不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/07/05
※2023/07/05 更新
マルウェア感染させると考えられるURLを検知（2023/07/05）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://138[.]68[.]56[.]139/?p=8184221136284 hxxp://cryptersandtools[.]minhacasa[.]tv/e/e hxxp://79[.]110[.]49[.]55/simolz[.]txt hxxp://138[.]68[.]56[.]139/?p=79846033643176 |
LokiBot |
| URL | hxxp://23[.]137[.]249[.]127/ddw23/Ozgkdiw[.]exe hxxp://95[.]214[.]27[.]98/lend/monitordhcp_cr[.]exe hxxp://109[.]172[.]83[.]121/windowsImageBigload/4Server4/javascript/Line/PrivateBase6Track/universal/2Cpu2/Pipe/linetohxxpprocess[.]php hxxp://80[.]87[.]192[.]174/VideoProviderasyncProtect/Sql5Dle/Uploads5/betterPrivate9Db/VoiddbMariadb/7game/Request66/update/temphxxp/api/hxxprequest/low/PipeCpu/ServerUpdatecentral/Cdn/multibetter1Wordpress/PollPythonTraffichxxp/externalapiserveruniversalTemp[.]php |
DCRat |
| URL | hxxp://185[.]246[.]220[.]60/defounder[.]exe hxxp://185[.]246[.]220[.]60/thirdagodzx[.]doc hxxp://185[.]246[.]220[.]60/mazx[.]doc hxxp://185[.]246[.]220[.]60/defounderzx[.]doc hxxp://23[.]95[.]122[.]102/222/RegEdit[.]exe hxxp://185[.]246[.]220[.]60/thirdagodzx[.]exe hxxp://185[.]246[.]220[.]60/mazx[.]exe hxxp://87[.]121[.]221[.]212/nellyzx[.]exe |
Formbook |
| URL | hxxp://185[.]246[.]220[.]60/chamberzx[.]exe hxxp://185[.]246[.]220[.]60/chamberzx[.]doc hxxp://195[.]178[.]120[.]24/dkxlkncxkbvnxbvxknvnvxnvxz[.]txt hxxp://23[.]95[.]122[.]102/bbg/bbgbbbgbbbgbgbbgbgbgbbggb%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23bbgbgbgbbgb[.]doc hxxp://23[.]95[.]122[.]102/221/RegEdit[.]exe hxxp://87[.]121[.]221[.]212/gvailantzx[.]exe hxxp://79[.]110[.]49[.]55/oplasx[.]vbs hxxp://87[.]121[.]221[.]212/millianozx[.]exe hxxp://87[.]121[.]221[.]212/wealthzx[.]exe hxxp://87[.]121[.]221[.]212/wealthzx[.]doc hxxp://87[.]121[.]221[.]212/millianozx[.]doc hxxp://87[.]121[.]221[.]212/obizx[.]doc hxxps://zyp[.]to/n4rni |
Agent Tesla |
| URL | hxxp://49[.]13[.]9[.]29/someoneadasylf[.]zip hxxp://116[.]202[.]176[.]70/get[.]zip hxxp://116[.]202[.]6[.]52:27016/get[.]zip |
Vidar |
| URL | hxxp://194[.]59[.]218[.]151/Brassate[.]exe | CloudEyE |
| URL | hxxps://acienco[.]com/mmfqdf2p9r107[.]exe | Coinminer |
| URL | hxxp://tthre3vt[.]top/zip[.]php | CryptBot |
| URL | hxxp://5[.]78[.]65[.]112:8988/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://5[.]78[.]65[.]112:8988/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://5[.]78[.]65[.]112:8988/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://5[.]78[.]65[.]112:8988/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://5[.]78[.]65[.]112:8988/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://5[.]78[.]65[.]112:8988/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://5[.]78[.]65[.]112:8988/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://45[.]150[.]65[.]128/b8a2dc7eaa92506e/sqlite3[.]dll hxxp://45[.]150[.]65[.]128/b8a2dc7eaa92506e/vcruntime140[.]dll hxxp://45[.]150[.]65[.]128/b8a2dc7eaa92506e/mozglue[.]dll hxxp://45[.]150[.]65[.]128/b8a2dc7eaa92506e/freebl3[.]dll hxxp://45[.]150[.]65[.]128/b8a2dc7eaa92506e/msvcp140[.]dll hxxp://45[.]150[.]65[.]128/b8a2dc7eaa92506e/nss3[.]dll