不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/07/10
※2023/07/10 更新
マルウェア感染させると考えられるURLを検知（2023/07/10）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://cgjmz[.]rfc[.]zitoprohealth[.]com/editContent hxxps://hhv[.]rfc[.]zitoprohealth[.]com/editContent hxxps://bleu[.]rfc[.]zitoprohealth[.]com/editContent hxxps://rpie[.]rfc[.]zitoprohealth[.]com/editContent hxxps://klxqb[.]rfc[.]zitoprohealth[.]com/editContent hxxps://biggreenlimes[.]org/h6JnYNfT hxxp://asfgze[.]fun/f23[.]svg hxxp://ahmgbgjhdlmmlnf[.]top/1[.]php?s=523 hxxp://asfgze[.]fun/f15[.]svg hxxp://ahmgbgjhdlmmlnf[.]top/1[.]php hxxp://ahmgbgjhdlmmlnf[.]top/2[.]php hxxps://vaa[.]rfc[.]zitoprohealth[.]com/editContent |
FAKEUPDATES |
| URL | hxxps://api[.]baimless[.]com/download/a[.]exe | Raccoon |
| URL | hxxp://itrevolution[.]in/enstomc2[.]1[.]exe hxxps://www[.]torq[.]qa/fIPfypJYu76PrjPnEo[.]exe |
Formbook |
| URL | hxxp://138[.]68[.]56[.]139/?p=628638060796 hxxp://138[.]68[.]56[.]139/?p=76150 hxxp://195[.]178[.]120[.]24/looorlki[.]exe hxxp://138[.]68[.]56[.]139/?p=2744 hxxp://blaztech[.]us/[.]en/image/fre[.]php |
LokiBot |
| URL | hxxp://45[.]133[.]1[.]182/proxies[.]txt | PrivateLoader |
| URL | hxxp://152[.]89[.]198[.]34/3b4f49719257c673[.]php hxxp://152[.]89[.]198[.]34/c1654e8c7c26cf7f/nss3[.]dll hxxp://152[.]89[.]198[.]34/c1654e8c7c26cf7f/sqlite3[.]dll hxxp://152[.]89[.]198[.]34/c1654e8c7c26cf7f/softokn3[.]dll hxxp://152[.]89[.]198[.]34/c1654e8c7c26cf7f/freebl3[.]dll hxxp://152[.]89[.]198[.]34/c1654e8c7c26cf7f/msvcp140[.]dll hxxp://152[.]89[.]198[.]34/c1654e8c7c26cf7f/mozglue[.]dll hxxp://152[.]89[.]198[.]34/c1654e8c7c26cf7f/vcruntime140[.]dll hxxp://5[.]78[.]104[.]95/7322cd0544d1389a[.]php hxxp://5[.]78[.]104[.]95/b16d5552b8e9c6da/nss3[.]dll hxxp://5[.]78[.]104[.]95/b16d5552b8e9c6da/sqlite3[.]dll hxxp://5[.]78[.]104[.]95/b16d5552b8e9c6da/msvcp140[.]dll hxxp://5[.]78[.]104[.]95/b16d5552b8e9c6da/softokn3[.]dll hxxp://5[.]78[.]104[.]95/b16d5552b8e9c6da/mozglue[.]dll hxxp://5[.]78[.]104[.]95/b16d5552b8e9c6da/freebl3[.]dll hxxp://5[.]78[.]104[.]95/b16d5552b8e9c6da/vcruntime140[.]dll hxxp://91[.]103[.]252[.]12/522d6f9280951d7f[.]php hxxp://194[.]50[.]153[.]23/9af57c9106bf2c01[.]php hxxp://reserchvpn[.]com/d9e6a8dee399ba79[.]php |
Stealc |
| URL | hxxp://77[.]91[.]68[.]3/home/love/index[.]php hxxp://77[.]91[.]68[.]3/home/love/Plugins/clip64[.]dll hxxp://77[.]91[.]68[.]3/home/love/Plugins/cred64[.]dll hxxp://185[.]252[.]179[.]228/crocus/index[.]php hxxp://45[.]9[.]74[.]164/b7djSDcPcZ/index[.]php hxxp://185[.]252[.]179[.]228/crocus/Plugins/clip64[.]dll hxxp://77[.]91[.]124[.]5/gallery/photo270[.]exe |
