不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/06/23
※2023/06/23 更新
マルウェア感染させると考えられるURLを検知（2023/06/23）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://192[.]210[.]215[.]42/bf/panel/uploads/Yjsdwwlrsgm[.]mp3 hxxp://192[.]3[.]109[.]146/sde/sdesdesdesdsesdfsdfefsfsdssdsedsesdsdsdsde%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23sdsesdsdsdesdsdedsedse[.]doc hxxp://192[.]3[.]109[.]146/256/cleanmgrse[.]exe |
Snake Keylogger |
| URL | hxxp://83[.]97[.]73[.]134/gallery/photo085[.]exe | Amadey |
| URL | hxxp://45[.]88[.]66[.]43/44yQ9dcOIkFHUOt[.]exe hxxp://194[.]180[.]48[.]58/chamberszx[.]exe hxxp://198[.]23[.]156[.]244/soft[.]exe hxxp://195[.]178[.]120[.]24/xvbhfhf[.]txt hxxps://sofancy[.]co[.]za/data/IqXYLXKzl6[.]exe |
Agent Tesla |
| URL | hxxp://xn--demirdkmyetkiliservis-mec3l[.]com[.]tr/fxmoftytka/vodka[.]gif hxxps://orimar[.]com[.]mx/ifmuwxrlse/ifmuwxrlse[.]gif hxxps://charlottepajamass[.]com/yxxqvysjsx/yxxqvysjsx[.]gif hxxps://weppydev[.]com[.]co/pnzjonelxc/pnzjonelxc[.]gif hxxps://roya4tpwebsite[.]almoasherbiz[.]com/ssbfxkethi/ssbfxkethi[.]gif hxxps://radiotvmixcba[.]com[.]ar/lrjuxtikhi/lrjuxtikhi[.]gif hxxps://thestreamresort[.]in/whhhpivtfu/whhhpivtfu[.]gif hxxp://doanlienhiep[.]vn/jtgyyassoz/jtgyyassoz[.]gif hxxp://assadgroup[.]qa/terbdwyspc/terbdwyspc[.]gif hxxp://redseafunding[.]com/bhqukzbvse/bhqukzbvse[.]gif hxxp://iowastormcenter[.]com/fhgymxnkte/fhgymxnkte[.]gif hxxps://aromaequestrian[.]com/drbqbmzssb/drbqbmzssb[.]gif hxxps://budgetgad[.]com/jhlciprlhx/jhlciprlhx[.]gif hxxps://gruposdl[.]com[.]br/baorpblgnu/baorpblgnu[.]gif hxxps://newlaunchesproject[.]com/shlrcdpyid/shlrcdpyid[.]gif hxxps://ashokudhayan[.]com/jpdsvtreny/jpdsvtreny[.]gif hxxp://jynacademy[.]com/anlhdovxxp/anlhdovxxp[.]gif hxxp://vaillantyetkiliservisim[.]com[.]tr/bbsistqmrl/bbsistqmrl[.]gif hxxp://olisra[.]com/btpdqomoiu/btpdqomoiu[.]gif hxxp://dizitaion[.]com/lnztiekrsu/lnztiekrsu[.]gif hxxp://dev[.]boostsearches[.]com/rebmpqfgly/rebmpqfgly[.]gif hxxp://ecomnz[.]com/ngbxgstvvx/ngbxgstvvx[.]gif hxxps://kitesconsulting[.]us/ohfcbneuel/ohfcbneuel[.]gif hxxps://jamunaadv[.]com/qdjnvkbrhz/qdjnvkbrhz[.]gif hxxps://thirdtotwelve[.]com/nwnsktbssb/nwnsktbssb[.]gif hxxp://151[.]236[.]14[.]86/gF1sH2v/CD745 hxxps://telusgroup[.]co/uwxzplhvwm/uwxzplhvwm[.]gif hxxp://151[.]236[.]14[.]60/c1oHe/CaiQr83Z hxxp://162[.]252[.]175[.]53/krBALa/7UFYXgld hxxps://104[.]129[.]119[.]201/BKg/Kk5V hxxp://193[.]235[.]147[.]20/6BlnalS/YIYIU4MpCLP hxxp://advisersbiasways[.]productions/ux/byag hxxps://swofacin[.]com/vodka[.]dat hxxps://cehazik[.]com/vodka[.]dat hxxps://hevintar[.]com/vodka[.]dat hxxps://tytrhel[.]com/vodka[.]dat hxxps://cosiruk[.]com/vodka[.]dat hxxps://cgpersa[.]com/vodka[.]dat hxxp://ingemarsa[.]cl/srmlaazljh/srmlaazljh[.]gif