不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/03/03
※2023/03/03 更新
マルウェア感染させると考えられるURLを検知（2023/03/03）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://15[.]237[.]37[.]205/e2[.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.]doc hxxp://15[.]237[.]37[.]205/723/vbc[.]exe hxxp://104[.]168[.]45[.]119/yes[.]exe hxxp://192[.]3[.]101[.]160/204/vbc[.]exe hxxp://192[.]3[.]101[.]163/880/vbc[.]exe |
Agent Tesla |
| URL | hxxp://62[.]204[.]41[.]88/lend/aliacesz[.]exe | Aurora Stealer |
| URL | hxxp://46[.]183[.]222[.]115/Roth1/Panel/index[.]php | Azorult |
| URL | hxxp://46[.]3[.]197[.]29/dss hxxp://46[.]3[.]197[.]29/co hxxp://46[.]3[.]197[.]29/dc hxxp://46[.]3[.]197[.]29/586 hxxp://46[.]3[.]197[.]29/m68k |
Bashlite |
| URL | hxxp://198[.]12[.]116[.]52/en_US/all[.]js hxxps://194[.]135[.]104[.]48/cx hxxp://43[.]140[.]193[.]29/activity hxxp://152[.]89[.]196[.]245:6789/ptj hxxps://149[.]129[.]72[.]37:18444/cm hxxp://47[.]95[.]1[.]240:801/activity hxxp://47[.]106[.]123[.]86:8080/ga[.]js hxxp://81[.]68[.]136[.]116/dpixel hxxp://49[.]234[.]38[.]74/visit[.]js hxxp://114[.]115[.]245[.]82:2233/g[.]pixel hxxps://157[.]245[.]153[.]7/ab[.]js hxxps://173[.]234[.]155[.]26/show/v8[.]77/JQESBIZ0 hxxps://fuyaboho[.]com/show/v8[.]77/JQESBIZ0 hxxp://47[.]116[.]75[.]96/dpixel hxxp://13[.]125[.]241[.]228:1443/__utm[.]gif hxxp://147[.]78[.]47[.]209/en_US/all[.]js hxxp://45[.]32[.]47[.]187:8888/dpixel hxxp://47[.]242[.]72[.]118/dot[.]gif hxxp://23[.]105[.]200[.]192/g[.]pixel hxxp://91[.]240[.]118[.]233:8080/push hxxps://5[.]255[.]105[.]23:9443/www/handle/doc hxxps://zx[.]svchosexec[.]com/cs hxxps://as[.]svchosexec[.]com/cs hxxps://qw[.]svchosexec[.]com/cs hxxp://45[.]140[.]147[.]105:8080/common[.]css hxxp://45[.]88[.]170[.]91:88/ptj hxxp://27[.]50[.]54[.]41/__utm[.]gif hxxps://103[.]187[.]168[.]153:55915/cx hxxp://121[.]43[.]189[.]59:7777/j[.]ad hxxps://47[.]116[.]75[.]96/fwlink hxxp://216[.]83[.]38[.]235/dot[.]gif hxxps://114[.]132[.]56[.]160:1234/ca hxxps://179[.]43[.]156[.]134:9443/discussion/mayo-clinic-radio-als/ hxxp://124[.]70[.]100[.]184:4567/dot[.]gif hxxp://82[.]157[.]182[.]245:8088/visit[.]js hxxp://1[.]13[.]82[.]101:8041/en_US/all[.]js hxxp://121[.]43[.]189[.]59:8010/push hxxp://170[.]39[.]214[.]187/dpixel hxxp://216[.]83[.]38[.]235:8081/match hxxp://50[.]229[.]122[.]11/archive/rar/loading[.]jpg hxxp://109[.]205[.]61[.]140/archive/rar/loading[.]jpg hxxp://quote[.]swalter[.]com/archive/rar/loading[.]jpg hxxp://103[.]30[.]17[.]40/load hxxps://103[.]30[.]17[.]40/activity hxxps://8[.]142[.]124[.]166:8443/match hxxp://43[.]139[.]8[.]152:9999/ga[.]js hxxp://121[.]40[.]212[.]230/pixel hxxp://120[.]25[.]236[.]78/match hxxp://49[.]233[.]60[.]12:8080/activity