Amadey |
| URL | hxxp://goldenstateglobalmail[.]com/new[.]exe hxxp://95[.]217[.]65[.]170/f96upol[.]exe |
Lumma Stealer |
| URL | hxxp://5[.]75[.]240[.]14/someoneadasylf[.]zip hxxp://167[.]235[.]204[.]174:27016/get[.]zip hxxp://168[.]119[.]55[.]206/someoneadasylf[.]zip hxxp://94[.]130[.]148[.]34/someoneadasylf[.]zip |
Vidar |
| URL | hxxp://79[.]110[.]49[.]55/nde[.]txt hxxp://23[.]95[.]122[.]102/51/win[.]exe hxxp://87[.]121[.]221[.]212/kudizx[.]doc hxxp://itrevolution[.]in/3qN9jJaXKsSA8e0LiGHt[.]exe hxxp://62[.]233[.]57[.]190/z1/PTT_20230707-WA01120xlsx[.]exe hxxp://79[.]110[.]49[.]55/nbvzfip[.]txt hxxp://87[.]121[.]221[.]212/herozx[.]exe hxxp://87[.]121[.]221[.]212/R0986545678[.]exe hxxp://87[.]121[.]221[.]212/europowerzx[.]doc hxxp://87[.]121[.]221[.]212/kudizx[.]exe |
Agent Tesla |
| URL | hxxp://spicysalthk[.]com/new64[.]dll hxxps://celloquidcapital[.]com/new64x[.]dll |
SystemBC |
| URL | hxxp://45[.]142[.]182[.]146/keysmaftehotim/nvdaiaContainer[.]exe hxxp://45[.]142[.]182[.]146/keysmaftehotim/AMDx46[.]exe hxxp://5[.]42[.]86[.]86/license[.]exe |
Coinminer |
| URL | hxxps://198[.]144[.]187[.]19/jquery-3[.]3[.]1[.]min[.]js hxxps://update[.]optelinteloss[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://update[.]optaneinteloss[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://123[.]234[.]2[.]86/en-us/silentauth hxxps://150[.]138[.]179[.]182/en-us/silentauth hxxp://1[.]14[.]63[.]190:8999/ga[.]js hxxp://47[.]242[.]0[.]207:8080/pixel hxxp://106[.]12[.]129[.]225:81/ga[.]js hxxp://43[.]138[.]212[.]90:8090/api/getit hxxp://47[.]92[.]100[.]70:8000/match hxxp://43[.]133[.]32[.]97:6666/image/ hxxp://106[.]15[.]170[.]141/push hxxp://118[.]24[.]128[.]43/__utm[.]gif hxxps://www[.]nacosgov[.]xyz:2087/assets/code-3d7b701fc6eb[.]css hxxp://182[.]92[.]71[.]20/ga[.]js hxxp://91[.]238[.]203[.]23:8006/en_US/all[.]js hxxp://124[.]222[.]32[.]173:84/fwlink hxxp://47[.]96[.]233[.]223:8445/__utm[.]gif hxxp://101[.]33[.]235[.]149/pixel[.]gif hxxp://20[.]24[.]65[.]23:8888/ga[.]js hxxp://150[.]158[.]137[.]72:10010/cm hxxp://195[.]123[.]233[.]9/add/contact-us/help hxxp://124[.]223[.]177[.]244:6666/CWoNaJLBo/VTNeWw11212/ hxxp://101[.]43[.]187[.]70/dpixel hxxp://180[.]76[.]164[.]197:12345/visit[.]js hxxp://47[.]109[.]105[.]56/updates[.]rss hxxp://216[.]83[.]48[.]71/__utm[.]gif hxxps://47[.]107[.]36[.]89/updates hxxps://cs[.]aazurenet[.]xyz/updates hxxp://47[.]104[.]244[.]206:8088/ptj hxxp://173[.]249[.]201[.]243:88/ca hxxp://121[.]4[.]115[.]219:8888/ptj hxxps://117[.]50[.]192[.]220/g[.]pixel hxxp://1[.]15[.]225[.]244:81/IE9CompatViewList[.]xml