hxxp://45[.]150[.]65[.]128/b8a2dc7eaa92506e/softokn3[.]dll hxxp://212[.]118[.]43[.]207/bd3e1635a6b33d1c/vcruntime140[.]dll hxxp://212[.]118[.]43[.]207/bd3e1635a6b33d1c/sqlite3[.]dll hxxp://212[.]118[.]43[.]207/bd3e1635a6b33d1c/softokn3[.]dll hxxp://212[.]118[.]43[.]207/bd3e1635a6b33d1c/mozglue[.]dll hxxp://212[.]118[.]43[.]207/bd3e1635a6b33d1c/freebl3[.]dll hxxp://212[.]118[.]43[.]207/bd3e1635a6b33d1c/msvcp140[.]dll hxxp://212[.]118[.]43[.]207/bd3e1635a6b33d1c/nss3[.]dll hxxp://172[.]86[.]70[.]117/94ed4bf54583a4fa[.]php |
Stealc |
| URL | hxxp://185[.]246[.]220[.]60/plugmanzx[.]exe | Remcos |
| URL | hxxp://1[.]117[.]176[.]254:443/bootstrap-2[.]min[.]js hxxp://1[.]117[.]176[.]254:443/pixel[.]gif hxxp://47[.]117[.]163[.]173:6666/cx hxxp://43[.]153[.]222[.]28:4646/__utm[.]gif hxxp://121[.]40[.]174[.]104/dot[.]gif hxxp://121[.]4[.]119[.]100:8888/match hxxps://119[.]188[.]86[.]194/reactivate/encryption/LKPFSFMBP hxxp://139[.]9[.]41[.]77:9000/dpixel hxxps://62[.]204[.]41[.]24:4444/functionalStatus/0hVCgni4jd9Ih5fgjGw1AdZFPlFttHKLTI hxxps://web[.]comchinantp[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://82[.]156[.]125[.]53:6443/www/handle/doc hxxp://175[.]24[.]177[.]84:50001/g[.]pixel hxxps://172[.]81[.]211[.]162:12344/pixel[.]gif hxxp://web[.]comchinantp[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://cins[.]hin7lostvas[.]pro:8443/groupcp[.]css hxxps://175[.]24[.]177[.]84:50002/pixel[.]gif hxxps://85[.]10[.]132[.]67/__utm[.]gif hxxp://49[.]65[.]96[.]139:8087/__utm[.]gif hxxp://35[.]89[.]201[.]66/files/april24[.]dll hxxp://121[.]4[.]34[.]103:81/IE9CompatViewList[.]xml hxxp://111[.]230[.]71[.]198:9090/IE9CompatViewList[.]xml hxxps://47[.]92[.]155[.]81/search/ hxxp://209[.]141[.]32[.]98:8081/pixel[.]gif hxxps://service[.]jaguarlandroverglobalservice[.]com/push hxxp://158[.]247[.]201[.]132/IE9CompatViewList[.]xml hxxp://120[.]76[.]173[.]159:8091/ca hxxps://114[.]115[.]220[.]3:8080/owa hxxps://nameless[.]life/IE9CompatViewList[.]xml hxxp://101[.]43[.]117[.]80/match hxxp://a[.]yuyancloud[.]asia:88/dot[.]gif hxxp://43[.]143[.]184[.]22:8031/updates[.]rss hxxp://194[.]50[.]153[.]42/gv[.]html hxxp://106[.]55[.]187[.]63:9080/push hxxp://1[.]14[.]63[.]190:8999/ptj hxxp://38[.]34[.]185[.]188:4999/IE9CompatViewList[.]xml hxxp://103[.]142[.]246[.]228/pixel hxxp://123[.]176[.]98[.]169:88/j[.]ad hxxp://157[.]245[.]201[.]255:8082/image/ hxxp://123[.]57[.]174[.]182:8888/pixel[.]gif hxxp://vnet[.]keshant[.]com:8880/api/3 hxxps://124[.]221[.]76[.]197/load hxxp://124[.]221[.]152[.]208:3333/match hxxps://vnet[.]keshant[.]com:8443/api/3 |
Cobalt Strike |
| URL | hxxp://vaalviewhmtlab[.]com/new64[.]dll | SystemBC |
| URL | hxxp://77[.]91[.]68[.]144:8000/2[.]exe hxxp://95[.]214[.]27[.]98/lend/Aleksey289_crypted[.]exe |
RedLine Stealer |
| URL | hxxps://exeseria[.]com/aperto hxxp://exeseria[.]com/aperto hxxps://exeseria[.]com/subordinati hxxp://185[.]82[.]126[.]202/sk64[.]jpg hxxp://185[.]82[.]126[.]202/sk32[.]jpg |
Gozi |
| URL | hxxps://entregabrasx[.]com/awsdownload/71dc968deda4d244063a5718e42e522a | Ousaban |
| URL | hxxp://gstatic-node[.]io/c2sock | Lumma Stealer |
