/bins/i586 hxxp://37[.]221[.]65[.]228/x-8[.]6-[.]Fourloko |
Bashlite |
| URL | hxxp://120[.]48[.]99[.]90:443/MdVV hxxp://120[.]48[.]99[.]90:443/ca hxxp://1[.]116[.]160[.]60/push hxxp://1[.]13[.]82[.]101:8041/cx hxxp://1[.]15[.]247[.]249:8086/ga[.]js hxxp://101[.]206[.]219[.]90:4444/updates[.]rss hxxp://101[.]37[.]33[.]153:87/fwlink hxxp://103[.]20[.]221[.]8/pixel[.]gif hxxp://103[.]67[.]191[.]89:8080/dpixel hxxp://104[.]168[.]68[.]35:8000/IE9CompatViewList[.]xml hxxp://104[.]168[.]9[.]28:9998/ptj hxxp://104[.]21[.]56[.]57/pixel[.]gif hxxp://106[.]13[.]20[.]56/g[.]pixel hxxp://107[.]148[.]149[.]21/visit[.]js hxxp://107[.]172[.]208[.]88/visit[.]js hxxp://107[.]172[.]208[.]88:8080/match hxxp://116[.]204[.]211[.]163/c/msdownload/update/others/2016/12/29136388_ hxxp://118[.]31[.]76[.]240:7999/push hxxp://121[.]5[.]102[.]200/activity hxxp://121[.]5[.]102[.]200:8081/dot[.]gif hxxp://123[.]249[.]77[.]187:8080/visit[.]js hxxp://123[.]60[.]178[.]169/updates[.]rss hxxp://124[.]223[.]22[.]86/__utm[.]gif hxxp://13[.]230[.]229[.]15/www/handle/doc hxxp://139[.]144[.]188[.]75:8082/category/research-2/ hxxp://139[.]180[.]193[.]248:9000/jquery-3[.]3[.]1[.]min[.]js hxxp://139[.]196[.]47[.]225:809/ptj hxxp://139[.]198[.]187[.]234/ptj hxxp://139[.]9[.]85[.]93:9558/load hxxp://142[.]11[.]205[.]63/ptj hxxp://149[.]129[.]72[.]37:2580/dot[.]gif hxxp://149[.]28[.]158[.]176:8081/match hxxp://150[.]158[.]100[.]162:8445/__utm[.]gif hxxp://150[.]158[.]11[.]76/pixel hxxp://150[.]158[.]11[.]76:8080/dot[.]gif hxxp://150[.]158[.]54[.]124:8503/en_US/all[.]js hxxp://154[.]38[.]108[.]253:8001/c/msdownload/update/others/2021/09/29136388_ hxxp://154[.]64[.]224[.]130:8088/j[.]ad hxxp://158[.]101[.]89[.]127:8081/mht_image/ hxxp://159[.]223[.]190[.]172:3333/dot[.]gif hxxp://165[.]22[.]241[.]234/dot[.]gif hxxp://172[.]67[.]178[.]195/match hxxp://175[.]178[.]191[.]210/pixel[.]gif hxxp://179[.]43[.]156[.]134:8081/hubcap/mayo-clinic-radio-full-shows/ hxxp://179[.]60[.]150[.]57/j[.]ad hxxp://182[.]61[.]147[.]36:8000/www/handle/doc hxxp://182[.]61[.]6[.]63:9999/fwlink hxxp://182[.]92[.]238[.]128/visit[.]js hxxp://185[.]11[.]61[.]199:8080/cm hxxp://192[.]3[.]127[.]22:1234/push hxxp://193[.]134[.]209[.]59:8062/en_US/all[.]js hxxp://20[.]210[.]200[.]226/zOMGAPT hxxp://208[.]67[.]105[.]87:12338/j[.]ad hxxp://37[.]220[.]87[.]75/common hxxp://38[.]60[.]39[.]41/dpixel hxxp://42[.]192[.]54[.]106:3333/zjservicezj/front/index/page[.]do hxxp://43[.]139[.]69[.]115/j[.]ad hxxp://43[.]139[.]78[.]242:8090/dot[.]gif hxxp://43[.]139[.]78[.]242:8090/j[.]ad hxxp://43[.]142[.]185[.]126:6789/dot[.]gif hxxp://43[.]143[.]134[.]147/cx hxxp://43[.]159[.]36[.]126:44344/updates hxxp://43[.]249[.]9[.]32:12345/ca