不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/05/22
※2023/05/22 更新
マルウェア感染させると考えられるURLを検知（2023/05/22）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://77[.]91[.]68[.]16/gallery/photo230[.]exe hxxp://77[.]91[.]124[.]20/DSC01491/foto0195[.]exe hxxp://171[.]22[.]30[.]164/philipzx[.]exe |
RedLine Stealer |
| URL | hxxp://159[.]223[.]7[.]35/S3J9X4E1U3X5U3/62600026163974233250[.]bin hxxp://159[.]223[.]7[.]35/S3J9X4E1U3X5U3/73270872782605626238[.]bin hxxp://94[.]142[.]138[.]79/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://94[.]142[.]138[.]79/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://94[.]142[.]138[.]79/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://94[.]142[.]138[.]79/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://94[.]142[.]138[.]79/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://94[.]142[.]138[.]79/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll |
RecordBreaker |
| URL | hxxp://161[.]35[.]102[.]56/~nikol/?p=33426451 hxxp://171[.]22[.]30[.]164/ugopzx[.]exe hxxp://103[.]170[.]119[.]172/480/vbc[.]exe |
LokiBot |
| URL | hxxp://179[.]43[.]142[.]99/6bad8dda11fd59df/nss3[.]dll hxxp://179[.]43[.]142[.]99/6bad8dda11fd59df/msvcp140[.]dll hxxp://179[.]43[.]142[.]99/6bad8dda11fd59df/softokn3[.]dll hxxp://179[.]43[.]142[.]99/6bad8dda11fd59df/mozglue[.]dll hxxp://179[.]43[.]142[.]99/6bad8dda11fd59df/sqlite3[.]dll hxxp://179[.]43[.]142[.]99/6bad8dda11fd59df/vcruntime140[.]dll hxxp://179[.]43[.]142[.]99/6bad8dda11fd59df/freebl3[.]dll hxxp://193[.]42[.]32[.]206/29b7525be881c8ea[.]php hxxp://193[.]42[.]32[.]206/f1e54b61d5902e6f/vcruntime140[.]dll hxxp://193[.]42[.]32[.]206/f1e54b61d5902e6f/softokn3[.]dll hxxp://193[.]42[.]32[.]206/f1e54b61d5902e6f/mozglue[.]dll hxxp://193[.]42[.]32[.]206/f1e54b61d5902e6f/msvcp140[.]dll hxxp://193[.]42[.]32[.]206/f1e54b61d5902e6f/freebl3[.]dll hxxp://193[.]42[.]32[.]206/f1e54b61d5902e6f/nss3[.]dll hxxp://193[.]42[.]32[.]206/f1e54b61d5902e6f/sqlite3[.]dll hxxp://194[.]180[.]48[.]244/e50a8a413d120466[.]php |
Stealc |
| URL | hxxp://117[.]212[.]173[.]31:42773/Mozi[.]m hxxp://78[.]25[.]93[.]89:39740/Mozi[.]m hxxp://116[.]25[.]39[.]74:34634/Mozi[.]m hxxp://171[.]35[.]243[.]107:56017/Mozi[.]m hxxp://175[.]107[.]13[.]88:53850/Mozi[.]m |
Mozi |
| URL | hxxp://45[.]90[.]222[.]125:7121/maili | WSHRAT |
