不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/06/16
※2023/06/16 更新
マルウェア感染させると考えられるURLを検知（2023/06/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://109[.]206[.]240[.]64/HBZ[.]exe hxxp://109[.]206[.]240[.]64/LUK[.]exe |
CloudEyE |
| URL | hxxp://94[.]142[.]138[.]41/fa9e8ac05e4bf430/softokn3[.]dll hxxp://94[.]142[.]138[.]41/fa9e8ac05e4bf430/vcruntime140[.]dll hxxp://94[.]142[.]138[.]41/fa9e8ac05e4bf430/freebl3[.]dll hxxp://94[.]142[.]138[.]41/fa9e8ac05e4bf430/msvcp140[.]dll hxxp://94[.]142[.]138[.]41/fa9e8ac05e4bf430/sqlite3[.]dll hxxp://94[.]142[.]138[.]41/fa9e8ac05e4bf430/mozglue[.]dll hxxp://94[.]142[.]138[.]41/fa9e8ac05e4bf430/nss3[.]dll |
Stealc |
| URL | hxxp://pan2[.]top/build[.]exe hxxp://pn2nnev[.]top/build[.]exe hxxp://pnob2[.]top/build[.]exe hxxp://p2newsil[.]top/build[.]exe hxxp://dop2buid[.]top/build[.]exe hxxp://dop2load[.]top/build[.]exe hxxp://sb2pnew[.]top/build[.]exe hxxp://powr2new[.]top/build[.]exe hxxp://log5ny[.]top/build[.]exe hxxp://ny2new[.]top/build[.]exe hxxp://p2newer[.]top/build[.]exe hxxp://ny2pnews[.]top/build[.]exe hxxp://new2pnev[.]top/build[.]exe hxxp://globalrawe[.]top/build[.]exe hxxp://newv2up[.]top/build[.]exe hxxp://newr2bb[.]top/build[.]exe hxxp://95[.]214[.]25[.]239/vidar[.]exe |
Vidar |
| URL | hxxp://asdasdwqrweerwfa[.]top/8vcWxwwx3/index[.]php | Amadey |
| URL | hxxp://23[.]94[.]148[.]6/GIB[.]exe hxxp://198[.]23[.]156[.]244/EBU[.]exe hxxp://gruparcas[.]com/orimaje2[.]1[.]exe hxxp://107[.]172[.]130[.]135/show[.]exe hxxp://198[.]46[.]173[.]137/vvv[.]exe hxxp://192[.]3[.]193[.]194/34/cleanmgrse[.]exe |
Agent Tesla |
| URL | hxxps://grapemundo[.]com/Apk/zp[.]js | WSHRAT |
| URL | hxxp://149[.]255[.]35[.]140/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://149[.]255[.]35[.]140/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://149[.]255[.]35[.]140/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://149[.]255[.]35[.]140/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://149[.]255[.]35[.]140/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://149[.]255[.]35[.]140/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://149[.]255[.]35[.]140/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxps://theinteriorstudio[.]com[.]au/uid/?5047862 hxxps://jeremiaholajiga[.]ng/utam/?7796762 hxxp://inversionesoberti[.]com/zsnmciptjh/vodka[.]gif hxxps://draks[.]co/zxzelfjhgd/vodka[.]gif hxxp://staging-1[.]ddmg[.]tech/egfcrpqkec/vodka[.]gif hxxps://visaetude[.]com/ddryacnkfs/vodka[.]gif hxxps://hifigifts[.]com/sthlnsivob/vodka[.]gif hxxp://amazingadvertise[.]lk/rkiuayqvjx/vodka[.]gif hxxps://doutorpauloricardo[.]com[.]br/ci/?3576762 hxxps://hostbooks[.]in/tuat/?1 hxxps://oficinaautoart[.]com[.]br/gf/?1 hxxps://hostbooks[.]in/tuat/ hxxps://laserdesign[.]com[.]ar/remo/?1 hxxps://laserdesign[.]com[.]ar/remo/ hxxps://luncalupall[.]ro/sst/?1 hxxps://bonitahouse[.]ro/ror/?1 hxxps://luncalupall[.]ro/sst/ hxxps://bonitahouse[.]ro/ror/ hxxp://192[.]121[.]16[.]225/HXSU65W/TUOIajA2pY hxxp://151[.]236[.]28[.]181/h2j/g469arI4Ki8e hxxp://151[.]236[.]14[.]139/mygjfh/YaKwgNWUKk1L hxxps://hostbooks[.]in/tuat/?9586572 hxxps://eletter-kanizsa[.]hu/ips/? hxxps://guianft[.]site/anua/? hxxps://larissacarboni[.]com/immi/? hxxps://chiety[.]com[.]co/elra/? hxxps://yabcare[.]com/iat/? hxxps://radiosurgery[.]hu/tet/? hxxps://vishwahindu[.]edu[.]np/tequ/? hxxps://tolledosports[.]com[.]br/assi/? hxxps://embro[.]edu[.]sa/ord/? hxxps://magikaldoor[.]ca/sdse/? hxxps://lsmongolia[.]company/eum/? hxxps://ppets[.]co[.]za/rra/? hxxps://ecv[.]dca[.]rw/ilo/? hxxps://ormware[.]com/lua/? hxxps://smbstores[.]us/beio/? hxxps://lcmycia[.]cl/oaor/? hxxps://brrllc[.]us/eve/? hxxps://examhelper[.]com[.]ng/iasm/? hxxps://thewebcam[.]show/natt/? hxxps://adecoco[.]us/it/? hxxps://mirrornews[.]in/oiim/? hxxps://2box[.]store/auiq/? hxxps://jacobballard[.]com/cu/? hxxps://wallpaperus[.]click/ha/? hxxps://superclick[.]co[.]zw/aa/? hxxps://insuranceseguros[.