hxxp://49[.]7[.]131[.]69:9999/visit[.]js hxxp://47[.]242[.]0[.]207:9999/dot[.]gif hxxps://121[.]5[.]134[.]64/ga[.]js hxxp://47[.]105[.]53[.]99:7002/match hxxps://47[.]115[.]219[.]93:8443/ptj hxxps://82[.]157[.]110[.]128/activity hxxp://111[.]231[.]4[.]143:8440/broadcast hxxps://8[.]140[.]37[.]238:9090/en_US/all[.]js hxxps://43[.]143[.]74[.]28:4455/pixel hxxps://143[.]198[.]241[.]192/jquery-3[.]3[.]1[.]min[.]js hxxps://134[.]122[.]10[.]106/jquery-3[.]3[.]1[.]min[.]js hxxps://134[.]122[.]0[.]130/jquery-3[.]3[.]1[.]min[.]js hxxps://167[.]99[.]52[.]241/jquery-3[.]3[.]1[.]min[.]js hxxp://156[.]247[.]11[.]238:8080/load hxxps://192[.]198[.]82[.]238/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://121[.]37[.]208[.]189/dpixel hxxp://216[.]83[.]48[.]71:8080/j[.]ad hxxps://195[.]123[.]233[.]9/add/contact-us/help hxxps://124[.]71[.]39[.]203/dpixel hxxp://207[.]226[.]136[.]40:88/updates[.]rss hxxps://8[.]217[.]147[.]50/pixel hxxps://101[.]37[.]88[.]59:6000/visit[.]js hxxp://82[.]157[.]110[.]128/updates[.]rss hxxps://82[.]157[.]110[.]128/fwlink hxxps://70[.]18[.]21[.]5:5999/fwlink hxxp://120[.]79[.]167[.]191:443/api/v1/server/user/info hxxps://89[.]147[.]108[.]109/ga[.]js hxxp://116[.]211[.]148[.]181:8045/push hxxp://5[.]182[.]38[.]176/pixel hxxps://39[.]106[.]76[.]185/ca hxxp://124[.]71[.]202[.]107:9999/fwlink hxxps://118[.]195[.]145[.]185/push hxxp://43[.]143[.]221[.]53/j[.]ad hxxp://162[.]14[.]100[.]23:8088/cm hxxp://81[.]68[.]241[.]8:7942/cx hxxp://124[.]221[.]183[.]95:8888/cm hxxp://111[.]230[.]42[.]149:8080/visit[.]js hxxp://182[.]92[.]131[.]14/activity hxxp://154[.]23[.]248[.]180:4444/ptj hxxps://116[.]204[.]77[.]75/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://124[.]221[.]183[.]95:9966/pixel[.]gif hxxps://ss[.]rlfslie[.]cloud:8443/j[.]ad hxxp://117[.]50[.]176[.]248/pixel[.]gif hxxps://103[.]173[.]154[.]214:5678/updates hxxp://47[.]92[.]100[.]70:8888/push hxxp://resource[.]sekretariatparti[.]org:8443/__utm[.]gif hxxp://62[.]234[.]185[.]105/image/ hxxps://149[.]28[.]146[.]218/ca hxxps://101[.]200[.]134[.]239/Def/v1[.]49/ZY1G5WNLV1 hxxp://198[.]13[.]34[.]82/__utm[.]gif hxxp://124[.]221[.]177[.]165:8080/jquery-3[.]3[.]1[.]min[.]js hxxps://124[.]221[.]177[.]165/jquery-3[.]3[.]1[.]min[.]js hxxp://45[.]92[.]158[.]220/us/ky/louisville/312-s-fourth-st[.]html hxxp://142[.]93[.]130[.]115:8443/j[.]ad hxxps://www[.]darkerstan[.]top/cx hxxp://119[.]13[.]90[.]176:9000/ga[.]js hxxp://47[.]120[.]2[.]120/cx hxxp://42[.]193[.]23[.]91/dot[.]gif hxxps://154[.]221[.]17[.]44:2080/ca hxxp://123[.]57[.]174[.]182:8888/cx hxxp://47[.]109[.]105[.]56/__utm[.]gif