| URL | hxxp://49[.]0[.]250[.]177/ptj hxxp://194[.]55[.]224[.]169/ca hxxps://104[.]21[.]14[.]245:2083/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://172[.]67[.]160[.]207:2083/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://pycharm-edu[.]us:2083/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://150[.]158[.]11[.]76:8080/g[.]pixel hxxp://92[.]63[.]196[.]48:92/pixel[.]gif hxxps://1[.]15[.]141[.]252/pixel[.]gif hxxps://150[.]158[.]11[.]76/load hxxp://120[.]46[.]169[.]156:8090/pixel[.]gif hxxps://45[.]227[.]252[.]243/cm hxxp://92[.]63[.]196[.]47:9513/__utm[.]gif hxxps://47[.]98[.]216[.]22/cx hxxp://123[.]249[.]5[.]18/IE9CompatViewList[.]xml hxxp://150[.]158[.]11[.]76:801/IE9CompatViewList[.]xml hxxps://158[.]150[.]11[.]76:8888/visit[.]js hxxps://106[.]53[.]109[.]148/index hxxps://81[.]71[.]77[.]164/api/x hxxps://81[.]71[.]10[.]192/about hxxps://106[.]53[.]111[.]113/about hxxp://pycharm-edu[.]us:2082/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://104[.]21[.]14[.]245:2082/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://172[.]67[.]160[.]207:2082/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://1[.]15[.]141[.]252/match hxxp://cdn[.]azureeservices[.]co[.]uk/en_US/all[.]js hxxps://82[.]157[.]253[.]125:8811/cx hxxp://43[.]143[.]26[.]191/activity hxxp://84[.]54[.]50[.]144/push hxxps://123[.]60[.]165[.]221/cx hxxp://43[.]143[.]175[.]188:2096/cm hxxps://45[.]66[.]230[.]25/fwlink hxxp://8[.]140[.]37[.]238:9999/visit[.]js hxxp://124[.]223[.]81[.]59:9012/load hxxp://43[.]142[.]185[.]126:6789/match hxxp://123[.]60[.]165[.]221/dpixel hxxps://8[.]140[.]37[.]238:9090/fwlink hxxp://62[.]204[.]41[.]24/functionalStatus/Jatmp1Jmb7LaCBVxMmGdjdVl02ZI7O hxxp://47[.]97[.]210[.]199:9999/dot[.]gif hxxp://neweastsystem[.]com:8081/ee[.]html hxxp://neweastsystem[.]com:81/ny hxxp://120[.]55[.]100[.]163:4444/push hxxp://178[.]128[.]238[.]89/ab[.]js hxxp://43[.]138[.]215[.]2:7777/match hxxps://62[.]204[.]41[.]24/functionalStatus/Jatmp1Jmb7LaCBVxMmGdjdVl02ZI7O hxxp://103[.]148[.]245[.]218/IE9CompatViewList[.]xml hxxp://8[.]130[.]74[.]211:1111/g[.]pixel hxxp://193[.]42[.]32[.]143/c/msdownload/update/others/2020/10/29136388_ hxxp://cloudupdateservice[.]online/c/msdownload/update/others/2020/10/29136388_ hxxp://81[.]71[.]68[.]50:8011/search/ hxxps://dangofil[.]xyz:8443/api/logout hxxps://cdn[.]azureeservices[.]co[.]uk/g[.]pixel hxxp://43[.]143[.]181[.]205:85/g[.]pixel hxxps://193[.]42[.]32[.]143/c/msdownload/update/others/2020/10/29136388_ hxxps://cloudupdateservice[.]online/c/msdownload/update/others/2020/10/29136388_ hxxps://178[.]128[.]238[.]89/rs[.]js hxxp://206[.]189[.]245[.]2/inform/v6[.]71/LT4TRZAZTPT hxxp://167[.]71[.]245[.]119:8088/c/msdownload/update/others/2020/10/29136388_ hxxp://194[.]135[.]33[.]127/Def/v6[.]81/D7Y58XIA75S6 hxxp://47[.]109[.]70[.]144/updates hxxp://175[.]24[.]201[.]188:8081/updates[.]rss hxxp://47[.]115[.]215[.]26/IE9CompatViewList[.]xml hxxp://216[.]127[.]175[.]18:801/fwlink hxxp://49[.]232[.]90[.]103:8111/match hxxps://vindowsupdt[.]ru/c/msdownload/update/others/2021/11/29136388_ hxxp://45[.]139[.]105[.]143:8089/match hxxp://45[.]136[.]187[.]69:12345/dot[.]gif hxxp://43[.]139[.]52[.]123:82/g[.]pixel hxxp://140[.]238[.]28[.]213/ptj hxxp://47[.]97[.]210[.]199:48897/dpixel hxxp://139[.]9[.]216[.]32:9999/cm hxxp://midasusme[.]uk/cx hxxp://8[.]217[.]79[.]173:8080/fwlink hxxp://cs[.]siakapkeli[.]net:8080/__utm[.]gif hxxp://35[.]207[.]107[.]211:8811/owa/ hxxp://47[.]92[.]199[.]215:8888/match hxxp://198[.]13[.]59[.]58:888/g[.]pixel hxxp://167[.]71[.]245[.]119:8190/c/msdownload/update/others/2020/10/29136388_ hxxp://139[.]9[.]244[.]125/j[.]ad hxxps://62[.]204[.]41[.]24:4444/functionalStatus/Jatmp1Jmb7LaCBVxMmGdjdVl02ZI7O hxxp://216[.]24[.]254[.]212:1234/g[.]pixel hxxp://149[.]100[.]157[.]111:8080/dpixel hxxp://80[.]211[.]161[.]32/__utm[.]gif hxxp://101[.]42[.]16[.]56:8083/pixel[.]gif hxxps://167[.]88[.]164[.]90:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://43[.]138[.]206[.]73/clemente/details hxxps://167[.]88[.]164[.]139:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://neweastsystem[.]com:4443/media hxxp://103[.]70[.]59[.]130:8945/IE9CompatViewList[.]xml hxxp://121[.]37[.]198[.]144/dot[.]gif hxxps://195[.]123[.]240[.]38/disable/v1[.]05/Game hxxp://92[.]63[.]196[.]48:92/load hxxps://43[.]138[.]154[.]3:7443/fwlink hxxp://106[.]52[.]163[.]222:30003/j[.]ad hxxp://103[.]118[.]42[.]11:6666/__utm[.]gif hxxps://5[.]188[.]206[.]78/fwlink hxxps://179[.]60[.]150[.]57/ca hxxp://121[.]199[.]21[.]219:8080/load hxxp://e[.]mirror[.]rnephi[.]ru:443/c/msdownload/update/others/2021/05/ hxxp://47[.]102[.]122[.]197:9999/g[.]pixel hxxp://120[.]48[.]100[.]52:8888/VmWC hxxp://119[.]45[.]71[.]204:8888/cm hxxp://162[.]14[.]73[.]248:8080/ga[.]js hxxp://39[.]106[.]45[.]206:8088/ptj hxxp://194[.]55[.]224[.]169/updates[.]rss hxxps://newstatisc[.]googleinfo[.]se:2053/pixel