不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/04/12
※2023/04/12 更新
マルウェア感染させると考えられるURLを検知（2023/04/12）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://hlcrn[.]cloudid[.]teacherhamish[.]com/gotoCheckout hxxps://xhno[.]cloudid[.]teacherhamish[.]com/gotoCheckout hxxps://jxwk[.]cloudid[.]teacherhamish[.]com/gotoCheckout hxxps://craj[.]cloudid[.]teacherhamish[.]com/gotoCheckout |
FAKEUPDATES |
| URL | hxxp://45[.]15[.]156[.]233/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://45[.]15[.]156[.]233/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://45[.]15[.]156[.]233/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://45[.]15[.]156[.]233/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://45[.]15[.]156[.]233/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://45[.]15[.]156[.]233/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://45[.]15[.]156[.]233/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll |
RecordBreaker |
| URL | hxxps://demo[.]app[.]cims[.]com[.]sa/tmp/index[.]php | SmokeLoader |
| URL | hxxp://85[.]217[.]144[.]143/files/123[.]exe | LgoogLoader |
| URL | hxxp://94[.]142[.]138[.]131/api/firegate[.]php | PrivateLoader |
| URL | hxxp://179[.]43[.]154[.]148/fjgD555c3/Login[.]php hxxp://77[.]73[.]134[.]15/dF30Hn4m/Login[.]php hxxp://77[.]91[.]78[.]242/0bjdn2Z/Login[.]php hxxp://88[.]218[.]60[.]230/Gb2dZz/index[.]php hxxp://193[.]201[.]9[.]67/gallery/photo_112[.]exe hxxp://193[.]201[.]9[.]43/plays/chapter/index[.]php hxxp://80[.]66[.]79[.]86/joomla/index[.]php hxxp://193[.]201[.]9[.]43/plays/chapter/Plugins/clip64[.]dll hxxp://80[.]66[.]79[.]86/joomla/Plugins/clip64[.]dll |
Amadey |
| URL | hxxp://185[.]224[.]129[.]51:8080/modlib/o6u3ke[.]661c hxxp://45[.]15[.]159[.]42/XSS1[.]exe |
Rhadamanthys |
| URL | hxxps://madputl[.]com/ap3b[.]exe | Emotet |
| URL | hxxp://146[.]0[.]36[.]62/Demon[.]arm4 hxxp://146[.]0[.]36[.]62/Demon[.]arm5 |
Bashlite |
| URL | hxxp://135[.]181[.]89[.]118/auth hxxp://168[.]119[.]234[.]111/auth hxxp://185[.]216[.]13[.]190/auth hxxp://95[.]216[.]154[.]91/auth hxxp://79[.]137[.]205[.]173/auth hxxp://82[.]115[.]223[.]34/auth hxxp://79[.]137[.]203[.]193/auth hxxp://45[.]15[.]156[.]176/auth |
Aurora Stealer |
| URL | hxxp://62[.]108[.]40[.]105/iy/bin-crypted[.]exe hxxp://45[.]88[.]66[.]207/newone/index[.]php hxxp://171[.]22[.]30[.]147/abbey/index[.]php hxxp://62[.]108[.]40[.]105/iy/Jhrkxmekol[.]exe hxxp://dblg023[.]shop/bill1/index[.]php |
Azorult |
| URL | hxxp://turkie[.]ac[.]ug/url/yk/rem[.]exe | Remcos |