]co/los/? hxxps://cutacut[.]com/rue/? hxxps://topanantisedot[.]store/rp/? hxxps://flouka[.]tn/at/? hxxps://scrum[.]ng/enu/? hxxps://flashmidiapa[.]com[.]br/se/? hxxps://innovadeck[.]mx/ieds/? hxxps://radioproyeccion[.]cl/ettu/? hxxps://ahg[.]com[.]sa/oms/? hxxps://excellarwine[.]com/stis/? hxxps://jornaldoplanalto[.]com[.]br/cus/? hxxps://topan77bom[.]xyz/am/? hxxps://mybeamlabel[.]nl/ui/? hxxps://crsoorgi[.]tech/domu/? hxxps://tpb77tokdalang[.]lol/use/? hxxps://nppnguyenduc[.]com/uiq/? hxxps://zoomtvlivehd[.]xyz/prom/? hxxps://bpengineering[.]co[.]za/cue/? hxxps://haytham[.]site/auu/? hxxps://download-solorap[.]site/ut/? hxxps://insurlabel[.]co[.]tz/sqet/? hxxps://tu[.]bmc[.]edu[.]np/roa/? hxxps://meupaineldeled[.]com[.]br/uoie/? hxxps://oficinaautoart[.]com[.]br/gf/? hxxps://prontomed[.]ro/rr/? hxxps://emmanuelgroup[.]org/oasm/? hxxps://restora[.]com[.]bd/lrdo/? hxxps://zoomtv4k[.]live/ss/? hxxps://solution-x[.]tech/uie/? hxxps://ardeoeducation[.]online/eas/? hxxps://inmentus[.]com[.]mx/eeae/? hxxps://verotools[.]com[.]br/abe/? hxxps://cqt[.]com[.]uy/ti/? hxxps://demogem[.]site/tu/? hxxps://marketingomniscient[.]com/mcte/? hxxps://centroveterinariovetmais[.]com[.]br/nihc/? hxxps://cmt-edu[.]info/lice/? hxxps://innokat[.]com[.]pk/ii/? hxxps://foroozesh[.]ir/ndi/? hxxps://delasabana[.]com/ui/? hxxps://repararmovil[.]eu/rer/? hxxps://insetmar[.]com[.]br/rcf/? hxxps://ultraphysics[.]hu/elsi/? hxxps://bluebirdtechnologies[.]biz/ut/? hxxps://lavastore[.]cz/isis/? hxxps://creatrix[.]com[.]mx/abdi/? hxxps://pasargadloster[.]ir/ensl/? hxxps://arabyka[.]com/tit/? hxxps://alcotrip[.]games/rn/? hxxps://dinh[.]dk/so/? hxxps://sportshd23[.]store/rpmi/? hxxps://wilshirelabs[.]com/pav/? hxxps://geapl[.]co[.]in/rme/? hxxps://planetadasbaterias[.]com[.]br/bot/? hxxps://ceper[.]my[.]id/pt/? hxxps://tnadw[.]in/ru/? hxxps://igorjfbatista[.]online/eq/? hxxps://dmiss[.]ge/ala/? hxxps://kailtopan77[.]lol/us/? hxxps://sciforschenonline[.]org/arr/? hxxps://globalsatgps[.]com[.]br/qi/? hxxps://lotusint[.]xyz/nsn/? hxxps://dwardevi[.]edu[.]np/sqi/? hxxps://dostavka[.]space/im/? hxxps://luxeria[.]ng/enm/? hxxps://dolkon[.]ng/remm/? hxxps://jobportal[.]tiv[.]vic[.]edu[.]au/qse/? hxxps://jetfuel[.]ph/lo/? hxxps://hdtvplay[.]xyz/eae/? hxxps://tava[.]co[.]nz/uelo/? hxxps://movebikes[.]cl/ese/? hxxps://machidafightfit[.]com[.]br/pnai/? hxxps://uaba[.]io/rl/? hxxps://oxyhealth[.]com[.]sa/pd/? hxxps://mulberryhotels[.]in/fig/? hxxps://digitalapb[.]online/teta/? hxxps://lifesounds[.]us/tnaa/? hxxps://venes[.]com[.]br/ma/? hxxps://wedigital[.]cloud/tisa/? hxxps://bizztechinfo[.]com/nme/? hxxps://mptactical[.]shop/dq/? hxxps://emerconotec[.]cl/so/? hxxps://mexicoautomatico[.]mx/oa/? hxxps://usinadelixo[.]com[.]br/vmr/? hxxps://social-growth[.]dev/sran/? hxxps://colegiobretondelosherreros[.]edu[.]mx/nuei/? hxxps://caninecat[.]com[.]br/im/? hxxps://myfan[.]com[.]br/fol/? hxxps://studive[.]pk/inns/? hxxps://pokretoslobodjenje[.]rs/dolo/? hxxps://mdea[.]gob[.]pe/lsui/? hxxps://smartalgotrade[.]in/xoa/? hxxps://alexmontagemdemoveis[.]com[.]br/rem/? hxxps://tpbspaceman[.]store/aul/? hxxps://restauranteanabella[.]com[.]br/me/? hxxps://promotorcyclehelmets[.]com/ud/? hxxps://follies[.]ro/teve/? hxxps://il-segreto[.]cl/edel/? hxxps://tpbmmorpg[.]lol/odco/? hxxps://rabbitsend[.]com[.]my/eeta/? hxxps://municipiounionhidalgo[.]gob[.]mx/at/? hxxps://morcode[.]pt/eti/? hxxps://ibexproductions[.]pk/saos/? hxxps://refrigeracaocamargo[.]com[.]br/ir/? hxxps://bharattech[.]co[.]in/er/? hxxps://prohear[.]com[.]br/mnmu/? hxxps://motojudi[.]mobi/caoe/? hxxps://familybenefits[.]xyz/ilc/? hxxps://cosmobook[.]pe/eeau/? hxxps://leccocucina[.]in/ip/? hxxps://punointerior[.]com/ec/? hxxps://hip[.]co[.]th/oimu/? hxxps://megashoes[.]mx/ca/? hxxps://shreesiddharthaschool[.]edu[.]np/eeti/? hxxps://primeld[.]com[.]sa/nfs/? hxxps://snravbasdilwa[.]edu[.]np/mop/? hxxps://darkessence[.]lk/st/? hxxps://mutllc[.]com/aaq/? hxxps://luncalupall[.]ro/sst/? hxxps://zarasshoes[.]com[.]au/utut/? hxxps://lifestyle[.]mn/etm/? hxxps://dramacool9[.]wtf/oics/? hxxps://ius[.]edu[.]bd/tme/? hxxps://hyundai[.]co[.]zw/nti/? hxxps://socialwelfare[.]ajk[.]gov[.]pk/tepa/? hxxps://topan77canggih[.]xyz/sloi/? hxxps://tpbwolf[.]cyou/oe/? hxxps://vwebhrsolutions[.]in/eus/? hxxps://faisalkabir[.]me/ur/? hxxps://constructioncreative[.]site/au/? hxxps://revistas[.]upp[.]edu[.]pe/te/? hxxps://autoingress[.]com[.]au/dob/? hxxps://elmundodeljuguete[.]com[.]ar/sett/? hxxps://amulakh[.]in/eni/? hxxps://mianind[.]com/etl/? hxxps://imextrade[.]ltd/sih/? hxxps://centroescolardelmayab[.]edu[.]mx/an/? hxxps://3-d[.]ro/su/? hxxps://franciseureka[.]com[.]br/eato/? hxxps://laslas[.]org/uu/? hxxps://cepemrj[.]com[.]br/spio/? hxxps://bharmaar[.]pk/ivet/? hxxps://pipduck[.]com[.]au/dsot/? hxxps://fashioneverywhere[.]pe/tbq/? hxxps://banyakmanfaatditpb[.]website/mao/? hxxps://radarsolucoesfinanceiras[.]com[.]br/qdi/? hxxps://wellyz[.]in/aa/? hxxps://metalmecanicaspikin[.]cl/nt/? hxxps://letstart[.]us/dtf/? hxxps://admin[.]njc[.]gov[.]ng/aot/? hxxps://fioruciengenharia[.]com[.]br/pt/? hxxps://zik[.]ai/olrr/? hxxps://inventare[.]me/ioea/? hxxps://clearconcepts[.]academy/ntst/? hxxps://onion[.]ng/uq/? hxxps://topan77oklah[.]xyz/mros/? hxxps://hermid[.]tech/atop/? hxxps://trimedperu[.]pe/ipea/? hxxps://laserdesign[.]com[.]ar/remo/? hxxps://fernandofaria[.]eng[.]br/or/? hxxps://mzansivoice[.]co[.]za/asf/? hxxps://sungaitpb77[.]xyz/tm/? hxxps://giftcodetpb77[.]cyou/iiun/? hxxps://atbox[.]ro/ecc/? hxxps://atcled[.]com[.]br/ca/? hxxps://sohaibr[.]group/ofed/? hxxps://kolea[.]co/am/? hxxps://jpnureg[.]com[.]ar/iv/? hxxps://bisff[.]in/ldr/? hxxps://snv[.]co[.]zw/ieu/? hxxps://qcast[.]live/te/? hxxps://alkhidmahtravels[.]site/ei/? hxxps://flaviaadvogadaprev[.]com[.]br/xupo/? hxxps://skillsandmore[.]ca/iatc/? hxxps://apoloagencia[.]com[.]br/im/? hxxps://tecnodroid[.]co/deqt/? hxxps://nyarusinga[.]co[.]ke/cta/? hxxps://marchtech[.]co[.]ke/eel/? hxxps://octalabs[.]xyz/ou/? hxxps://afelschool[.]com/qat/? hxxps://cyberbuddies[.]co/hrde/? hxxps://strcs[.]ca/eiut/? hxxps://reginaldo[.]com[.]br/sro/? hxxps://brandintel[.]co[.]ke/pea/? hxxps://edukacional[.]com[.]br/roo/? hxxps://georgeeyitayo[.]com/usc/? hxxps://microworldindia[.]co[.]in/ul/? hxxps://soundfactory[.]cl/imvl/? hxxps://oksanastore[.]co[.]tz/soce/? hxxps://fwcdigital[.]com[.]br/io/? hxxps://usalama[.]app/uado/? hxxps://irasdesign[.]nl/uqsq/? hxxps://prescriptionfood[.]com[.]hk/rudt/? hxxps://bonitahouse[.]ro/ror/? hxxps://uciran[.]ir/ad/? hxxps://criminalsrp[.]store/ctht/? hxxps://evollui[.]com[.]br/tn/? hxxps://robol[.]ink/lli/? hxxps://socialmarketing[.]pt/iicl/? hxxps://climatempo[.]online/nspo/? hxxps://qtglobal[.]in/rue/? hxxps://srajan[.]in/snh/? hxxps://sebastijancerade[.]rs/eit/? hxxps://nobag[.]io/ra/? hxxps://allsportslive24tv[.]xyz/al/? hxxps://d-e-u-s[.]art/to/? hxxps://fcdsolucionesindustriales[.]co/issu/? hxxps://gederex[.]ro/st/? hxxps://codixpharma[.]co[.]uk/ac/? hxxps://demo[.]jpe[.]njc[.]gov[.]ng/au/? hxxps://desentupidorafloripa[.]com[.]br/ma/? hxxps://zanzibarkanji[.]tours/equa/? hxxps://unidelvalla[.]mx/iifa/? hxxps://institutoys[.]com[.]br/ra/? hxxps://iscool[.]com[.]br/et/? hxxps://goodconnect[.]co/qml/? hxxps://carrieryucatan[.]com[.]mx/ai/? hxxps://troqueseunome[.]com[.]br/st/? hxxps://nzcollection[.]pk/oaa/? hxxps://leonexpress[.]ca/lotd/? hxxps://calentadores[.]info/riso/?1 hxxps://ctiveterinario[.]com[.]br/oiq/?1 hxxps://trimedperu[.]pe/ipea/?1 hxxp://192[.]121[.]17[.]43/Gs9h/FE293 hxxp://158[.]255[.]213[.]54/vMCtB/FD130 hxxp://151[.]236[.]14[.]86/gF1sH2v/DA951 hxxps://ahg[.]com[.]sa/oms/?1 hxxps://giamracnhua[.]vn/taa/?1 hxxps://southwestline[.]ae/uem/?1 hxxps://tallyit[.]management/eitp/?1 hxxps://lsmongolia[.]company/eum/?1 hxxps://socialwelfare[.]ajk[.]gov[.]pk/tepa/?1 hxxps://goodconnect[.]co/qml/?1 hxxps://excellarwine[.]com/stis/?1 hxxps://farmatech[.]xyz/srm/?1 