hxxp://42[.]193[.]20[.]173/push hxxp://43[.]143[.]184[.]22:801/ptj hxxps://185[.]74[.]222[.]126:6379/boxes[.]js hxxp://103[.]146[.]179[.]67:8090/j[.]ad hxxps://45[.]227[.]253[.]30/en_US/all[.]js hxxp://193[.]42[.]32[.]19/image/ hxxp://43[.]136[.]185[.]137/define/cookies/J7Y8XV07BJQ hxxps://78[.]85[.]17[.]88:8443/cx hxxps://212[.]18[.]104[.]6/dot[.]gif hxxp://45[.]227[.]253[.]30/cx hxxp://101[.]34[.]36[.]115:8012/pixel hxxp://47[.]113[.]149[.]52/visit[.]js hxxp://179[.]43[.]154[.]137/j[.]ad hxxp://93[.]185[.]166[.]142/cm hxxp://43[.]133[.]58[.]180:50005/dpixel hxxps://193[.]42[.]32[.]19/image/ hxxp://212[.]18[.]104[.]6:88/IE9CompatViewList[.]xml hxxps://www[.]cufinancialservices[.]com/ptj hxxp://23[.]95[.]41[.]69:888/push hxxp://8[.]219[.]8[.]195/push hxxps://120[.]78[.]169[.]163/g[.]pixel hxxp://139[.]9[.]216[.]32:8081/visit[.]js hxxps://43[.]142[.]169[.]169/cx hxxp://47[.]102[.]209[.]7:8089/www/handle/doc hxxp://51[.]250[.]71[.]227:8081/j[.]ad hxxps://1[.]15[.]186[.]229:4431/visit[.]js hxxp://106[.]75[.]29[.]225:8080/fwlink hxxps://sapocijo[.]xyz/FAQ[.]html hxxps://78[.]85[.]17[.]88/updates[.]rss hxxp://194[.]55[.]224[.]169/ga[.]js hxxp://121[.]199[.]68[.]210/ptj hxxps://194[.]165[.]16[.]74/fwlink hxxps://74[.]119[.]193[.]241:49152/ms[.]html hxxp://47[.]98[.]220[.]25:5000/ca hxxp://47[.]100[.]249[.]61:4443/ca hxxp://103[.]139[.]2[.]185:10333/pixel hxxp://31[.]25[.]88[.]171:10333/IE9CompatViewList[.]xml hxxp://43[.]139[.]146[.]60:2222/visit[.]js hxxp://95[.]214[.]27[.]59:7777/updates[.]rss hxxp://23[.]224[.]39[.]41:8888/__utm[.]gif hxxp://23[.]224[.]39[.]41:8080/pixel hxxps://110[.]40[.]184[.]247/en_US/all[.]js hxxp://165[.]232[.]136[.]198:8080/cx hxxp://43[.]142[.]179[.]128:18080/ca hxxps://85[.]217[.]144[.]148/ptj hxxp://47[.]99[.]147[.]223:3333/cm hxxp://112[.]124[.]38[.]57:8080/cx hxxp://101[.]43[.]67[.]24:2222/ptj hxxps://49[.]232[.]90[.]103:4433/ptj hxxps://www[.]tools-bitget[.]com/_/scs/mail-static/_/js/ hxxp://43[.]142[.]175[.]45:22/login/v2/api/getPhoneCode hxxps://5[.]8[.]18[.]119/visit[.]js hxxp://18[.]197[.]246[.]27/dpixel hxxp://117[.]50[.]174[.]131:7776/cx hxxp://112[.]124[.]38[.]57:8089/dpixel hxxp://77[.]73[.]134[.]32:2020/IE9CompatViewList[.]xml hxxp://5[.]8[.]18[.]119/updates[.]rss hxxp://39[.]105[.]168[.]110:800/j[.]ad hxxps://101[.]42[.]247[.]160/en_US/all[.]js hxxp://43[.]139[.]93[.]96:3456/fwlink hxxp://43[.]136[.]172[.]165/en_US/all[.]js