| URL | hxxp://179[.]43[.]175[.]187/wmbl/Build1[.]exe hxxp://179[.]43[.]175[.]187/wmbl/house[.]hta hxxp://179[.]43[.]175[.]187/wmbl/Skillz[.]exe hxxp://179[.]43[.]175[.]187/wmbl/FF[.]exe hxxp://179[.]43[.]175[.]187/wmbl/fit[.]exe hxxp://193[.]233[.]20[.]36/lend/Cuttoes[.]exe hxxp://179[.]43[.]175[.]187/ksjy/Shit[.]exe hxxp://104[.]168[.]46[.]107/430/vbc[.]exe hxxp://104[.]168[.]46[.]107/30[.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.][.]30[.][.][.][.][.][.][.][.][.][.][.][.][.][.][.]doc hxxp://179[.]43[.]175[.]187/ksjy/Newfile[.]exe hxxp://179[.]43[.]175[.]187/ksjy/wfile[.]exe hxxp://179[.]43[.]175[.]187/ksjy/winfile[.]exe hxxp://179[.]43[.]175[.]187/ksjy/FILE[.]exe hxxp://179[.]43[.]175[.]187/ksjy/JD285[.]exe hxxp://179[.]43[.]175[.]187/ksjy/D1[.]exe hxxp://179[.]43[.]175[.]187/ksjy/skillzoflife[.]exe |
zgRAT |
| URL | hxxp://45[.]15[.]157[.]136/shared/Ruzvelt[.]exe | Vidar |
| URL | hxxp://62[.]204[.]41[.]45:8092/j[.]ad hxxp://103[.]30[.]17[.]40/dpixel hxxps://103[.]30[.]17[.]40/dpixel hxxps://101[.]33[.]219[.]90:5566/dpixel hxxps://bbc[.]cctv03[.]tk:8443/en_US/all[.]js hxxps://sedarait[.]com/oscp/ hxxp://81[.]71[.]68[.]50:8066/cm hxxp://1[.]12[.]62[.]177:35465/en_US/all[.]js hxxps://175[.]178[.]151[.]92/match hxxp://110[.]40[.]214[.]45/dot[.]gif hxxps://192[.]3[.]103[.]77/ptj hxxp://18[.]192[.]11[.]175/conf hxxp://104[.]168[.]68[.]177:4321/ptj hxxp://180[.]76[.]96[.]230/ca hxxp://110[.]41[.]131[.]105/fwlink hxxp://121[.]37[.]191[.]139/j[.]ad hxxp://49[.]235[.]92[.]228:801/updates[.]rss hxxp://175[.]178[.]42[.]176:9999/ca hxxps://47[.]93[.]60[.]109/updates[.]rss hxxp://175[.]178[.]147[.]242:8888/cm hxxp://124[.]220[.]191[.]24/j[.]ad hxxp://45[.]148[.]120[.]149/pixel hxxp://124[.]223[.]156[.]185:4444/dpixel hxxp://45[.]76[.]204[.]69/updates[.]rss hxxp://120[.]48[.]71[.]139:88/pixel[.]gif hxxp://205[.]185[.]121[.]102:8080/load hxxp://121[.]37[.]179[.]61:6666/dpixel hxxp://82[.]156[.]28[.]224:8088/ptj hxxps://192[.]3[.]103[.]77/dpixel hxxp://23[.]224[.]143[.]23:8000/visit[.]js hxxps://121[.]4[.]127[.]235/pixel hxxp://47[.]87[.]138[.]83:8999/load hxxps://1[.]13[.]2[.]80/match hxxps://api[.]tanksw[.]top/pixel[.]gif hxxps://1[.]13[.]168[.]170:8443/api/v1/nsquery hxxp://103[.]234[.]72[.]176:555/push hxxps://aerosunelectric[.]com/br[.]css hxxps://lxnft[.]org/maps/overlaybfpr hxxp://139[.]144[.]44[.]74/cm hxxp://8[.]140[.]36[.]157:8001/dot[.]gif hxxp://43[.]139[.]136[.]243/en_US/all[.]js hxxps://23[.]224[.]143[.]23:8080/visit[.]js hxxp://mirrordirectory[.]com/updates[.]rss hxxps://mirrordirectory[.]com/j[.]ad hxxps://81[.]68[.]97[.]4:59039/updates[.]rss hxxps://im[.]polourize[.]com/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://139[.]144[.]44[.]74/cx |
Cobalt Strike |
| URL | hxxp://45[.]15[.]159[.]42/XSS2[.]exe | Coinminer |
| URL | hxxp://208[.]67[.]105[.]179/atlaszx[.]exe | Formbook |
| URL | hxxp://37[.]49[.]230[.]54/da8682eaa858cf19008c5a71152343b0 hxxp://37[.]49[.]230[.]54/813e6f7aa373047a84dfbc31315a38a0 hxxp://37[.]49[.]230[.]54/4ca2cf91c151dccbc3a272205026c13b |
Raccoon |