hxxp://44[.]198[.]164[.]69/dpixel hxxp://45[.]140[.]88[.]85:8088/g[.]pixel hxxp://45[.]76[.]196[.]195:8888/j[.]ad hxxp://45[.]76[.]79[.]8/image/ hxxp://47[.]100[.]215[.]156/load hxxp://47[.]122[.]22[.]26/fwlink hxxp://47[.]92[.]114[.]227/www/handle/doc hxxp://47[.]99[.]188[.]174:8888/g[.]pixel hxxp://54[.]236[.]49[.]195/jquery-3[.]3[.]1[.]min[.]js hxxp://8[.]134[.]209[.]29/push hxxp://8[.]142[.]124[.]166:8090/ca hxxp://80[.]66[.]88[.]127/j[.]ad hxxp://81[.]68[.]249[.]97:8090/dpixel hxxp://81[.]68[.]249[.]97:9001/visit[.]js hxxp://82[.]157[.]167[.]219/api/jquery[.]fancybox[.]min[.]js hxxp://82[.]157[.]243[.]230:8005/IE9CompatViewList[.]xml hxxp://94[.]131[.]8[.]103/activity hxxp://cs[.]capetradefinance[.]co[.]za/pixel[.]gif hxxp://da[.]fulim[.]top:2095/push hxxp://devsecurityservices[.]com/lu[.]css hxxp://e-servicesolutions[.]com/Forums[.]html hxxp://fityourself[.]tk:81/match hxxp://mgt[.]microsoft-cdn[.]org/script/src/main[.]js hxxp://s173[.]minrosoftupdate[.]com/jquery-3[.]3[.]1[.]min[.]js hxxp://vnssinc[.]com/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://winlog03[.]micnosoftupdates[.]com/jquery-3[.]3[.]1[.]min[.]js hxxp://www[.]diaolu[.]live:8080/updates[.]rss hxxp://xvnmyi[.]ht5wy2lga[.]site/dashboard hxxp://xvnmyi[.]ht5wy2lga[.]site/security hxxps://100[.]100[.]101[.]114/load hxxps://101[.]43[.]149[.]199/j[.]ad hxxps://103[.]135[.]101[.]182:88/ptj hxxps://103[.]67[.]191[.]89:8443/visit[.]js hxxps://104[.]168[.]68[.]35:9000/pixel hxxps://107[.]173[.]251[.]222:58443/api/info hxxps://108[.]62[.]118[.]180/Inform/servlets/XOMB26P0RJ hxxps://117[.]18[.]13[.]220:1443/g[.]pixel hxxps://119[.]167[.]147[.]250/en-us/silentauth hxxps://121[.]5[.]102[.]200/push hxxps://124[.]221[.]144[.]169/pixel[.]gif hxxps://149[.]129[.]72[.]37:8444/cm hxxps://154[.]38[.]108[.]253:8089/c/msdownload/update/others/2021/09/29136388_ hxxps://173[.]82[.]195[.]131:18992/fwlink hxxps://18[.]117[.]178[.]164/en_US/all[.]js hxxps://18[.]162[.]188[.]12/www/handle/doc hxxps://183[.]246[.]191[.]193/en-us/silentauth hxxps://185[.]132[.]43[.]99:8443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://185[.]158[.]250[.]194/jquery-4[.]3[.]1[.]min[.]js hxxps://185[.]174[.]101[.]68/fwlink hxxps://190[.]123[.]44[.]137:4433/increase hxxps://20[.]89[.]23[.]164/zOMGAPT hxxps://202[.]95[.]19[.]204:4430/push hxxps://208[.]67[.]105[.]87:13443/g[.]pixel hxxps://23[.]108[.]57[.]239/inquiry/issues/VLQLVST0PYX7 hxxps://37[.]220[.]87[.]75/common hxxps://38[.]60[.]39[.]41:888/__utm[.]gif hxxps://39[.]98[.]78[.]9/load hxxps://42[.]192[.]54[.]106:8443/zjservicezj/front/index/page[.]do hxxps://43[.]138[.]121[.]2/push hxxps://43[.]138[.]127[.]159/match hxxps://47[.]100[.]215[.]156/dpixel