hxxp://112[.]125[.]47[.]35/activity hxxp://8[.]130[.]107[.]128/g[.]pixel hxxp://179[.]43[.]154[.]137:445/dot[.]gif hxxp://118[.]195[.]201[.]92:8088/__utm[.]gif hxxp://101[.]43[.]67[.]24/ptj hxxp://146[.]190[.]90[.]125/fwlink hxxp://45[.]139[.]105[.]143:8087/load hxxp://8[.]130[.]86[.]184/dot[.]gif hxxp://78[.]141[.]217[.]65:8583/load hxxps://43[.]142[.]179[.]128:18443/updates[.]rss hxxp://85[.]217[.]144[.]148/ga[.]js hxxps://47[.]92[.]199[.]215:4443/activity hxxp://47[.]109[.]70[.]144:4445/updates hxxps://101[.]42[.]41[.]186:4433/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://77[.]105[.]146[.]216/fwlink hxxp://91[.]149[.]237[.]76:8900/__utm[.]gif hxxps://123[.]254[.]107[.]51/functionalStatus/ |
Cobalt Strike |
| URL | hxxp://141[.]94[.]149[.]125/R0079/vbc[.]exe hxxp://171[.]22[.]30[.]164/whiteezx[.]exe hxxp://141[.]94[.]149[.]125/savecloud/vbc[.]exe hxxp://194[.]180[.]48[.]59/adolfzx[.]exe hxxp://194[.]180[.]48[.]59/whiteezx[.]exe |
Formbook |
| URL | hxxp://198[.]46[.]132[.]133/oloriii[.]exe hxxp://171[.]22[.]30[.]164/damianozx[.]exe hxxp://194[.]180[.]48[.]59/wealthzx[.]exe hxxp://194[.]180[.]48[.]187/kmb[.]txt hxxp://171[.]22[.]30[.]164/dollzx[.]exe hxxp://171[.]22[.]30[.]164/pablozx[.]exe hxxp://195[.]201[.]147[.]116/214/vbc[.]exe hxxp://194[.]180[.]48[.]59/governorzx[.]exe |
Agent Tesla |
| URL | hxxp://216[.]83[.]59[.]17/datelog[.]dll | Ghost RAT |
| URL | hxxps://ivibits[.]com/hOyChmJtem[.]exe | bancos |
| URL | hxxp://95[.]214[.]26[.]53/J84hHFuefh2/Login[.]php hxxp://95[.]214[.]27[.]98/cronus/Login[.]php hxxp://77[.]91[.]124[.]20/DSC01491/fotocr45[.]exe |
Amadey |
| URL | hxxp://94[.]131[.]106[.]196/api/tracemap[.]php | PrivateLoader |
| URL | hxxps://ridersintl[.]org/vincent-sewe/f1[.]ps1 hxxps://macayaywaak[.]cl/sistema2/variables[.]php hxxp://macayaywaak[.]cl/sistema2/variables[.]php |
NetSupportManager RAT |
| URL | hxxp://46[.]149[.]77[.]33/vmAsync/GamevmLongpoll/Track/79Poll/7/Image/2LongpollBetter/Eternal/VoiddbSecure/packetpollProcess/voiddblongpoll1Image/central/Js8Server2/Sqluniversal/trafficdefault/Low_/temporaryCpu/GameLineCpuGame/Linuxlocal[.]php hxxp://89[.]185[.]85[.]106/External48Poll/better72/eternal24Temporary/BaseBaseauth/BetterApipoll/_/Cpu0hxxptrack/windowsTestcentral[.]php hxxp://94[.]131[.]112[.]154/PythonphpGeneratortemporary[.]php hxxp://45[.]140[.]147[.]214/bigloadsqlWindowsLocalcentral[.]php |
DCRat |