| URL | hxxps://ianjesuscr[.]org/3nSn/ hxxps://cientificagroup[.]com/ARvDiE/ hxxps://medicaintl[.]com/CmyH/ hxxps://nomadlove[.]com[.]br/VR8f/ hxxps://conectabrazilnewbank[.]com/vyxB/ hxxps://alkanaria-uae[.]com/3iv/ hxxps://institutoekballo[.]org/DuZjN/ hxxps://iluminareodonto[.]com[.]br/8K3IA/ hxxps://diabeflix[.]club/Q6py/ hxxps://bsdtreeinc[.]com/5DY/ hxxps://smknspplampung[.]sch[.]id/pqdm/pqdm[.]php hxxps://ryse[.]com[.]mx/edia/edia[.]php hxxps://thannong[.]net/musr/musr[.]php hxxps://unitedcomm[.]pk/cdun/cdun[.]php hxxps://zokeyo[.]uk/ti/ti[.]php hxxps://tyxod[.]com[.]ng/uist/uist[.]php hxxps://instalaire[.]cl/liau/liau[.]php hxxps://pizzamoretti[.]mk/emir/emir[.]php hxxps://l-artisto[.]com/isn/isn[.]php hxxps://mscs-bcsir[.]org/qae/qae[.]php hxxps://nutralyst[.]co/titu/titu[.]php hxxps://luckyseven[.]com[.]pk/pes/pes[.]php hxxps://iadcnigeria[.]org/loo/loo[.]php hxxps://locationappartementmarrakech[.]com/qts/qts[.]php hxxps://joyland[.]co[.]tz/tiue/tiue[.]php hxxps://abrinde[.]net/boi/boi[.]php hxxps://asmindo[.]or[.]id/quad/quad[.]php hxxps://eplheadlines[.]com/tba/tba[.]php hxxps://aastha-restaurant[.]de/uoq/uoq[.]php hxxps://cemmixco[.]edu[.]gt/uqt/uqt[.]php hxxps://bendzasvadbe[.]biz/ente/ente[.]php hxxps://collemino[.]it/ec/ec[.]php hxxps://designart[.]com[.]tr/sdt/sdt[.]php hxxps://cinematalkies[.]in/mrm/mrm[.]php hxxps://crimevartha[.]in/rspt/rspt[.]php hxxp://codas-thompson[.]com[.]py/eamu/eamu[.]php hxxp://info-center[.]rw/eut/eut[.]php hxxp://centro-froebel[.]edu[.]mx/pttu/pttu[.]php hxxps://vivastreet[.]asia/aim/aim[.]php hxxps://quaint-tech[.]com/cud/cud[.]php hxxps://pulsodelsur[.]com/pumi/pumi[.]php hxxps://quickbestprice[.]com/ce/ce[.]php hxxps://watersedgebunbury[.]com[.]au/ivd/ivd[.]php hxxps://sunmobiles[.]in/qsd/qsd[.]php hxxps://securenet[.]quest/nd/nd[.]php hxxps://shopozo[.]in/ltu/ltu[.]php hxxps://seguridadbouncer[.]com[.]pe/lem/lem[.]php hxxps://techpurenet[.]com/pc/pc[.]php hxxps://vmarin[.]site/aidt/aidt[.]php hxxps://yilkes[.]com[.]tr/aim/aim[.]php hxxps://pontoway[.]com[.]br/ao/ao[.]php hxxps://telefactura[.]cl/no/no[.]php hxxps://sportfiles[.]co[.]uk/iar/iar[.]php hxxps://socialcoz[.]eu/sse/sse[.]php hxxps://technoleaf[.]qa/ella/ella[.]php hxxps://ukcbc[.]ac[.]uk/irp/irp[.]php hxxps://tiroch[.]com[.]br/tti/tti[.]php hxxps://snrsssolakhpur[.]edu[.]np/iq/iq[.]php hxxps://pimjai[.]no/rcve/rcve[.]php hxxps://topnotchlegal[.]com[.]au/taq/taq[.]php hxxps://rigon[.]com[.]py/ua/ua[.]php hxxps://rolexindia[.]in/in/in[.]php hxxps://seedsbob[.]com/qo/qo[.]php hxxps://seatrade[.]ma/ue/ue[.]php hxxps://proinvestminingoption[.]co[.]uk/uemq/uemq[.]php hxxps://stroll-in[.]ng/ntie/ntie[.]php hxxps://prowtext[.]in/bms/bms[.]php hxxps://roughedgesmerchandise[.]com/se/se[.]php hxxps://tm[.]rcm[.]edu[.]ng/or/or[.]php hxxps://souperito[.]com[.]br/sqqu/sqqu[.]php hxxps://rar[.]ust[.]md/raee/raee[.]php hxxps://tekwini[.]gov[.]mr/arom/arom[.]php hxxps://quesota[.]xyz/em/em[.]php hxxps://steelsynergy[.]ro/uah/uah[.]php hxxps://phoenixpartners[.]com[.]ng/atu/atu[.]php hxxps://thefashionfirm[.]co[.]za/ic/ic[.]php