hxxps://microsoft[.]twiganm[.]xyz/api/uio hxxps://1[.]117[.]169[.]18:10443/pixel hxxps://129[.]211[.]214[.]232/cm hxxp://150[.]158[.]152[.]94/visit[.]js hxxp://87[.]118[.]67[.]253/c/msdownload/update/others/2020/10/29136388_ hxxp://cloudforceget[.]online/c/msdownload/update/others/2020/10/29136388_ hxxp://218[.]11[.]133[.]33:8806/ga[.]js hxxp://101[.]42[.]101[.]185:8008/cx hxxps://globaltechline[.]com/common hxxp://43[.]143[.]234[.]105:801/ga[.]js hxxp://180[.]76[.]247[.]230:8080/cx hxxps://1[.]117[.]6[.]126:8443/jquery-3[.]6[.]0[.]min[.]js hxxp://107[.]172[.]201[.]137:8086/j[.]ad hxxps://120[.]25[.]236[.]78/dpixel hxxp://173[.]82[.]209[.]248:6666/IE9CompatViewList[.]xml |
Cobalt Strike |
| URL | hxxps://tecnozona[.]site/DW/MainVid3[.]0[.]exe | Coinminer |
| URL | hxxp://471120[.]clmonth[.]nyashteam[.]top/nyashsupport[.]php hxxp://194[.]87[.]82[.]229/linecentralbaseUpdate/Low4/Default5/Game/Php/TempGeo/temporaryCentralMulti/vm/08/Javascript6/longpollprotectcdn[.]php |
DCRat |
| URL | hxxp://kerasiastudios[.]gr/boillinet2[.]1[.]exe hxxp://kerasiastudios[.]gr/bobourn2[.]1[.]exe hxxp://gdesnny[.]ga/flow[.]exe hxxp://kerasiastudios[.]gr/intershev2[.]4[.]exe |
Formbook |
| URL | hxxp://45[.]12[.]253[.]74/pineapple[.]php hxxp://45[.]12[.]253[.]56/advertisting/plus[.]php hxxp://45[.]12[.]253[.]56/advertisting/plus[.]php?s=NOSUB&str=mixtwo&substr=mixkis hxxp://45[.]12[.]253[.]72/default/puk[.]php |
GCleaner |
| URL | hxxps://www[.]luxurypropertiesfl[.]com/impresa/Agenzia[.]zip hxxps://primusth[.]com/impresa/impresa[.]zip hxxps://moodle[.]corplearning[.]net/impresa/Marzo[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/Marzo[.]zip hxxps://msgismakineleri[.]com/impresa/Direzione[.]zip hxxps://primusth[.]com/impresa/azienda[.]zip hxxps://matchtranslations[.]com/impresa/AgenziaEntrate[.]zip hxxps://bookkeepingagents[.]com/impresa/azienda[.]zip hxxps://sirinatpetrol[.]com/impresa/Agenzia_Entrate[.]zip hxxps://jadhaoagroinds[.]com/impresa/cliente[.]zip hxxps://maviproducciones[.]com/impresa/Agenzia_Entrate[.]zip hxxps://moodle[.]corplearning[.]net/impresa/documenti[.]zip hxxps://maviproducciones[.]com/impresa/azienda[.]zip hxxps://matchtranslations[.]com/impresa/azienda[.]zip hxxps://matchtranslations[.]com/impresa/documenti[.]zip hxxps://jadhaoagroinds[.]com/impresa/documenti[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/impresa[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/Direzione[.]zip hxxps://jadhaoagroinds[.]com/impresa/Agenzia[.]zip hxxps://primusth[.]com/impresa/Agenzia[.]zip hxxps://sirinatpetrol[.]com/impresa/AgenziaEntrate[.]zip hxxps://moodle[.]corplearning[.]net/impresa/azienda[.]zip hxxps://moodle[.]corplearning[.]net/impresa/AgenziaEntrate[.]zip