| URL | hxxp://156[.]96[.]113[.]118/AvRKrHqTh131[.]bin | CloudEyE |
| URL | hxxp://ss[.]apjeoighw[.]com/check/safe hxxp://count[.]iiagjaggg[.]com/check/safe |
Fabookie |
| URL | hxxp://carwashdenham[.]com/mn[.]php hxxps://qaswrahc[.]com/wp-content/out/mn[.]php hxxps://intellectproactive[.]com/dist/out/mn[.]php hxxp://80[.]77[.]23[.]73/lndex[.]php hxxp://tusaceitesesenciales[.]com/mn[.]php hxxp://80[.]77[.]23[.]84/lndex[.]php hxxp://80[.]77[.]23[.]115/lndex[.]php hxxp://80[.]77[.]23[.]75/lndex[.]php hxxp://80[.]77[.]23[.]61/lndex[.]php hxxp://80[.]77[.]23[.]63/lndex[.]php hxxp://80[.]77[.]23[.]76/lndex[.]php hxxp://80[.]77[.]23[.]70/lndex[.]php hxxp://80[.]77[.]23[.]69/lndex[.]php hxxp://80[.]77[.]23[.]85/lndex[.]php |
BumbleBee |
| URL | hxxp://45[.]61[.]184[.]159/ars/linux_mipsel hxxp://45[.]61[.]184[.]159/ars/linux_mips hxxp://45[.]61[.]184[.]159/ars/linux_386 hxxp://45[.]61[.]184[.]159/ars/linux_arm7 hxxp://45[.]61[.]184[.]159/ars/linux_arm5 hxxp://45[.]61[.]184[.]159/ars/linux_arm6 |
Kaiji |
| URL | hxxp://62[.]33[.]2[.]50/mipsel hxxp://62[.]33[.]2[.]50/co hxxp://62[.]33[.]2[.]50/586 hxxp://62[.]33[.]2[.]50/i686 hxxp://62[.]33[.]2[.]50/ppc hxxp://62[.]33[.]2[.]50/dc hxxp://62[.]33[.]2[.]50/sh4 hxxp://62[.]33[.]2[.]50/m68k hxxp://62[.]33[.]2[.]50/x86 hxxp://62[.]33[.]2[.]50/mips hxxp://62[.]33[.]2[.]50/arm61 hxxp://62[.]33[.]2[.]50/dss hxxp://98[.]159[.]100[.]33/Mddos/Mddos[.]arm7 hxxp://194[.]41[.]47[.]197/tsuki[.]sh4 hxxp://194[.]41[.]47[.]197/tsuki[.]arm7 hxxp://194[.]180[.]48[.]30/rebirth[.]spc hxxp://194[.]180[.]48[.]30/rebirth[.]arm4 hxxp://194[.]180[.]48[.]30/rebirth[.]i686 hxxp://194[.]180[.]48[.]30/rebirth[.]arm7 hxxp://194[.]180[.]48[.]30/rebirth[.]arm5 hxxp://194[.]180[.]48[.]30/rebirth[.]m68 hxxp://194[.]180[.]48[.]30/rebirth[.]ppc hxxp://194[.]180[.]48[.]30/rebirth[.]sh4 hxxp://194[.]180[.]48[.]30/rebirth[.]mips hxxp://194[.]180[.]48[.]30/rebirth[.]mpsl hxxp://194[.]180[.]48[.]30/rebirth[.]arm6 hxxp://194[.]180[.]48[.]30/rebirth[.]arm4t hxxp://78[.]142[.]228[.]151/yakuza[.]arm6 hxxp://78[.]142[.]228[.]151/yakuza[.]mpsl hxxp://78[.]142[.]228[.]151/yakuza[.]mips hxxp://78[.]142[.]228[.]151/yakuza[.]m68k hxxp://78[.]142[.]228[.]151/yakuza[.]x32 hxxp://78[.]142[.]228[.]151/yakuza[.]ppc hxxp://78[.]142[.]228[.]151/yakuza[.]i586 hxxp://78[.]142[.]228[.]151/yakuza[.]sh4 hxxp://78[.]142[.]228[.]151/yakuza[.]arm4 |
Bashlite |
| URL | hxxps://somanga[.]top/a[.]msi | Gozi |