hxxps://superplay[.]app/utin/utin[.]php hxxps://wealthytravelagency[.]co/lap/lap[.]php hxxps://tmportal[.]rcm[.]edu[.]ng/plru/plru[.]php hxxps://thepridehaus[.]com/im/im[.]php hxxps://sha-d[.]co[.]il/ufss/ufss[.]php hxxps://teemgreen[.]online/er/er[.]php hxxps://rematech[.]hu/ec/ec[.]php hxxps://thebee4bees[.]com/uinf/uinf[.]php hxxps://idrogeolab[.]it/ao/ao[.]php hxxps://lojadaslojas[.]com[.]br/amoe/amoe[.]php hxxps://ktr-kuplung[.]hu/rt/rt[.]php hxxps://mteesolutions[.]co[.]za/mr/mr[.]php hxxps://gaheto[.]com/eset/eset[.]php hxxps://liveconsultancy[.]in/calt/calt[.]php hxxps://majisaart[.]in/aec/aec[.]php hxxps://negdar[.]dd[.]sa/ne/ne[.]php hxxps://moontaxiandlimousines[.]com/enif/enif[.]php hxxps://healthroomzone[.]xyz/aate/aate[.]php hxxps://doktoronlne[.]com/ai/ai[.]php hxxps://hotelmonopolijakarta[.]com/rfco/rfco[.]php hxxps://ipsacs[.]com/pma/pma[.]php hxxps://mileinvestments[.]pk/uru/uru[.]php hxxps://ilikeshop[.]cl/rsqq/rsqq[.]php hxxps://mobilserwis[.]pl/uac/uac[.]php hxxps://isaacentebi[.]com/pole/pole[.]php hxxps://drillaltd[.]co[.]uk/dro/dro[.]php hxxps://joydrilingdeliverencechurch[.]com/eles/eles[.]php hxxps://masteryourminds[.]com/mn/mn[.]php hxxps://logiex[.]info/ent/ent[.]php hxxps://jangocouture[.]com/qe/qe[.]php hxxps://newtrackstar[.]xyz/quur/quur[.]php hxxps://far-clar[.]ro/eixd/eixd[.]php hxxps://jariperkasa[.]com/itte/itte[.]php hxxps://llenergia[.]com[.]br/se/se[.]php hxxps://luxuriescrown[.]com/uaee/uaee[.]php hxxps://eurocaseroma[.]com/sta/sta[.]php hxxps://gulfcoastrenovation[.]com/seu/seu[.]php hxxps://kingscabs[.]co[.]uk/nm/nm[.]php hxxps://emedic[.]com[.]pk/cot/cot[.]php hxxps://karesolutions[.]co/qe/qe[.]php hxxps://flotillas360[.]com[.]mx/np/np[.]php hxxps://notebookprokash[.]com/ied/ied[.]php hxxps://devf5r[.]com/ll/ll[.]php hxxps://digitalcomputer[.]cl/se/se[.]php hxxps://fairweatherdavies[.]com[.]au/frif/frif[.]php hxxps://nbcmedia[.]co/utni/utni[.]php hxxps://nilkhet[.]xyz/os/os[.]php hxxps://peach[.]lk/ruos/ruos[.]php hxxps://nvl[.]uts[.]com[.]pk/sr/sr[.]php hxxps://emmyemagrobiz[.]ng/nu/nu[.]php hxxps://moodle[.]ust[.]md/mie/mie[.]php hxxps://molilife[.]com/deui/deui[.]php hxxps://greenpasturesch[.]com[.]ng/it/it[.]php hxxps://dixykidderminster[.]co[.]uk/iu/iu[.]php hxxps://labssol[.]com/tsno/tsno[.]php hxxps://ensjsi[.]dz/tve/tve[.]php hxxps://morla[.]info/da/da[.]php hxxps://meeask[.]com/usta/usta[.]php hxxps://manchesterwholesales[.]com/ao/ao[.]php hxxps://maconsi[.]com[.]ec/ef/ef[.]php hxxp://mugiaitri[.]co/lb/lb[.]php hxxps://aromagrill[.]pk/iem/iem[.]php hxxps://abrcadabra[.]it/ptar/ptar[.]php hxxps://cafeterasindustriales[.]com[.]mx/oqvu/oqvu[.]php hxxps://bmg-kw[.]com/ic/ic[.]php hxxps://cargoglobal[.]co/ci/ci[.]php hxxps://awmc[.]ge/lti/lti[.]php hxxps://azile[.]co[.]za/nio/nio[.]php hxxps://bbt[.]org[.]br/no/no[.]php hxxps://armeriaeantiquariato[.]it/pr/pr[.]php hxxps://concretefoundation[.]co[.]za/se/se[.]php