hxxps://oxyhealth[.]com[.]sa/pd/?1 hxxps://follies[.]ro/teve/?1 hxxps://tnadw[.]in/ru/?1 hxxps://khoahoctunhien[.]vn/au/?1 hxxps://inmentus[.]com[.]mx/eeae/?1 hxxps://careersit[.]co[.]za/nuo/?1 hxxps://airterjuntpb77[.]lol/ms/?1 hxxps://magikaldoor[.]ca/sdse/?1 hxxps://najahbakery[.]sa/eo/?1 hxxps://cilgpan[.]com[.]ng/uuiq/?1 hxxps://restauranteanabella[.]com[.]br/me/?1 hxxps://punointerior[.]com/ec/?1 hxxps://gederex[.]ro/st/?1 hxxps://77uhuyb4nget[.]xyz/pucn/?1 hxxps://loveworldnext[.]global/cp/?1 hxxps://dwardevi[.]edu[.]np/sqi/?1 hxxps://carrieryucatan[.]com[.]mx/ai/?1 hxxps://toplinemarketing[.]co[.]ke/eomx/?1 hxxps://bumbumdosonhos[.]online/mduu/?1 hxxps://growshome[.]com/sdrn/?1 hxxps://hadart[.]com[.]br/itu/?1 hxxps://onel[.]com[.]br/itum/?1 hxxps://ecv[.]dca[.]rw/ilo/?1 hxxps://edukacional[.]com[.]br/roo/?1 hxxps://softomatic[.]in/au/?1 hxxps://unidelvalla[.]mx/iifa/?1 hxxps://maisthanvidyapith[.]edu[.]np/ttml/?1 hxxps://rtanet[.]info/reas/?1 hxxps://darcepel[.]com[.]br/eam/?1 hxxps://medmasters[.]in/etr/?1 hxxps://marbella[.]co[.]in/ce/?1 hxxps://brrllc[.]us/eve/?1 hxxps://cricpk[.]tk/sc/?1 hxxps://student[.]cac[.]edu[.]au/eoo/?1 hxxps://yabcare[.]com/iat/?1 hxxps://cmjoaodourado[.]ba[.]gov[.]br/col/?1 hxxps://cosmobook[.]pe/eeau/?1 hxxps://autoingress[.]com[.]au/dob/?1 hxxps://fwcdigital[.]com[.]br/io/?1 hxxps://megabrindespg[.]com[.]br/ore/?1 hxxps://robol[.]ink/lli/?1 hxxps://strcs[.]ca/eiut/?1 hxxps://telemontazs[.]hu/eaet/?1 hxxps://maiskibolobom[.]com[.]br/ipar/?1 hxxps://restora[.]com[.]bd/lrdo/?1 hxxps://awaisahmadtech[.]com/oetn/?1 hxxps://leonexpress[.]ca/lotd/?1 hxxps://dashbords1[.]pm[.]com[.]bo/oiud/?1 hxxps://zanzibarkanji[.]tours/equa/?1 hxxps://projetoprovida[.]com[.]br/eme/?1 hxxps://bharmaar[.]pk/ivet/?1 hxxps://alibababuy[.]com[.]sa/mquu/?1 hxxps://crsoorgi[.]tech/domu/?1 hxxps://binasentra[.]co[.]id/nten/?1 hxxps://thewebcam[.]show/natt/?1 hxxps://lcmycia[.]cl/oaor/?1 hxxps://smbstores[.]us/beio/?1 hxxps://verotools[.]com[.]br/abe/?1 hxxps://il-segreto[.]cl/edel/?1 hxxps://sebastijancerade[.]rs/eit/?1 hxxps://atbox[.]ro/ecc/?1 hxxps://cancer[.]do/as/?1 hxxps://usalama[.]app/uado/?1 hxxps://machidafightfit[.]com[.]br/pnai/?1 hxxps://promotorcyclehelmets[.]com/ud/?1 hxxps://aapm[.]com[.]br/em/?1 hxxps://oksanastore[.]co[.]tz/soce/?1 hxxps://smartalgotrade[.]in/xoa/?1 hxxps://meupaineldeled[.]com[.]br/uoie/?1 hxxps://esplendoreconsultoria[.]com[.]br/qiqu/?1 hxxps://mcare[.]best/ivq/?1 hxxps://mnp[.]mr/steb/?1 hxxps://darahbiru[.]xyz/ttt/?1 hxxps://gomusanna[.]xyz/et/?1 hxxps://escuelasemillita[.]com/eutt/?1 hxxps://prescriptionfood[.]com[.]hk/rudt/?1 hxxps://flouka[.]tn/at/?1 hxxps://familybenefits[.]xyz/ilc/?1 hxxps://fashioneverywhere[.]pe/tbq/?1 hxxps://simcomm[.]com/sr/?1 hxxps://guiamodshacker[.]xyz/ntag/?1 hxxps://flashmidiapa[.]com[.]br/se/?1 hxxps://socialhd[.]com[.]ar/rr/?1 hxxps://jpnureg[.]com[.]ar/iv/?1 hxxps://kingdomgacor[.]makeup/osl/?1 hxxps://codixsl[.]com/eel/?1 hxxps://onion[.]ng/uq/?1 hxxps://sosaka[.]co[.]tz/ude/?1 hxxps://adecoco[.]us/it/?1 hxxps://evollui[.]com[.]br/tn/?1 hxxps://tava[.]co[.]nz/uelo/?1 hxxps://banyakmanfaatditpb[.]website/mao/?1 hxxps://bizztechinfo[.]com/nme/?1 hxxps://lyonsdemoz[.]website/uud/?1 hxxps://amulakh[.]in/eni/?1 hxxps://ppets[.]co[.]za/rra/?1 hxxps://compactoftherepublic[.]com/saml/?1 hxxps://refrigeracaocamargo[.]com[.]br/ir/?1 hxxps://fioruciengenharia[.]com[.]br/pt/?1 hxxps://globalsatgps[.]com[.]br/qi/?1 hxxps://luxeria[.]ng/enm/?1 hxxps://gmpacademy[.]com[.]br/vre/?1 hxxps://zik[.]ai/olrr/?1 hxxps://cyberbuddies[.]co/hrde/?1 hxxps://marketingomniscient[.]com/mcte/?1 hxxps://blogdosalao[.]com[.]br/dme/?1 hxxps://zarasshoes[.]com[.]au/utut/?1 hxxps://elsandina[.]com[.]co/rmuo/?1 hxxps://dmiss[.]ge/ala/?1 hxxps://topanmanis[.]lol/ebi/?1 hxxps://prodental[.]store/oie/?1 hxxps://laslas[.]org/uu/?1 hxxps://tpb77virus[.]store/riur/?1 hxxps://mutllc[.]com/aaq/?1 hxxps://procivlamego[.]pt/ci/?1 