hxxps://goldwincfs[.]com[.]ph/tjcakuxvab/tjcakuxvab[.]gif hxxps://jupitermaturin[.]com/mmqbvkjsln/mmqbvkjsln[.]gif hxxps://segurivi[.]cl/hhswlhfkyt/hhswlhfkyt[.]gif hxxps://lmt20[.]com/bjhukgpncs/bjhukgpncs[.]gif hxxps://nofoodwaste[.]org/txxxzqnwgs/txxxzqnwgs[.]gif hxxp://pn-jayapura[.]go[.]id/rwhdnuavuo/rwhdnuavuo[.]gif hxxp://zikay[.]biz/tkcmwdlusy/tkcmwdlusy[.]gif hxxp://rolopom[.]com/alfqtwrbcn/alfqtwrbcn[.]gif hxxps://ourlovelyday[.]us/xuenxavleu/xuenxavleu[.]gif hxxps://carrot-entertainment[.]com/ocermwhvfo/ocermwhvfo[.]gif hxxp://colegiopablohoff[.]edu[.]co/ycuecyxcjt/ycuecyxcjt[.]gif hxxps://zikay[.]com/ozwjnlyhgl/ozwjnlyhgl[.]gif hxxps://appteco-demo[.]info/xxblccdrpr/xxblccdrpr[.]gif hxxp://garagedoorportsmouthnh[.]com/xnozmxusda/xnozmxusda[.]gif hxxp://treegeyecare[.]com/ypsormkzyz/ypsormkzyz[.]gif hxxp://anilens[.]co/bblmmchaev/bblmmchaev[.]gif hxxp://td[.]rcat[.]online/hmueygvyke/hmueygvyke[.]gif hxxps://jaivecreditrepair[.]com/oriuwovqbo/oriuwovqbo[.]gif hxxps://brotherocean[.]com/bebarwlxbs/bebarwlxbs[.]gif hxxps://janakagroup[.]lk/dfvurstvvb/dfvurstvvb[.]gif hxxp://peruguia[.]xyz/cqeuhdpzva/cqeuhdpzva[.]gif hxxp://jardimalecrim[.]com/pvfcgaxxma/pvfcgaxxma[.]gif hxxp://filipeshoes[.]com/xgzvmonwno/xgzvmonwno[.]gif hxxp://giftgram[.]shop/exkanndllo/exkanndllo[.]gif hxxps://ratoolsourcing[.]com/bziqzdulys/bziqzdulys[.]gif hxxps://shinnysportss[.]com/lzyeyqyhjd/lzyeyqyhjd[.]gif hxxps://ikankite[.]my[.]id/qvpooltzkc/qvpooltzkc[.]gif hxxps://mujerpotencialmenterica[.]com/whimaxqmth/whimaxqmth[.]gif hxxps://passbaan[.]com/lwqbjkrfla/lwqbjkrfla[.]gif hxxp://pn-jayapura[.]go[.]id/jdifafinzt/jdifafinzt[.]gif hxxps://macplatforms[.]com/ghfjwjavyv/ghfjwjavyv[.]gif hxxp://ezgaragedoorlawrencema[.]com/rkvvywzdnl/rkvvywzdnl[.]gif hxxp://i-mapsolutions[.]com/ytujmucsyj/ytujmucsyj[.]gif hxxp://wordpresstest[.]vledev[.]com/hjbuuckjqb/hjbuuckjqb[.]gif hxxps://garagedoorrepaireasthartfordct[.]com/mvnreebamf/mvnreebamf[.]gif hxxps://garagedoorsattleboroma[.]com/huyzkfpuah/huyzkfpuah[.]gif hxxp://bios[.]pe/sabfdetiuu/sabfdetiuu[.]gif hxxps://garagedoorrepairmillis[.]com/yzcporpgwv/yzcporpgwv[.]gif hxxp://topnewslb[.]com/bjzuqrrvil/bjzuqrrvil[.]gif hxxp://fixergaragedoor[.]com/iszzecbyeo/iszzecbyeo[.]gif |
QakBot |
| URL | hxxp://5[.]42[.]66[.]3/bo/fundtitleie64[.]zip hxxp://5[.]42[.]64[.]15/bo/westatisticie64[.]zip hxxp://5[.]42[.]64[.]15/bo/artadditionie64[.]zip hxxp://193[.]233[.]134[.]57/puhatka/payload hxxp://5[.]42[.]64[.]6/3d980df4aa7e4a91[.]php hxxp://65[.]108[.]210[.]97/6338efb1723e277d[.]php |
Stealc |
| URL | hxxp://filetops[.]com/1006[.]exe hxxp://95[.]214[.]27[.]98/lend/bira[.]exe hxxp://192[.]3[.]109[.]135/50/[.]NetFramework[.]exe |
RedLine Stealer |
| URL | hxxp://kngppdp[.]shop/Dbl3/index[.]php | Azorult |