hxxps://beamfastcleaning[.]ae/eeii/eeii[.]php hxxp://mafg[.]ro/tad/tad[.]php hxxps://adshub[.]it/lrop/lrop[.]php hxxp://mavmetall[.]com[.]ar/in/in[.]php hxxps://athanassopoulos[.]gr/dite/dite[.]php hxxp://twinangel[.]co[.]zw/ppir/ppir[.]php hxxps://carteiraonline[.]net/lc/lc[.]php hxxp://121directmarketing[.]com/auq/auq[.]php hxxp://totemuyas[.]com[.]uy/de/de[.]php hxxps://cres[.]cae[.]ge/dqi/dqi[.]php hxxps://alse[.]com[.]tr/ugai/ugai[.]php hxxps://comunet[.]psi[.]br/urol/urol[.]php hxxps://artgallery[.]agency/xe/xe[.]php hxxp://innovaingenieria[.]com[.]pe/uop/uop[.]php hxxps://alliedresources[.]sa/omue/omue[.]php hxxps://agcs[.]com[.]bd/ta/ta[.]php hxxps://9799[.]info/ictu/ictu[.]php hxxps://ciccde[.]edu[.]py/ma/ma[.]php hxxp://alimimportaciones[.]com/tiec/tiec[.]php hxxps://alphaechurch[.]com/er/er[.]php hxxps://cilafrique[.]com/io/io[.]php hxxps://coolcivilengineering[.]com/ircb/ircb[.]php hxxps://carservice-kuw[.]com/seit/seit[.]php hxxps://azcotech[.]ae/qeou/qeou[.]php hxxps://clinicacardiocare[.]com[.]br/etut/etut[.]php hxxps://aleez[.]online/rein/rein[.]php hxxp://hilariohendges[.]com[.]br/up/up[.]php hxxp://globalsoulconnexion[.]com/nmio/nmio[.]php hxxps://care360[.]pk/on/on[.]php hxxp://dispecerat[.]ro/unv/unv[.]php hxxps://biet[.]in/nor/nor[.]php hxxp://iwithyou[.]org/qta/qta[.]php hxxps://3curvesllc[.]com/im/im[.]php hxxp://platinumcableinternet[.]com/lsua/lsua[.]php hxxp://tvmacizle[.]com/op/op[.]php hxxp://taisirulquranbd[.]com/rq/rq[.]php hxxps://xlsurgical[.]com/ea/ea[.]php hxxps://usrolloffdumpsters[.]com/ees/ees[.]php hxxps://turkogluhali[.]com/ofo/ofo[.]php hxxps://visualneststudio[.]com/eti/eti[.]php hxxp://xraycoach[.]com/ht/ht[.]php hxxps://wonderlabsgt[.]com/ru/ru[.]php hxxps://wayverrentals[.]com/foi/foi[.]php hxxps://wilticket[.]com/ste/ste[.]php hxxp://webcarebd[.]com/gc/gc[.]php hxxps://wayhoty[.]com/cees/cees[.]php hxxps://tubabuilderanddeveloper[.]com/eeru/eeru[.]php hxxp://veggyscambodia[.]com/ro/ro[.]php hxxps://writesongs[.]com/etao/etao[.]php hxxps://visserpaintingservices[.]com/isxd/isxd[.]php hxxps://anzomarketing[.]com/ene/ene[.]php hxxps://antoinedesulme[.]com/otmo/otmo[.]php hxxps://goldcoastswimmingpools[.]com/icmt/icmt[.]php hxxps://ajanicustomdesigns[.]com/peim/peim[.]php hxxps://bdanam[.]com/lt/lt[.]php hxxps://mokshgnatechnologies[.]com/clof/clof[.]php hxxps://ipvisiontv[.]com/le/le[.]php hxxps://reviewholdings[.]com/iutr/iutr[.]php hxxps://primeabonnement[.]com/lti/lti[.]php hxxps://beholda[.]com/apvu/apvu[.]php hxxps://thelivinbrand[.]com/is/is[.]php hxxps://tehranbeat[.]com/cfq/cfq[.]php hxxps://dixontelbolivia[.]com/ld/ld[.]php hxxps://prologycomsas[.]com/un/un[.]php hxxps://elkekhiagroup[.]com/le/le[.]php hxxps://rud-development[.]com/meux/meux[.]php hxxps://superiorexamtakers[.]com/qpu/qpu[.]php hxxps://iskillagency[.]com/ae/ae[.]php hxxps://hollywoodkidderminster[.]com/ta/ta[.]php