hxxps://3-d[.]ro/su/?1 hxxps://rgimpressao[.]com[.]br/ioes/?1 hxxps://futureskillsforafrica[.]xyz/eq/?1 hxxps://leccocucina[.]in/ip/?1 hxxps://atcled[.]com[.]br/ca/?1 hxxps://qcast[.]live/te/?1 hxxps://flaviaadvogadaprev[.]com[.]br/xupo/?1 hxxps://mzansivoice[.]co[.]za/asf/?1 hxxps://topan77canggih[.]xyz/sloi/?1 hxxps://ccjsobral[.]com[.]br/qs/?1 hxxps://solution-x[.]tech/uie/?1 hxxps://climatempo[.]online/nspo/?1 hxxps://tpbspaceman[.]store/aul/?1 hxxps://superclick[.]co[.]zw/aa/?1 hxxps://transmissaosecreta[.]com/or/?1 hxxps://martinsakhivbareme[.]tech/ia/?1 hxxps://emmanuelgroup[.]org/oasm/?1 hxxps://softboss[.]com[.]br/ntie/?1 hxxps://highpana[.]co[.]za/uq/?1 hxxps://bharattech[.]co[.]in/er/?1 hxxps://berkeley[.]edu[.]eu/ius/?1 hxxps://myfan[.]com[.]br/fol/?1 hxxps://zoomtv4k[.]live/ss/?1 hxxps://codixpharma[.]co[.]uk/ac/?1 hxxps://mkworld[.]me/lvqt/?1 hxxps://wedigital[.]cloud/tisa/?1 hxxps://dinh[.]dk/so/?1 hxxps://darkessence[.]lk/st/?1 hxxps://allsportslive24tv[.]xyz/al/?1 hxxps://double[.]ind[.]br/nteu/?1 hxxps://reach[.]mn/tes/?1 hxxps://josebraz[.]pt/mnpi/?1 hxxps://gjleather[.]store/its/?1 hxxps://santacasasacramento[.]com[.]br/tuts/?1 hxxps://usinadelixo[.]com[.]br/vmr/?1 hxxps://venes[.]com[.]br/ma/?1 hxxps://appfile[.]us/iic/?1 hxxps://rabbitsend[.]com[.]my/eeta/?1 hxxps://topandiluarnalar[.]cyou/ut/?1 hxxps://tolledosports[.]com[.]br/assi/?1 hxxps://caninecat[.]com[.]br/im/?1 hxxps://iphix[.]shop/op/?1 hxxps://skillsandmore[.]ca/iatc/?1 hxxps://morgenhealthcare[.]in/qucu/?1 hxxps://insetmar[.]com[.]br/rcf/?1 hxxps://franciseureka[.]com[.]br/eato/?1 hxxps://bisff[.]in/ldr/?1 hxxps://harmoniaclassguarulhos[.]com[.]br/nn/?1 hxxps://cmt-edu[.]info/lice/?1 hxxps://awaisdev[.]co/uu/?1 hxxps://sirinatureroost[.]com/tat/?1 hxxps://trhospitalis[.]com/pn/?1 hxxps://ormschool[.]com/oe/?1 hxxps://hapvidaplanos[.]com[.]br/ip/?1 hxxps://sephari[.]me[.]uk/udlb/?1 hxxps://ormware[.]com/lua/?1 hxxps://criminalsrp[.]store/ctht/?1 hxxps://ius[.]edu[.]bd/tme/?1 hxxps://nobag[.]io/ra/?1 hxxps://apoloagencia[.]com[.]br/im/?1 hxxps://zoomtvlivehd[.]xyz/prom/?1 hxxps://stareheboyscentre[.]ac[.]ke/mc/?1 hxxps://brandskhabar[.]in/uli/?1 hxxps://elmundodeljuguete[.]com[.]ar/sett/?1 hxxps://opticaskairoz[.]com[.]mx/sei/?1 hxxps://dolkon[.]ng/remm/?1 hxxps://jetfuel[.]ph/lo/?1 hxxps://loyalanimals[.]com[.]co/tdo/?1 hxxps://afes[.]edu[.]pk/ae/?1 hxxps://octalabs[.]xyz/ou/?1 hxxps://chambira[.]store/uo/?1 hxxps://avisstur[.]edu[.]pe/ur/?1 hxxps://deltacolegio[.]com[.]br/clre/?1 hxxps://shadowfantasyworld[.]site/ua/?1 hxxps://masmegas[.]mx/hie/?1 hxxps://jtmkarquitetura[.]com[.]br/de/?1 hxxps://tecnodroid[.]co/deqt/?1 hxxps://anticorrupcionchubut[.]gob[.]ar/ning/?1 hxxps://laboral[.]com[.]uy/vt/?1 hxxps://foroozesh[.]ir/ndi/?1 hxxps://motojudi[.]mobi/caoe/?1 hxxps://simcon-group[.]com/ti/?1 hxxps://d-e-u-s[.]art/to/?1 hxxps://srdm[.]in/se/?1 hxxps://download-solorap[.]site/ut/?1 hxxps://snravbasdilwa[.]edu[.]np/mop/?1 hxxps://gracielaneves[.]com/tx/?1 hxxps://larissacarboni[.]com/immi/?1 hxxps://jacobballard[.]com/cu/?1 hxxps://cqt[.]com[.]uy/ti/?1 hxxps://ebraulisamyaro[.]ge/xei/?1 hxxps://troqueseunome[.]com[.]br/st/?1 hxxps://vwebhrsolutions[.]in/eus/?1 hxxps://topangm[.]website/ues/?1 hxxps://hermid[.]tech/atop/?1 hxxps://sabornareiceta[.]online/ivte/?1 hxxps://topmedical[.]com[.]ec/oite/?1 hxxps://bibianos[.]com/tue/?1 hxxps://earner[.]work/tirr/?1 hxxps://lusso[.]cl/urue/?1 hxxps://amcare[.]com[.]mx/sla/?1 hxxps://caper[.]my[.]id/na/?1 hxxps://diquinsa[.]com[.]mx/tatu/?1 hxxps://protrasa[.]com[.]mx/odol/?1 hxxps://bluebirdtechnologies[.]biz/ut/?1 hxxps://kailtopan77[.]lol/us/?1 hxxps://megashoes[.]mx/ca/?1 hxxps://thelanguages[.]club/uai/?1 hxxps://sandblaster[.]com[.]mx/uet/?1 hxxps://bhcs[.]co[.]za/vr/?1 hxxps://globaltrends[.]com[.]br/tri/?1 hxxps://radioproyeccion[.]cl/ettu/?1 hxxps://mulberryhotels[.]in/fig/?1 hxxps://alhoja[.]net/ce/?1 hxxps://qtglobal[.]in/rue/?1 