| URL | hxxp://141[.]98[.]6[.]149/bonder[.]exe | XMRig |
| URL | hxxp://193[.]117[.]208[.]106:7100/rDbpHRrhkgkyQzNCVh0YTAjbe2tR7zqaQkeyiAicOkBUJRDJ_kwgVOw_1pMhE_HT4A0C0J40bQpYPglSXHe3AMgbhSl2lGJRn-r-OD4QvhD0af5f5X hxxp://193[.]117[.]208[.]107:7200/8LUOnCvE1xgUvxW-cOE-NgaCWoD478lMEa7lB1SUo0WUauMD7lXeljKYeaRbvJqXyhv628ohW6z4s7P-nXfATWHcEcNUg4Qv9Q_801cNlmDcyYcGPx4Uy5-Pn1ZXB7nEahObuQxHKrGePwMqE8KRXC2eU8MiwTIotlmAPJ0KGWpp---ygRV3b6fUJZsvUTDnZbIRCDCgxXwjRp4FBGJP-jJtxZUnTmdashhJ29dQ hxxp://193[.]117[.]208[.]109:7400/LdweF_tC2dcJ6wjqbbUjDwvj2IvXh_OxfjdXC5GTU3oF3Q9H8RfN_Ac-t3zkW1e4kmghRWkvztCs5iY0Cgqdbq34cAUae07AeZFTp9_XPl1tPbdhG-YuQeIpiUH3Alx8wROnYmo9NzFLgbgKCtO4_7b9Yf0xzx_CvX0Yiz0xPM26TajJs8zAwECUhfA4bhudegiG_3kNtDuHztt hxxp://193[.]117[.]208[.]106:7100/OclPypsHxr_utu-3iujHTwRUWvYyueo-O2XEOlOmCib6vHhNy-4WOAA8xV5SpXR0pO1KEYHuC5lnshq0Faj9On9bsx8yxSbg7Q_I4nWLkjg7KaxJ1hBknP4hXre0Xjqk4j-KoV2OL39KH_0q5 hxxp://193[.]117[.]208[.]107:7200/31JUksFXhBvwUvFTlAzaIQtzWnOlOaTKypZLbPiJKB_VfrRs2abOAAlbxbYPprB7vIi1UjYX6P9qzFMRe hxxp://193[.]117[.]208[.]109:7400/-bGTcUbi350X4xbic709LgBXMur6qr6NLgnP1IEqvONHJFD8bv_njCoCZ9lAfDE0DKojWgpi2-jhRGcVYJ8xkMO7cxB3d6FMdHI6fW-Cf9MZ6yMeBeFkEXhF_xCnIgGI4pJ2sLYelbmeFUlZ6IcKuRMWhDNknkTSZDxxfncvfog7oVNE3pw-bRm9 hxxp://193[.]117[.]208[.]106:7100/HbKkOoow2-LObs9vrbVrSgRozgiLWp_nBmW0upOjEn5njFDAaLXLtD-jiq-VlBB-YkDK7jeqd4w9dy1 hxxp://193[.]117[.]208[.]107:7200/FYUZRPJCYUWHaYZo5LIiKQ8leDzCwa4m62rmVgRuMXuLW7xVKXogGfa9xq_4QrNB4KGaVdln1xv0UzGHXgpULNPWYATkGbBXkEvkm3nZZO91cn1ogYh7_Bq4A8DwTiE_vmENYTxK2JmaqyDxTFVQ9fO-HkLR_ePsEeJ1sqQ6P7lu8zlCSoEw3bgP5ZScOsC0Uc_odzkatGXZGpAFYjmo hxxp://193[.]117[.]208[.]108:7300/dWSgVBYqqVIU2RXYdwKxhQvLvs-56qZlWv49_6Tz26pqMeXi81oujywtg9e13E5VUFFF7botl53c7r3ZLxp1jzhoalRdaZ37mdHeoZ0rhFwWdLSkENUimlxzmoNONkt0vblzpXwlqhjofB5kNsZDvvQQ7M4Vb7BE7tpbLz_nLGdrI7_0eNkRN49YL5U0P6PPFsgvsg5SBYnSNh7o28 hxxp://193[.]117[.]208[.]109:7400/luWQLp-21yLCXsNfoYVnJg5ng_jAo6QHkmSE53PzSCbRcICpBVdjjQRToSKICQiO1e5KgKAQawxYlSyoVahwRdWQrT3UarIHm_tGWhA_2YIx3jwgoMsLA4nKAOmj1gq590zhn_WWBRg2y2f8ShzDLq |
Metasploit |
| URL | hxxp://194[.]38[.]20[.]32/kinsing hxxp://194[.]38[.]20[.]32/libsystem[.]so hxxp://194[.]38[.]20[.]32/curl-amd64 |
Kinsing |
| URL | hxxp://49[.]12[.]115[.]154:8333/config[.]zip hxxp://94[.]130[.]56[.]27/config[.]zip hxxp://185[.]254[.]37[.]108/Updates%20Windows[.]exe |
Vidar |
| URL | hxxp://194[.]180[.]48[.]59/jawazx[.]exe | Remcos |