hxxp://59[.]110[.]215[.]128/j[.]ad hxxp://198[.]98[.]52[.]184:20001/pixel hxxp://47[.]108[.]218[.]63:81/dpixel hxxp://47[.]109[.]97[.]92:5555/cx hxxp://72[.]44[.]68[.]94:10002/ptj hxxp://121[.]196[.]210[.]161/IE9CompatViewList[.]xml hxxp://72[.]44[.]68[.]94:10001/dot[.]gif hxxp://39[.]104[.]57[.]62:9097/ga[.]js hxxp://43[.]142[.]150[.]154/visit[.]js hxxp://47[.]92[.]100[.]70:8088/visit[.]js hxxp://124[.]221[.]183[.]95:5005/dot[.]gif hxxp://4[.]194[.]41[.]34/activity hxxp://8[.]130[.]45[.]91:44444/updates[.]rss hxxp://123[.]56[.]182[.]36/dpixel hxxp://50[.]93[.]205[.]252/j[.]ad hxxp://81[.]68[.]252[.]42:6666/dpixel hxxp://81[.]70[.]190[.]25/dot[.]gif hxxp://198[.]211[.]98[.]185:8088/c/msdownload/update/others/2016/12/29136388_ hxxp://156[.]224[.]26[.]227/ga[.]js hxxp://162[.]212[.]158[.]164/__utm[.]gif hxxp://143[.]110[.]147[.]192/api2/json/access/ticket hxxps://91[.]206[.]178[.]165/fwlink hxxp://81[.]68[.]121[.]240/j[.]ad hxxps://api[.]0nedriveup[.]com/push hxxps://111[.]230[.]74[.]60:4433/dot[.]gif hxxp://150[.]158[.]13[.]117:9999/updates[.]rss hxxp://47[.]242[.]78[.]26/__utm[.]gif hxxp://185[.]166[.]163[.]115/g[.]pixel hxxp://82[.]156[.]157[.]156:7002/updates[.]rss hxxp://89[.]19[.]214[.]166/ga[.]js hxxps://116[.]204[.]77[.]75/en_US/all[.]js hxxp://216[.]146[.]25[.]53/changes/TWl3f2wDOLzsopklW5dDAnZe9XKFIFQ hxxp://119[.]3[.]250[.]165:443/HWqM hxxp://42[.]51[.]40[.]232:8899/push hxxp://124[.]220[.]210[.]41:8081/dot[.]gif hxxp://8[.]140[.]135[.]23:8012/cm hxxps://47[.]242[.]78[.]26/load hxxps://101[.]37[.]255[.]14:8080/cx hxxps://lumswestnewyork[.]com/design/query/9X5M3SOE0F hxxp://82[.]156[.]188[.]211:9443/api/x hxxp://216[.]146[.]25[.]53:81/xx1[.]exe hxxp://216[.]146[.]25[.]53:81/cl2[.]exe hxxps://170[.]130[.]165[.]100/jquery-3[.]3[.]1[.]min[.]js hxxp://175[.]178[.]174[.]131:7878/IE9CompatViewList[.]xml hxxp://45[.]137[.]10[.]228:10816/www/handle/doc hxxp://45[.]125[.]45[.]162/visit[.]js hxxp://170[.]130[.]165[.]100/jquery-3[.]3[.]1[.]min[.]js hxxp://23[.]94[.]194[.]163:45783/ca hxxps://43[.]142[.]60[.]207:6668/activity hxxp://79[.]124[.]40[.]70/match hxxp://85[.]175[.]101[.]203/pixel[.]gif hxxp://1[.]117[.]115[.]142/en_US/all[.]js hxxp://82[.]156[.]28[.]224:8088/visit[.]js hxxp://119[.]13[.]90[.]176:9000/ptj hxxps://14[.]215[.]11[.]154/reactivate/encryption/LKPFSFMBP hxxps://58[.]217[.]206[.]245/reactivate/encryption/LKPFSFMBP hxxps://117[.]34[.]18[.]102/reactivate/encryption/LKPFSFMBP hxxps://122[.]246[.]12[.]168/reactivate/encryption/LKPFSFMBP hxxps://106[.]53[.]67[.]175/ca hxxp://43[.]138[.]251[.]32:4567/load hxxps://114[.]115[.]212[.]24/pixel