hxxps://ceper[.]my[.]id/pt/?1 hxxps://crazystory[.]xyz/rdiu/?1 hxxps://primeld[.]com[.]sa/nfs/?1 hxxps://macherie[.]ro/ta/?1 hxxps://hdtvplay[.]xyz/eae/?1 hxxps://centroveterinariovetmais[.]com[.]br/nihc/?1 hxxps://oncologico[.]com[.]do/ar/?1 hxxps://municipiounionhidalgo[.]gob[.]mx/at/?1 hxxps://sppu[.]com[.]br/pene/?1 hxxps://decoimport[.]cl/tot/?1 hxxps://innokat[.]com[.]pk/ii/?1 hxxps://ceachiloe[.]cl/eoeo/?1 hxxps://institutoys[.]com[.]br/ra/?1 hxxps://globalhse[.]org/ie/?1 hxxps://radar[.]africa/do/?1 hxxps://innovadeck[.]mx/ieds/?1 hxxps://nrbexpresstourstravels[.]in/osiu/?1 hxxps://lvoy[.]shop/eos/?1 hxxps://mattoseschactae[.]com[.]br/snio/?1 hxxps://wellyz[.]in/aa/?1 hxxps://parvage[.]xyz/tnll/?1 hxxps://tpbwolf[.]cyou/oe/?1 hxxps://pgsoftpb77[.]website/au/?1 hxxps://biavakil[.]ir/oee/?1 hxxps://shreesiddharthaschool[.]edu[.]np/eeti/?1 hxxps://eletter-kanizsa[.]hu/ips/?1 hxxps://luziania[.]go[.]gov[.]br/ti/?1 hxxps://finder-relevadores[.]com[.]mx/ouvn/?1 hxxps://smartboardindia[.]in/is/?1 hxxps://letstart[.]us/dtf/?1 hxxps://nidanhospital[.]com/isd/?1 hxxps://wzappstech[.]store/rror/?1 hxxps://kolea[.]co/am/?1 hxxps://ardeoeducation[.]online/eas/?1 hxxps://mianind[.]com/etl/?1 hxxps://royalstore[.]me/uie/?1 hxxps://marchtech[.]co[.]ke/eel/?1 hxxps://wallpaperus[.]click/ha/?1 hxxps://riovinyl[.]com[.]mx/lm/?1 hxxps://hip[.]co[.]th/oimu/?1 hxxps://folhadireito[.]com/ecce/?1 hxxps://snackys[.]cl/os/?1 hxxps://udinamo[.]edu[.]mx/auso/?1 hxxps://crafttech[.]co/la/?1 hxxps://inventare[.]me/ioea/?1 hxxps://homecrate[.]sg/ou/?1 hxxps://gedmmpe[.]ci/tn/?1 hxxps://pasargadloster[.]ir/ensl/?1 hxxps://saksijezarasad[.]co[.]rs/so/?1 hxxps://insurlabel[.]co[.]tz/sqet/?1 hxxps://movebikes[.]cl/ese/?1 hxxps://fcdsolucionesindustriales[.]co/issu/?1 hxxps://sungaitpb77[.]xyz/tm/?1 hxxps://audit[.]njc[.]gov[.]ng/ifa/?1 hxxps://tpbmmorpg[.]lol/odco/?1 hxxps://embro[.]edu[.]sa/ord/?1 hxxps://tpb77tokdalang[.]lol/use/?1 hxxps://charitraprajapati[.]com[.]np/pexr/?1 hxxps://travu[.]africa/iinl/?1 hxxps://mexicoautomatico[.]mx/oa/?1 hxxps://sharquitectura[.]cat/sq/?1 hxxps://sciforschenonline[.]org/arr/?1 hxxps://snv[.]co[.]zw/ieu/?1 hxxps://insuranceseguros[.]co/los/?1 hxxps://longmarchpakistan[.]com/qteu/?1 hxxps://mge[.]cl/tvr/?1 hxxps://inmobiliariaexhibemex[.]mx/utut/?1 hxxps://sattaking2023[.]in/luit/?1 hxxps://guianft[.]site/anua/?1 hxxps://prohear[.]com[.]br/mnmu/?1 hxxps://constructioncreative[.]site/au/?1 hxxps://sportshd23[.]store/rpmi/?1 hxxps://giftcodetpb77[.]cyou/iiun/?1 hxxps://rcmportal[.]rcm[.]edu[.]ng/uvt/?1 hxxps://protech-lb[.]net/stc/?1 hxxps://techplus[.]com[.]pk/uanr/?1 hxxps://alhoja[.]info/iuot/?1 hxxps://totallyyoubeauty[.]co[.]nz/ials/?1 hxxps://nzcollection[.]pk/oaa/?1 hxxps://oasisinternacional[.]com[.]pe/ta/?1 hxxps://georgeeyitayo[.]com/usc/?1 hxxps://cycloaguas[.]com[.]br/ni/?1 hxxps://microworldindia[.]co[.]in/ul/?1 hxxps://colegiobretondelosherreros[.]edu[.]mx/nuei/?1 hxxps://bmc[.]edu[.]np/omns/?1 hxxps://bhojpurisangam[.]co[.]in/ime/?1 hxxps://jazigus[.]com[.]br/rlir/?1 hxxps://3dsolution[.]online/osd/?1 hxxps://sipromejeunes[.]cm/moeo/?1 hxxps://faisalkabir[.]me/ur/?1 hxxps://mirrornews[.]in/oiim/?1 hxxps://gctrwp[.]edu[.]pk/tq/?1 hxxps://tpb77io[.]cyou/eett/?1 hxxps://denpasa[.]com[.]br/lt/?1 hxxps://planetadasbaterias[.]com[.]br/bot/?1 hxxps://careers2000[.]co[.]za/icu/?1 hxxps://preprod-verticalsquare[.]tech/ip/?1 hxxps://minhazurrahmanbijoy[.]com/tne/?1 hxxps://jornaldoplanalto[.]com[.]br/cus/?1 hxxps://employeejunction[.]tech/ul/?1 hxxps://brandintel[.]co[.]ke/pea/?1 hxxps://soundfactory[.]cl/imvl/?1 hxxps://quranforkids[.]com/iim/?1 hxxps://clearconcepts[.]academy/ntst/?1 hxxps://jobportal[.]tiv[.]vic[.]edu[.]au/qse/?1 hxxps://chiety[.]com[.]co/elra/?1 hxxps://metalmecanicaspikin[.]cl/nt/?1 hxxps://bulleto[.]io/eat/?1 hxxps://topanpubg[.]xyz/dosm/?1 hxxps://orpheocol[.]co/iiln/?1 hxxps://demogem[.]site/tu/?1 hxxps://alexmontagemdemoveis[.]com[.]br/rem/?1 