hxxps://47[.]92[.]198[.]186/ga[.]js hxxps://47[.]92[.]198[.]186/submit[.]php hxxps://47[.]94[.]3[.]175:55443/cx hxxps://47[.]99[.]151[.]68:5556/ca hxxps://8[.]134[.]212[.]47/j[.]ad hxxps://81[.]161[.]229[.]111/ca hxxps://82[.]157[.]75[.]169/pixel hxxps://87[.]251[.]67[.]43:444/cx hxxps://91[.]238[.]203[.]2/jquery-3[.]3[.]1[.]min[.]js hxxps://98[.]142[.]143[.]85/cm hxxps://analytics[.]vip2-nice[.]com/www/handle/doc hxxps://app[.]sncyhkttp[.]nl:2096/image/ hxxps://app[.]sncyhkttp[.]nl:8443/image/ hxxps://as[.]kbnexc[.]com/an hxxps://cdn[.]winservers-network[.]in/www/handle/doc hxxps://devsecurityservices[.]com/ur hxxps://e-servicesolutions[.]com/link hxxps://jquerysslx[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://kbangbi[.]net/owa/auth[.]owa hxxps://liuzhanxian[.]shop:2096/metro91/admin/1/ppptp[.]jpg hxxps://lugociyah[.]com/Inform/servlets/XOMB26P0RJ hxxps://name[.]vip2-nice[.]com/www/handle/doc hxxps://network[.]vip2-nice[.]com/www/handle/doc hxxps://qw[.]kbnexc[.]com/search hxxps://s173[.]minrosoftupdate[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://security[.]vip2-nice[.]com/www/handle/doc hxxps://traffic[.]vip2-nice[.]com/www/handle/doc hxxps://update[.]huorongsec[.]com:2083/zjservicezj/front/index/page[.]do hxxps://upgrade[.]vip2-nice[.]com/www/handle/doc hxxps://vnssinc[.]com/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://winlog03[.]micnosoftupdates[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://yifebuto[.]com/inquiry/issues/VLQLVST0PYX7 hxxps://zx[.]kbnexc[.]com/an hxxps://zx[.]kbnexc[.]com/ee |
Cobalt Strike |
| URL | hxxp://45[.]15[.]159[.]15/Hedtgoupb[.]exe hxxp://62[.]204[.]41[.]88/lend/Installerr[.]exe hxxp://77[.]91[.]78[.]166/s[.]exe hxxps://covidguardeth[.]com/svcrun[.]exe hxxps://hayainteriors[.]com/svcrun[.]exe |
Coinminer |
| URL | hxxp://ewzvpq52[.]top/gate[.]php hxxp://ewzpak62[.]top/gate[.]php hxxp://ewzsvl72[.]top/gate[.]php |
CryptBot |
| URL | hxxp://212[.]109[.]192[.]100/externaltoUpdateauth[.]php hxxp://217[.]25[.]95[.]234/Temporarybasedatalife0/universal25/5gameexternalTo/AuthUpdateProviderProcessor/7Traffic/6Video/dbSecuremulti/update/9/_/protect4/Publiclocal/Linux/Windows6flower/To/asyncExternalPipeUpdate/Protonlinux/7/eternalBasetrafficwp[.]php hxxp://80[.]87[.]192[.]227/7/_8Generator/ImageExternalGame3/5/08protect8/Default/EternalmultiWp/Image6/voiddbTemp0/External6/_DleGeneratorprivate/Traffic68/Private/videoServerVoiddb/php83/universal2/UniversalhxxpPython/21/MultiProcessor/eternalprotectWindowsflowerasync[.]php hxxp://haivo[.]co[.]zw/admin/Linerequestgeosql[.]php |
DCRat |