hxxps://alateeqi[.]com/cr/cr[.]php hxxps://khayrukum[.]com/tu/tu[.]php hxxps://friendsfpt[.]com/ei/ei[.]php hxxps://redlineautogarage[.]com/ccqu/ccqu[.]php hxxps://aimahapparel[.]com/esdo/esdo[.]php hxxps://paxalphaltd[.]com/usr/usr[.]php hxxps://guaranteecu[.]com/is/is[.]php hxxps://aussiepesach[.]com/psti/psti[.]php hxxps://loginbola168[.]com/rm/rm[.]php hxxps://itravbeirute[.]com/te/te[.]php hxxps://ovitanics[.]com/usu/usu[.]php hxxps://inducosperu[.]com/taer/taer[.]php hxxps://anadolukahvefestivali[.]com/ed/ed[.]php hxxps://galexapp[.]com/ep/ep[.]php hxxps://krieshnaweb[.]com/setv/setv[.]php hxxps://anzglobalsoft[.]com/re/re[.]php hxxps://bondima[.]com/rr/rr[.]php hxxps://pharmaccare[.]com/aosi/aosi[.]php hxxps://littlereaderslibrary[.]com/chvl/chvl[.]php hxxps://dowaline[.]com/aiv/aiv[.]php hxxp://simbafoamltd[.]com/emtu/emtu[.]php hxxps://chcizb[.]com/spg/spg[.]php hxxps://ahmedartworks[.]com/tee/tee[.]php hxxps://socialifter[.]com/tpa/tpa[.]php hxxps://americangreenlandestate[.]com/doe/doe[.]php hxxps://smartepicengineering[.]com/mla/mla[.]php hxxps://marylouretton[.]com/lueo/lueo[.]php hxxps://taktsys[.]com/li/li[.]php hxxps://i800services[.]com/oee/oee[.]php hxxps://khushbuenterprise[.]com/si/si[.]php hxxps://ginzamotors[.]com/at/at[.]php hxxps://stmarybahrain[.]com/tiie/tiie[.]php hxxps://rfcodevelopment[.]com/ia/ia[.]php hxxps://alredhahsteelworkshop[.]com/oi/oi[.]php hxxps://mscseller[.]com/ra/ra[.]php hxxps://kodakmomentsng[.]com/miti/miti[.]php hxxps://beynelxalqtehsil[.]com/ai/ai[.]php hxxps://balloonshower[.]com/ue/ue[.]php hxxps://braineeshopping[.]com/cadu/cadu[.]php hxxps://clypai[.]com/ul/ul[.]php hxxps://allleaguebaseball[.]com/pp/pp[.]php hxxps://sandbardunedin[.]com/umnq/umnq[.]php hxxps://jktradingcompany[.]com/iu/iu[.]php hxxps://marketingplatformmena[.]com/armi/armi[.]php hxxps://parvejsmmfollw[.]com/eip/eip[.]php hxxps://auctusmagnum[.]com/uuq/uuq[.]php hxxps://serengeticargo[.]com/td/td[.]php hxxps://bmakers-sa[.]com/ae/ae[.]php hxxps://programmerlogics[.]com/pms/pms[.]php hxxps://pedroibagaza[.]com/eloo/eloo[.]php hxxps://berfomoclinic[.]com/ee/ee[.]php hxxps://speedyhomework[.]com/uu/uu[.]php hxxps://posadasanagustin[.]com/end/end[.]php hxxps://ptbolaslot[.]com/ab/ab[.]php hxxps://lightofchristfoundation[.]com/paus/paus[.]php hxxps://timeratechnologies[.]com/la/la[.]php hxxps://astrowavefx[.]com/eed/eed[.]php hxxps://juridicasparlotcolombia[.]com/gaf/gaf[.]php hxxps://subeinfotech[.]com/oo/oo[.]php hxxps://ptbolasatu[.]com/tuut/tuut[.]php hxxps://landskape360[.]com/net/net[.]php hxxps://pbpdisbunkaltim[.]com/te/te[.]php hxxps://oduduwa-europe-shop[.]com/tv/tv[.]php hxxps://rockwoodmachinery[.]com/qta/qta[.]php hxxps://susypa[.]com/imn/imn[.]php hxxps://ilampagency[.]com/cel/cel[.]php hxxps://rentcarshow[.]com/tt/tt[.]php hxxps://baywoodgrp[.]com/id/id[.]php hxxps://magicshvac[.]com/iei/iei[.]php