hxxps://sirinatpetrol[.]com/impresa/cliente[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/AgenziaEntrate[.]zip hxxps://jadhaoagroinds[.]com/impresa/impresa[.]zip hxxps://bookkeepingagents[.]com/impresa/impresa[.]zip hxxps://bookkeepingagents[.]com/impresa/contratto[.]zip hxxps://maviproducciones[.]com/impresa/Direzione[.]zip hxxps://primusth[.]com/impresa/Marzo[.]zip hxxps://primusth[.]com/impresa/Agenzia_Entrate[.]zip hxxps://matchtranslations[.]com/impresa/contratto[.]zip hxxps://moodle[.]corplearning[.]net/impresa/contratto[.]zip hxxps://moodle[.]corplearning[.]net/impresa/Agenzia[.]zip hxxps://maviproducciones[.]com/impresa/Marzo[.]zip hxxps://maviproducciones[.]com/impresa/contratto[.]zip hxxps://jadhaoagroinds[.]com/impresa/Marzo[.]zip hxxps://msgismakineleri[.]com/impresa/Agenzia[.]zip hxxps://bookkeepingagents[.]com/impresa/Marzo[.]zip hxxps://moodle[.]corplearning[.]net/impresa/impresa[.]zip hxxps://sirinatpetrol[.]com/impresa/documenti[.]zip hxxps://jadhaoagroinds[.]com/impresa/Agenzia_Entrate[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/Agenzia_Entrate[.]zip hxxps://moodle[.]corplearning[.]net/impresa/Agenzia_Entrate[.]zip hxxps://moodle[.]corplearning[.]net/impresa/cliente[.]zip hxxps://moodle[.]corplearning[.]net/impresa/Direzione[.]zip hxxps://sirinatpetrol[.]com/impresa/impresa[.]zip hxxps://msgismakineleri[.]com/impresa/AgenziaEntrate[.]zip hxxps://matchtranslations[.]com/impresa/Agenzia_Entrate[.]zip hxxps://sirinatpetrol[.]com/impresa/Direzione[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/azienda[.]zip hxxps://sirinatpetrol[.]com/impresa/Marzo[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/cliente[.]zip hxxps://sirinatpetrol[.]com/impresa/contratto[.]zip hxxps://maviproducciones[.]com/impresa/impresa[.]zip hxxps://maviproducciones[.]com/impresa/AgenziaEntrate[.]zip hxxps://primusth[.]com/impresa/Direzione[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/contratto[.]zip hxxps://www[.]luxurypropertiesfl[.]com/impresa/documenti[.]zip hxxps://primusth[.]com/impresa/AgenziaEntrate[.]zip hxxps://jadhaoagroinds[.]com/impresa/Direzione[.]zip hxxps://matchtranslations[.]com/impresa/Direzione[.]zip hxxps://matchtranslations[.]com/impresa/Marzo[.]zip hxxps://matchtranslations[.]com/impresa/Agenzia[.]zip hxxps://matchtranslations[.]com/impresa/impresa[.]zip hxxps://matchtranslations[.]com/impresa/cliente[.]zip hxxps://bookkeepingagents[.]com/impresa/documenti[.]zip hxxps://bookkeepingagents[.]com/impresa/cliente[.]zip hxxps://bookkeepingagents[.]com/impresa/Agenzia[.]zip hxxps://bookkeepingagents[.]com/impresa/Agenzia_Entrate[.]zip hxxps://bookkeepingagents[.]com/impresa/Direzione[.]zip hxxps://bookkeepingagents[.]com/impresa/AgenziaEntrate[.]zip