| URL | hxxps://1e3f0[.]decision[.]alshafipdk[.]com/subscribeEvent hxxps://2a812[.]calendar[.]wishmarkets[.]com/subscribeEvent hxxps://5866c[.]decision[.]alshafipdk[.]com/subscribeEvent hxxps://7c511[.]decision[.]alshafipdk[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://103[.]232[.]54[.]88/windows/vbc[.]exe hxxp://kerasiastudios[.]gr/kentorio2[.]1[.]exe |
Formbook |
| URL | hxxp://185[.]209[.]29[.]94/kinsing hxxp://62[.]113[.]119[.]186/x hxxp://185[.]209[.]29[.]94/lr2[.]sh hxxp://185[.]221[.]154[.]208/ms |
Kinsing |
| URL | hxxp://185[.]174[.]137[.]94/bot/regex hxxp://194[.]15[.]216[.]30/bot/regex hxxp://212[.]113[.]106[.]172/bot/regex hxxp://31[.]172[.]79[.]130/bot/regex hxxp://45[.]159[.]189[.]105/bot/regex?key=e1833dcb76f0a51a7b0032c5e4e935cc980d513fbeb93b892018bd0048583197 hxxp://51[.]195[.]166[.]203/bot/regex |
Laplas |
| URL | hxxp://185[.]246[.]220[.]85/fresh/five/fre[.]php hxxp://195[.]133[.]40[.]108/googlespace/[.]win32[.]exe hxxp://212[.]87[.]204[.]200/[.][.]x[.]doc hxxp://212[.]87[.]204[.]200/5021/vbc[.]exe hxxp://212[.]87[.]204[.]200/9088/vbc[.]exe hxxp://212[.]87[.]204[.]200/O00-O[.]doc hxxp://212[.]87[.]204[.]200/O0-O[.]doc hxxp://92[.]52[.]217[.]50/googlespace/csrss[.]exe hxxp://92[.]52[.]217[.]50/windows/csrss[.]exe |
LokiBot |
| URL | hxxp://113[.]228[.]89[.]243:34699/Mozi[.]m hxxp://175[.]107[.]11[.]82:47024/Mozi[.]m hxxp://175[.]173[.]227[.]67:40134/Mozi[.]m hxxp://180[.]177[.]106[.]24:55773/Mozi[.]m |
Mozi |
| URL | hxxp://193[.]138[.]195[.]211:8000/sln[.]exe | Orcus RAT |
| URL | hxxp://revitape[.]com/gdy/Pftcp[.]dll hxxp://argentum[.]com[.]br/well-known/acme-challenge/k/h/d/g/Pnhez[.]bmp hxxp://23[.]94[.]148[.]10/6333/vbc[.]exe hxxp://23[.]95[.]122[.]240/u/1990[.]exe hxxp://45[.]15[.]159[.]15/rizzler[.]exe |
PureCrypter |
| URL | hxxp://45[.]9[.]74[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://45[.]9[.]74[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://45[.]9[.]74[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://45[.]9[.]74[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://45[.]9[.]74[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://45[.]9[.]74[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://45[.]9[.]74[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxps://privacy-tools-for-you-453[.]com/downloads/lab[.]exe |
RecordBreaker |
| URL | hxxp://193[.]233[.]20[.]19/sokr/hasan[.]exe hxxp://193[.]233[.]20[.]19/sokr/herso[.]exe hxxp://193[.]233[.]20[.]19/ti/lampa[.]exe hxxp://194[.]110[.]203[.]101/puta/nsoftwinx64[.]exe hxxp://62[.]204[.]41[.]88/lend/DefermentsStarkly_2023-02-22_18-57[.]exe hxxp://62[.]204[.]41[.]88/lend/Extenuate[.]exe hxxp://95[.]214[.]24[.]244/limetor/Rrobknnz-LIMETORRENTS[.]exe hxxp://95[.]214[.]24[.]244/newz2k/Z2K-1[.]exe hxxp://95[.]214[.]24[.]244/TPB-2-Links/TPB-1[.]exe hxxps://flareroyale[.]com/uploads/media/settings/January2023/FlareRoyale(0_9)3[.]rar |