hxxps://scrum[.]ng/enu/?1 hxxps://repararmovil[.]eu/rer/?1 hxxps://classycrete[.]co[.]za/toie/?1 hxxps://appocalypse[.]co/tl/?1 hxxps://irasdesign[.]nl/uqsq/?1 hxxps://hyundai[.]co[.]zw/nti/?1 hxxps://fernandofaria[.]eng[.]br/or/?1 hxxps://ttc[.]edu[.]sg/rl/?1 hxxps://alcotrip[.]games/rn/?1 hxxps://retroarcadesolutions[.]com[.]au/au/?1 hxxps://bestapk[.]tech/uom/?1 hxxps://desentupidorafloripa[.]com[.]br/ma/?1 hxxps://digitalapb[.]online/teta/?1 hxxps://topanwede[.]click/sdc/?1 hxxps://creatrix[.]com[.]mx/abdi/?1 hxxps://revistas[.]upp[.]edu[.]pe/te/?1 hxxps://ansaf[.]or[.]tz/eneo/?1 hxxps://syloam[.]eu/tuit/?1 hxxps://kenyanprime[.]co[.]ke/cui/?1 hxxps://radarsolucoesfinanceiras[.]com[.]br/qdi/?1 hxxps://tpbmaxwin88[.]lol/va/?1 hxxps://ibexproductions[.]pk/saos/?1 hxxps://uaba[.]io/rl/?1 hxxps://rootingenious[.]in/utc/?1 hxxps://neoplenus[.]com[.]br/del/?1 hxxps://sanluisbeltran[.]edu[.]co/tuoe/?1 hxxps://museudelamas[.]pt/utaa/?1 hxxps://bcprojetos[.]pt/tomn/?1 hxxps://photoin[.]click/daa/?1 hxxps://wilshirelabs[.]com/pav/?1 hxxps://groupe2[.]site/ah/?1 hxxps://emilianozapata[.]gob[.]mx/squ/?1 hxxps://pipduck[.]com[.]au/dsot/?1 hxxps://mdea[.]gob[.]pe/lsui/?1 hxxps://forms[.]cac[.]edu[.]au/onut/?1 hxxps://radiosurgery[.]hu/tet/?1 hxxps://electriuniverselle[.]ma/lidr/?1 hxxps://nppnguyenduc[.]com/uiq/?1 hxxps://bpengineering[.]co[.]za/cue/?1 hxxps://centroescolardelmayab[.]edu[.]mx/an/?1 hxxps://picc-penang[.]com/sdie/?1 hxxps://lifestyle[.]mn/etm/?1 hxxps://esquadriasmp[.]com[.]br/inuu/?1 hxxps://kiaracollege[.]com[.]ng/taea/?1 hxxps://dhangame[.]in/ur/?1 hxxps://forumitalia[.]ca/uuqq/?1 hxxps://habesha[.]com[.]au/nrl/?1 hxxps://sabias[.]cl/at/?1 hxxps://crispnclean[.]in/xi/?1 hxxps://aronlifelink[.]in/nldl/?1 hxxps://nailfactory[.]com[.]mx/odt/?1 hxxps://qngnode[.]cc/cisp/?1 hxxps://arabyka[.]com/tit/?1 hxxps://gdcrewalsar[.]in/ra/?1 hxxps://studive[.]pk/inns/?1 hxxps://lantuu[.]xyz/ir/?1 hxxps://srajan[.]in/snh/?1 hxxps://noisefactory[.]io/oers/?1 hxxps://prueba-testing[.]vps[.]co[.]ve/ra/?1 hxxps://greenlinelabs[.]in/is/?1 hxxps://sunrisebandb[.]co[.]za/ial/?1 hxxps://mptactical[.]shop/dq/?1 hxxps://svnkarimganj[.]ac[.]in/tiee/?1 hxxps://limelightchurchinternational[.]org/sun/?1 hxxps://dmsasoc[.]mx/ei/?1 hxxps://dostavka[.]space/im/?1 hxxps://bsyconsultoria[.]com[.]br/tliu/?1 hxxps://counselcrib[.]com[.]ng/mmeu/?1 hxxps://intatec[.]com[.]mx/ein/?1 hxxps://admin[.]njc[.]gov[.]ng/aot/?1 hxxps://vishwahindu[.]edu[.]np/tequ/?1 hxxps://eurolact[.]ro/eo/?1 hxxps://digitalinflux[.]co/vpoa/?1 hxxps://haytham[.]site/auu/?1 hxxps://lorettohouse[.]edu[.]pk/ss/?1 hxxps://sitarahilal[.]pk/ise/?1 hxxps://brimak[.]co[.]za/le/?1 hxxps://visapoint[.]travel/ua/?1 hxxps://vidhyapithmavi[.]edu[.]np/uui/?1 hxxps://apinit[.]in/midq/?1 hxxps://2box[.]store/auiq/?1 hxxps://civilwarhomestead[.]com/qra/?1 hxxps://essayever[.]com/mo/?1 hxxps://geapl[.]co[.]in/rme/?1 hxxps://sohaibr[.]group/ofed/?1 hxxps://uciran[.]ir/ad/?1 hxxps://tu[.]bmc[.]edu[.]np/roa/?1 hxxps://wetalk247[.]tv/lmq/?1 hxxps://pokretoslobodjenje[.]rs/dolo/?1 hxxps://topanantisedot[.]store/rp/?1 hxxps://delasabana[.]com/ui/?1 hxxps://iscool[.]com[.]br/et/?1 hxxps://ultraphysics[.]hu/elsi/?1 hxxps://demo[.]jpe[.]njc[.]gov[.]ng/au/?1 hxxps://hotelcreta[.]mx/in/?1 hxxps://ctvet[.]edu[.]gy/usmd/?1 hxxps://dealpa[.]com[.]mx/ets/?1 hxxps://fashiontive[.]com/tuap/?1 hxxps://tiblej[.]com/mt/?1 hxxps://mytrip[.]ng/uss/?1 hxxps://social-growth[.]dev/sran/?1 hxxps://urologistadrvinicius[.]com[.]br/ln/?1 hxxps://lifesounds[.]us/tnaa/?1 hxxps://lukukenya[.]co[.]ke/teie/?1 hxxps://bestachizitii[.]ro/tete/?1 hxxps://chiomadigitalagency[.]com[.]ng/rlim/?1 hxxps://lavastore[.]cz/isis/?1 hxxps://learntor[.]ng/lm/?1 hxxps://funnylab[.]com[.]br/hee/?1 hxxps://evitamin[.]com[.]pk/qn/?1 hxxps://morcode[.]pt/eti/?1 hxxps://reginaldo[.]com[.]br/sro/?1 hxxps://igorjfbatista[.]online/eq/?1 hxxps://cepemrj[.]com[.]br/spio/?1 