hxxps://shadyhakim[.]com/iee/iee[.]php hxxps://coreconnectionuk[.]com/iq/iq[.]php hxxps://bessobike[.]com/ttu/ttu[.]php hxxps://poriptv[.]com/otu/otu[.]php hxxps://jellysystems[.]com/qdui/qdui[.]php hxxps://cherryberryrms[.]com/aie/aie[.]php hxxps://danishlaptops[.]com/essb/essb[.]php hxxps://ejoar[.]com/una/una[.]php hxxps://imperialconcretesawinginc[.]com/eil/eil[.]php hxxps://polipanelgroup[.]com/eteo/eteo[.]php hxxps://atatingcilik[.]com/oree/oree[.]php hxxps://crossmanufacturinguk[.]com/ada/ada[.]php hxxps://lanonnaspizzeria[.]com/tia/tia[.]php hxxps://simedarbyltd[.]com/aol/aol[.]php hxxps://cdescape[.]com/fts/fts[.]php hxxps://judynaimo[.]com/iirl/iirl[.]php hxxps://ciessecisnc[.]com/eeas/eeas[.]php hxxps://safuucrypto[.]com/ia/ia[.]php hxxp://sjprofesionales[.]com/tuo/tuo[.]php hxxp://glorchive[.]com/aiim/aiim[.]php hxxps://1127underpressure[.]com/rop/rop[.]php hxxp://freedownloadapss[.]com/tti/tti[.]php hxxp://milatin[.]com/po/po[.]php hxxp://abutabaneh[.]com/sms/sms[.]php hxxp://khmerbilling[.]com/uroo/uroo[.]php hxxps://adspeet[.]com/ma/ma[.]php hxxp://balikesirtirtamircisi[.]com/rao/rao[.]php hxxp://exceldeliverycompany[.]com/is/is[.]php hxxp://corporacionroyalclass[.]com/rsl/rsl[.]php hxxps://mftinternet[.]com/ui/ui[.]php hxxps://tradewithnajamahmed[.]com/tor/tor[.]php hxxps://servitecmach[.]com/ieam/ieam[.]php hxxps://soussbat[.]com/um/um[.]php hxxps://penmanpapers[.]com/ute/ute[.]php hxxps://bibge[.]com/qaim/qaim[.]php hxxps://agadirexcursion[.]com/aout/aout[.]php hxxp://149[.]102[.]243[.]204/vodka[.]dat hxxp://51[.]222[.]199[.]244/vodka[.]dat hxxp://87[.]236[.]146[.]34/vodka[.]dat hxxp://45[.]66[.]248[.]187/vodka[.]dat hxxp://5[.]42[.]221[.]124/vodka[.]dat hxxp://45[.]159[.]249[.]33/vodka[.]dat hxxps://blogonnet[.]com/blo/me[.]zip hxxps://eugbc[.]net/blo/me[.]zip hxxp://mdea[.]gob[.]pe/blo/me[.]zip hxxp://dubaiframeticket[.]com/blo/me[.]zip hxxp://epec[.]com[.]bd/blo/me[.]zip hxxp://smartfact[.]pe/blo/me[.]zip hxxp://1tenshipping[.]com/blo/me[.]zip hxxp://globallinks-fas[.]com/blo/me[.]zip hxxp://datasafe-services[.]co[.]uk/blo/me[.]zip hxxp://tremac[.]hr/blo/me[.]zip hxxp://staging[.]tripscon[.]com/blo/me[.]zip hxxp://zainmotors2008[.]com/blo/me[.]zip hxxp://megashops[.]com[.]br/blo/me[.]zip hxxp://availguide[.]com/blo/me[.]zip hxxp://ytdown[.]site/blo/me[.]zip hxxp://autonaprawa[.]org[.]pl/blo/me[.]zip hxxp://ldsinternacional[.]com/blo/me[.]zip hxxp://computaciontandil[.]com/blo/me[.]zip hxxp://eugbc[.]net/blo/me[.]zip hxxp://blogonnet[.]com/blo/me[.]zip hxxp://rpalma[.]com[.]br/blo/me[.]zip hxxp://akimile[.]com[.]pe/blo/me[.]zip hxxp://thespringsportal[.]org/blo/me[.]zip hxxp://dalexglobal[.]com/blo/me[.]zip hxxp://jangocouture[.]com/blo/me[.]zip hxxps://lawyerkh[.]com/blo/me[.]zip hxxp://masteryourminds[.]com/blo/me[.]zip hxxp://eo-serije[.]com/blo/me[.]zip hxxp://flaxeninfosoft[.]in/blo/me[.]zip