RedLine Stealer |
| URL | hxxp://212[.]87[.]204[.]245/Drsvvfpwmn[.]exe hxxp://23[.]94[.]99[.]5/9020/vbc[.]exe hxxp://23[.]94[.]99[.]5/9686/vbc[.]exe hxxp://23[.]94[.]99[.]5/O0-O[.]doc hxxp://sjunmel[.]org/yakfileloadsonedrivedocumentsuploadgoogleapclouddownloads/Cnpzfybowxg |
Remcos |
| URL | hxxp://157[.]254[.]195[.]116/jkdoashfabnio[.]exe hxxp://179[.]43[.]142[.]172:443/admin/console/index[.]html |
Rhadamanthys |
| URL | hxxp://misha[.]at/upload/ hxxp://roohaniinfra[.]com/upload/ hxxp://0axqpcc[.]cn/upload/ hxxp://mayak-lombard[.]ru/upload/ hxxp://mebel-lass[.]ru/upload/ hxxp://dishakhan[.]com/upload/ |
SmokeLoader |
| URL | hxxp://195[.]178[.]120[.]24/oXGvf66xcU[.]exe hxxp://23[.]95[.]122[.]244/20/xyz[.]exe |
Snake Keylogger |
| URL | hxxp://www[.]cpasdrole[.]com/handdiy_3[.]exe | Socelars |
| URL | hxxp://23[.]88[.]122[.]134/579d5c7e95a610c1/freebl3[.]dll hxxp://23[.]88[.]122[.]134/579d5c7e95a610c1/mozglue[.]dll hxxp://23[.]88[.]122[.]134/579d5c7e95a610c1/msvcp140[.]dll hxxp://23[.]88[.]122[.]134/579d5c7e95a610c1/nss3[.]dll hxxp://23[.]88[.]122[.]134/579d5c7e95a610c1/softokn3[.]dll hxxp://23[.]88[.]122[.]134/579d5c7e95a610c1/sqlite3[.]dll hxxp://23[.]88[.]122[.]134/579d5c7e95a610c1/vcruntime140[.]dll hxxp://systemupdate-microsoft[.]top/852ee5ffe0de00c3/freebl3[.]dll hxxp://systemupdate-microsoft[.]top/852ee5ffe0de00c3/mozglue[.]dll hxxp://systemupdate-microsoft[.]top/852ee5ffe0de00c3/msvcp140[.]dll hxxp://systemupdate-microsoft[.]top/852ee5ffe0de00c3/nss3[.]dll hxxp://systemupdate-microsoft[.]top/852ee5ffe0de00c3/softokn3[.]dll hxxp://systemupdate-microsoft[.]top/852ee5ffe0de00c3/sqlite3[.]dll hxxp://systemupdate-microsoft[.]top/852ee5ffe0de00c3/vcruntime140[.]dll hxxp://23[.]88[.]122[.]134/da4d23fa59600f9c[.]php hxxp://91[.]215[.]85[.]213/4f230c0dd4efa481[.]php hxxp://systemupdate-microsoft[.]top/31f2a38ac74a9d54[.]php |
Stealc |
| URL | hxxp://jiqaz[.]com/test2/get[.]php | STOP |
| URL | hxxp://185[.]106[.]93[.]140:5000//authed/ hxxp://37[.]220[.]87[.]60:5000//authed/ hxxp://45[.]15[.]156[.]211:5000//authed/ hxxp://45[.]9[.]74[.]63:5000//authed/ hxxp://77[.]73[.]134[.]33:5000//authed/ hxxp://89[.]22[.]232[.]230:5000//authed/ hxxp://94[.]142[.]138[.]42:5000//authed/ hxxp://94[.]142[.]138[.]58:5000//authed/ |
TitanStealer |
| URL | hxxp://116[.]203[.]1[.]203/15 hxxp://23[.]88[.]36[.]149/736 |
Vidar |
| URL | hxxp://kerasiastudios[.]gr/warex2[.]1[.]exe hxxp://kerasiastudios[.]gr/warzgo2[.]1[.]exe |
Warzone RAT |
| URL | hxxp://212[.]87[.]204[.]245/Hedtgoupb[.]exe | XMRig |
| URL | hxxp://39[.]109[.]114[.]129:5858/akaz/Updaater[.]exe | YoungLotus |