| URL | hxxp://194[.]180[.]48[.]59/mpomzx[.]doc hxxp://194[.]180[.]48[.]59/mpomzx[.]exe |
Formbook |
| URL | hxxp://oraxsoft[.]com/Files/3[.]exe | Loda |
| URL | hxxp://daveonenewtestpanel[.]com/axis/cone[.]php | Bitter RAT |
| URL | hxxp://135[.]181[.]32[.]61/zelda[.]zip hxxp://195[.]201[.]45[.]110/upload[.]zip |
Vidar |
| URL | hxxps://101[.]43[.]215[.]118/__utm[.]gif hxxps://103[.]211[.]124[.]126/windows-updates hxxps://103[.]211[.]124[.]125/windows-updates hxxps://103[.]211[.]124[.]124/windows-updates hxxps://103[.]211[.]124[.]123/windows-updates hxxps://103[.]211[.]124[.]122/windows-updates hxxp://124[.]223[.]91[.]53:88/dpixel hxxp://47[.]100[.]180[.]123:3003/g[.]pixel hxxp://129[.]226[.]201[.]214:9999/visit[.]js hxxp://101[.]33[.]199[.]47:7777/dpixel hxxp://external[.]myazureonline[.]com/ga[.]js hxxp://154[.]221[.]17[.]44:2090/en_US/all[.]js hxxp://45[.]14[.]66[.]194:4444/api/x hxxp://185[.]225[.]74[.]47/en_US/all[.]js hxxp://54[.]234[.]158[.]24/update_wapp2[.]aspx hxxp://92[.]63[.]196[.]48:92/visit[.]js hxxp://88[.]218[.]192[.]130:8086/ca hxxps://81[.]68[.]152[.]129/eo[.]js hxxp://43[.]139[.]146[.]60:8069/ptj hxxps://8[.]130[.]45[.]91/j[.]ad hxxp://43[.]139[.]70[.]248:8001/dot[.]gif hxxps://101[.]33[.]199[.]47:5555/push hxxp://13[.]48[.]123[.]193/oscp/ hxxp://152[.]89[.]198[.]29/visit[.]js hxxp://101[.]42[.]37[.]235:6666/pixel hxxps://c2c[.]updatenews[.]me/match hxxp://121[.]36[.]225[.]82:100/match hxxps://194[.]41[.]59[.]3/mhtget/ hxxp://8[.]130[.]96[.]100/g[.]pixel hxxps://usadevgroup[.]com/ee[.]html hxxp://47[.]110[.]248[.]105/__utm[.]gif hxxp://45[.]116[.]76[.]16:6666/g[.]pixel hxxp://194[.]87[.]68[.]171:8080/ca hxxp://101[.]35[.]234[.]156/cm hxxp://usadevgroup[.]com/fam_calendar hxxps://121[.]4[.]72[.]239:8030/push hxxps://38[.]60[.]214[.]248/en_US/all[.]js hxxps://103[.]234[.]72[.]150/ca hxxps://redteambp[.]tech/__utm[.]gif hxxp://47[.]92[.]87[.]184:8080/api/info hxxps://43[.]143[.]175[.]235:8003/activity hxxps://45[.]76[.]97[.]86/dot[.]gif hxxp://8[.]130[.]110[.]174/match hxxps://101[.]35[.]21[.]201:50002/load |
Cobalt Strike |
| URL | hxxps://ishahcouture[.]com/wp-content/uploads/2020/03/ActiveGlucol[.]zip | NetSupportManager RAT |
| URL | hxxp://95[.]214[.]27[.]98/lend/203decdty8ubl2[.]exe | Rhadamanthys |
| URL | hxxp://5[.]161[.]143[.]111/Linuximage/Multi3/Default/multi/Eternal/WordpressUniversal/SecureLowbasewordpress/sql4hxxp8/wordpress/PrivateAsync1cpu/php/UpdateRequestPrivate0/externalpythonPhpUpdates[.]php | DCRat |
| URL | hxxps://artwork[.]siddavisart[.]com/5g6RGJ0s8nGCLKsq0D29OpQsqzqcbOk6mw== hxxps://inside[.]awesomepotions[.]com/fQTEgwYmp+oZJv6xSzfooQ8m/qELcrHiB3Wl9Bho5v4= |
FAKEUPDATES |
| URL | hxxp://109[.]206[.]240[.]64/tl/RmeONIErjnwcBdKC67[.]bin hxxp://109[.]206[.]240[.]64/tl/hNjnzd124[.]bin |
CloudEyE |