hxxp://boticamedicalmarket[.]com[.]pe/blo/me[.]zip hxxp://watersedgebunbury[.]com[.]au/blo/me[.]zip hxxp://quseynoff[.]com/blo/me[.]zip hxxp://klikworx[.]com/blo/me[.]zip hxxp://impexpower[.]com/blo/me[.]zip hxxp://l2solucoes[.]com[.]br/blo/me[.]zip hxxp://forxtra[.]com/blo/me[.]zip hxxp://terrasdepiri[.]com[.]br/blo/me[.]zip hxxp://lawyerkh[.]com/blo/me[.]zip hxxps://torzilliseguros[.]com[.]ar/blo/me[.]zip hxxp://javaherbal[.]co[.]id/blo/me[.]zip hxxp://knowledgeelitegame[.]xyz/blo/me[.]zip hxxp://nugerirx[.]com/blo/me[.]zip hxxps://devscorner[.]net/blo/me[.]zip hxxp://kemonp[.]com/blo/me[.]zip hxxp://mothercolor[.]com/blo/me[.]zip hxxp://staging-api[.]tripscon[.]com/blo/me[.]zip hxxps://klikworx[.]com/blo/me[.]zip hxxps://datasafe-services[.]co[.]uk/blo/me[.]zip hxxp://blogmedia[.]ge/blo/me[.]zip hxxp://delivaroobd[.]com/blo/me[.]zip hxxp://engaging[.]media/blo/me[.]zip hxxp://alertasecurity[.]net/blo/me[.]zip hxxp://eurofarm[.]ge/blo/me[.]zip hxxp://curriculovirtual[.]com/blo/me[.]zip hxxp://torzilliseguros[.]com[.]ar/blo/me[.]zip hxxp://devscorner[.]net/blo/me[.]zip hxxps://yatratheconnection[.]com/blo/me[.]zip hxxp://lafilgroup[.]com/blo/me[.]zip hxxp://hos[.]com[.]pk/blo/me[.]zip hxxp://excessinteriors[.]in/blo/me[.]zip hxxp://itpcorbeanca[.]ro/blo/me[.]zip hxxp://yatratheconnection[.]com/blo/me[.]zip |
QakBot |
| URL | hxxps://intercross[.]shop/index/kXFpZBb[.]exe | Quasar RAT |
| URL | hxxp://91[.]151[.]88[.]63/2eternalMariadbmulti/29BaseVoiddb/Auth/Sql7Dump/5/7geo/ImageupdateRequestdatalife/mariadb/Better/jsPolllowprocessorLongpoll[.]php | DCRat |
| URL | hxxps://autocars-sapporo[.]com/content[.]php hxxps://avls[.]com[.]ph/content[.]php hxxps://backlogworld[.]demodemo[.]link/content[.]php hxxps://app[.]ykasandbox[.]com/content[.]php hxxps://avada2[.]ladygym[.]ro/content[.]php hxxps://avindustry[.]org/content[.]php hxxps://ancrages[.]ca/content[.]php hxxps://beachfront[.]demodemo[.]link/content[.]php hxxps://benettonrugby[.]it/content[.]php hxxps://api-help[.]100px[.]com/content[.]php hxxps://beauty[.]audreylyllian[.]com[.]br/content[.]php hxxps://bassanglersofmichigan[.]com/content[.]php hxxps://benlloc[.]es/content[.]php hxxps://bams[.]co/content[.]php hxxps://bagat24[.]de/content[.]php hxxps://asi-instruments[.]com/content[.]php hxxps://bddlandscaping[.]com/content[.]php hxxps://avocadobar[.]mls-test[.]ch/content[.]php hxxps://amatus[.]office[.]thexroadz[.]com/content[.]php hxxps://azitgroup[.]com[.]au/content[.]php hxxps://baltimorecreditrepair[.]info/content[.]php hxxps://atlantacreditrepair[.]info/content[.]php hxxps://atopicschool[.]co[.]il/content[.]php hxxps://baohomnay365[.]com/content[.]php hxxps://bbqaddicts[.]fr/content[.]php hxxps://bctambore[.]com[.]br/content[.]php hxxps://bellevue-tourtour[.]com/content[.]php hxxps://art[.]barakaconsultants[.]com/content[.]php hxxps://augustynbaran[.]pl/content[.]php |
GootLoader |