hxxps://msgismakineleri[.]com/impresa/Agenzia_Entrate[.]zip hxxps://msgismakineleri[.]com/impresa/azienda[.]zip hxxps://msgismakineleri[.]com/impresa/contratto[.]zip hxxps://msgismakineleri[.]com/impresa/impresa[.]zip hxxps://msgismakineleri[.]com/impresa/Marzo[.]zip hxxps://msgismakineleri[.]com/impresa/documenti[.]zip hxxps://msgismakineleri[.]com/impresa/cliente[.]zip hxxps://sirinatpetrol[.]com/impresa/azienda[.]zip hxxps://sirinatpetrol[.]com/impresa/Agenzia[.]zip hxxps://jadhaoagroinds[.]com/impresa/AgenziaEntrate[.]zip hxxps://primusth[.]com/impresa/cliente[.]zip hxxps://primusth[.]com/impresa/documenti[.]zip hxxps://primusth[.]com/impresa/contratto[.]zip hxxps://jadhaoagroinds[.]com/impresa/azienda[.]zip hxxps://jadhaoagroinds[.]com/impresa/contratto[.]zip hxxps://maviproducciones[.]com/impresa/Agenzia[.]zip hxxps://maviproducciones[.]com/impresa/cliente[.]zip hxxps://maviproducciones[.]com/impresa/documenti[.]zip hxxps://commerce[.]mariagecongo-lais[.]com/impresa/marzo[.]zip hxxp://lavacolla[.]com/connect/index[.]php |
Gozi |
| URL | hxxp://195[.]201[.]252[.]247/rlmp32wlve[.]exe | Laplas |
| URL | hxxp://teleportstation[.]gq/Panel/five/fre[.]php | LokiBot |
| URL | hxxp://111[.]172[.]39[.]72:52972/Mozi[.]m hxxp://115[.]220[.]210[.]178:55658/Mozi[.]m |
Mozi |
| URL | hxxp://185[.]215[.]113[.]84/newtpp[.]exe | Phorpiex |
| URL | hxxps://evilsoftware[.]vip/dwn/%D0%A0%D0%9D%D0%9E%D0%A2%D0%9ES%D0%9D%D0%9E%D0%A02023[.]rar | RecordBreaker |
| URL | hxxp://45[.]155[.]204[.]14/doz[.]exe hxxp://193[.]233[.]20[.]22/male/birma[.]exe hxxp://91[.]215[.]85[.]15/cryp[.]exe hxxp://193[.]233[.]20[.]22/male/serka[.]exe |
RedLine Stealer |
| URL | hxxp://62[.]204[.]41[.]88/lend/rh_0[.]exe hxxp://185[.]246[.]220[.]34/ppi[.]exe |
Rhadamanthys |
| URL | hxxp://79[.]137[.]206[.]226/s[.]exe | SmokeLoader |
| URL | hxxp://192[.]3[.]26[.]135/uo/Bcbcxfcil[.]bmp hxxp://192[.]3[.]101[.]163/4020/vbc[.]exe hxxp://192[.]3[.]26[.]135/765/g8cs[.]exe hxxp://192[.]3[.]26[.]135/u72/ytgg[.]exe |
Snake Keylogger |
| URL | hxxp://www[.]cpasdrole[.]com/handdiy_6[.]exe | Socelars |
| URL | hxxp://91[.]215[.]85[.]213/4a4993f1399adf8e/vcruntime140[.]dll hxxp://91[.]215[.]85[.]213/4a4993f1399adf8e/msvcp140[.]dll hxxp://91[.]215[.]85[.]213/4a4993f1399adf8e/nss3[.]dll hxxp://91[.]215[.]85[.]213/4a4993f1399adf8e/softokn3[.]dll hxxp://91[.]215[.]85[.]213/4a4993f1399adf8e/sqlite3[.]dll hxxp://91[.]215[.]85[.]213/4a4993f1399adf8e/freebl3[.]dll hxxp://91[.]215[.]85[.]213/4a4993f1399adf8e/mozglue[.]dll |
Stealc |
| URL | hxxp://zexeq[.]com/lancer/get[.]php hxxp://zexeq[.]com/test2/get[.]php hxxp://zexeq[.]com/test1/get[.]php |
TeamBot |
| URL | hxxp://kerasiastudios[.]gr/ojekon2[.]1[.]exe | Warzone RAT |