hxxps://socialmarketing[.]pt/iicl/?1 hxxps://goldorbit[.]co/matu/?1 hxxps://dramacool9[.]wtf/oics/?1 hxxps://topan77oklah[.]xyz/mros/?1 hxxps://nyarusinga[.]co[.]ke/cta/?1 hxxps://topanasik[.]cyou/et/?1 hxxps://topan77bom[.]xyz/am/?1 hxxps://compnext[.]eu/noa/?1 hxxps://prontomed[.]ro/rr/?1 hxxps://shoppybloom[.]site/iim/?1 hxxps://emerconotec[.]cl/so/?1 hxxps://mybeamlabel[.]nl/ui/?1 hxxps://adsart[.]online/pm/?1 hxxps://slotjpspin88[.]store/ild/?1 hxxps://afelschool[.]com/qat/?1 hxxps://imextrade[.]ltd/sih/?1 hxxps://examhelper[.]com[.]ng/iasm/?1 hxxps://bestmix[.]ae/sesr/?1 hxxps://cinematalkies[.]in/me/?1 hxxps://yourgoal[.]pl/eu/?1 hxxps://fivebrosreno[.]ca/ciii/?1 hxxps://cutacut[.]com/rue/?1 hxxps://lotusint[.]xyz/nsn/?1 hxxps://alkhidmahtravels[.]site/ei/?1 |
QakBot |
| URL | hxxps://www[.]health[.]gov[.]fj/ddcmdawmk[.]htm hxxps://a[.]ezydict[.]com/4th_2[.]zip |
NetSupportManager RAT |
| URL | hxxps://www[.]city-optikhaus[.]shop:2053/async/ddljson hxxp://123[.]56[.]160[.]111/dpixel hxxp://43[.]139[.]69[.]115:8090/pixel hxxp://92[.]63[.]196[.]47:9765/pixel hxxp://139[.]224[.]188[.]165/pixel[.]gif hxxp://114[.]116[.]67[.]8/push hxxp://129[.]226[.]211[.]237:6666/load hxxp://43[.]142[.]188[.]168:8223/cx hxxps://119[.]23[.]61[.]52:8098/ca hxxp://101[.]42[.]37[.]235:9999/pixel[.]gif hxxps://124[.]222[.]3[.]42/en_US/all[.]js hxxp://68[.]183[.]237[.]202:56226/g[.]pixel hxxp://103[.]70[.]59[.]130:8945/updates[.]rss hxxps://chidao[.]icu:8443/ga[.]js hxxp://172[.]245[.]180[.]61:11000/activity hxxps://106[.]52[.]116[.]188/pixel hxxp://150[.]158[.]212[.]71/push hxxp://120[.]48[.]9[.]221:9999/j[.]ad hxxps://124[.]223[.]6[.]231:4432/cx hxxp://172[.]245[.]180[.]61:12000/activity hxxps://www[.]micrcscft-store[.]com/mg hxxp://43[.]142[.]188[.]168:8333/visit[.]js hxxp://www[.]0nedriveup[.]com:2022/push hxxp://47[.]113[.]231[.]140:81/fwlink hxxp://124[.]221[.]127[.]90/g[.]pixel hxxps://211[.]101[.]244[.]179/pixel hxxps://www[.]taxinfoservices[.]org/api/v2/json/resources/modules/list hxxp://1[.]117[.]57[.]7:6667/api/x hxxp://124[.]71[.]192[.]197/ca hxxp://101[.]33[.]210[.]57/ca hxxp://193[.]134[.]210[.]26:50000/activity hxxp://114[.]115[.]185[.]41:44444/updates[.]rss hxxps://62[.]234[.]12[.]42/j[.]ad hxxp://39[.]100[.]70[.]50/updates[.]rss hxxp://116[.]62[.]16[.]54:9124/ca hxxps://116[.]63[.]137[.]69/visit[.]js hxxp://39[.]105[.]191[.]1:8080/cm hxxps://106[.]12[.]106[.]210/pixel[.]gif hxxps://121[.]40[.]75[.]34/api/info hxxp://154[.]221[.]17[.]44:2090/g[.]pixel hxxp://38[.]54[.]16[.]142:10010/visit[.]js hxxp://38[.]34[.]185[.]188:4444/push hxxps://62[.]234[.]13[.]73:8899/api/x hxxps://18[.]204[.]142[.]71/__utm[.]gif hxxp://139[.]159[.]137[.]236/match hxxps://101[.]35[.]234[.]201:18443/load hxxp://149[.]127[.]237[.]67/ca hxxp://82[.]117[.]252[.]36/disable/v1[.]05/Online hxxp://123[.]207[.]41[.]129:8888/fwlink hxxps://172[.]86[.]77[.]70/fwlink hxxp://139[.]196[.]47[.]225:2248/search hxxps://47[.]241[.]225[.]61/IE9CompatViewList[.]xml hxxps://coalafoods[.]com/design/query/9X5M3SOE0F hxxp://49[.]4[.]24[.]255:8012/ptj hxxp://47[.]94[.]215[.]220:1521/pixel hxxp://8[.]140[.]63[.]62:8761/__utm[.]gif hxxps://101[.]35[.]112[.]94:8443/g[.]pixel hxxps://1[.]117[.]176[.]254/load |
Cobalt Strike |
| URL | hxxps://bluestaks[.]novationgroups[.]com/post/ClipperDoej4oa[.]exe | Laplas |
| URL | hxxps://red[.]mk/netTime[.]exe | XMRig |
| URL | hxxp://oraycdn[.]com/gate[.]php | Colibri Loader |
| URL | hxxp://95[.]214[.]25[.]239/gjdj[.]exe | Arkei Stealer |
| URL | hxxps://sociembal[.]pt/SetUpLyla1408[.]exe hxxp://entrenaconraulfit[.]com/1/data64_2[.]exe |
RedLine Stealer |
| URL | hxxps://bluestaks[.]novationgroups[.]com/post/p5zl9bq82kjf7[.]exe | Coinminer |
| URL | hxxp://185[.]252[.]179[.]100/download/gate_011[.]exe | PrivateLoader |
| URL | hxxp://dba692117be7b6d3480fe5220fdd58b38bf[.]xyz/API/2/configure[.]php | AllcomeClipper |
| URL | hxxp://161[.]35[.]102[.]56/~nikol/?p=7093752 | LokiBot |