hxxps://117[.]25[.]130[.]94/cx hxxp://14[.]29[.]170[.]11:8899/cm hxxps://39[.]105[.]19[.]199/ca hxxp://120[.]46[.]210[.]49:88/ga[.]js hxxp://118[.]195[.]179[.]203/g[.]pixel hxxp://120[.]46[.]164[.]123:9999/en_US/all[.]js hxxp://140[.]143[.]139[.]139:8090/pixel hxxp://158[.]247[.]247[.]98:4451/updates[.]rss hxxp://8[.]134[.]99[.]117:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://47[.]242[.]0[.]207:8080/dpixel hxxp://47[.]242[.]0[.]207:9999/cx hxxp://162[.]14[.]77[.]157/page[.]jsp hxxps://8[.]140[.]37[.]238:9999/IE9CompatViewList[.]xml hxxps://1[.]117[.]115[.]142/pixel hxxps://162[.]14[.]77[.]157/process[.]jsp hxxp://154[.]221[.]17[.]44:2090/j[.]ad hxxp://47[.]120[.]2[.]172/match hxxp://124[.]223[.]96[.]251/match hxxps://104[.]238[.]35[.]74/calculate/v3[.]3/9AIEC05QK8H8 hxxp://45[.]91[.]81[.]100:9991/fwlink hxxps://123[.]57[.]174[.]182:4444/ga[.]js hxxps://bks[.]loginke[.]xyz:8443/js/main[.]js hxxps://106[.]52[.]42[.]139/j[.]ad hxxps://ns1[.]gcloud-api[.]com:8443/ga[.]js hxxp://120[.]78[.]91[.]212:1234/IE9CompatViewList[.]xml hxxp://8[.]140[.]50[.]236:8080/ca hxxp://110[.]42[.]234[.]190:100/pixel[.]gif hxxp://120[.]27[.]210[.]80/ca hxxps://118[.]24[.]2[.]129/image/ hxxp://117[.]62[.]217[.]78:8999/ptj hxxp://47[.]93[.]242[.]212/ca hxxp://140[.]143[.]232[.]178/jquery-3[.]3[.]2[.]min_7834a10[.]js hxxp://124[.]220[.]28[.]253:8080/dpixel hxxp://124[.]221[.]183[.]95:5555/pixel[.]gif hxxp://171[.]22[.]128[.]34:8888/activity hxxp://163[.]197[.]212[.]47/ga[.]js hxxps://110[.]42[.]234[.]190:8090/dpixel hxxp://157[.]245[.]201[.]255/image/ hxxps://47[.]97[.]159[.]241:8443/en_US/all[.]js hxxp://165[.]154[.]130[.]222:1234/push hxxp://162[.]14[.]77[.]157/parse[.]jsp hxxp://185[.]132[.]125[.]142:8080/updates[.]rss hxxp://8[.]140[.]135[.]23:8011/push hxxps://107[.]172[.]206[.]242:444/pixel[.]gif hxxps://165[.]154[.]130[.]222:4444/ga[.]js |
Cobalt Strike |
| URL | hxxps://propagandaetrafego[.]com/julhovenom[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/SP/Q2s[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/T3[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/Q7[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/Q1[.]txt |
Quasar RAT |
| URL | hxxp://91[.]103[.]252[.]17:8912/sqlite3[.]dll hxxp://91[.]103[.]252[.]17:8912/nss3[.]dll hxxp://91[.]103[.]252[.]17:8912/softokn3[.]dll hxxp://91[.]103[.]252[.]17:8912/libcrypto[.]dll hxxp://91[.]103[.]252[.]17:8912/mozglue[.]dll hxxp://91[.]103[.]252[.]17:8912/freebl3[.]dll |
ObserverStealer |
| URL | hxxp://tthre3pt[.]top/zip[.]php hxxp://tfive5ht[.]top/zip[.]php hxxp://tythre3vs[.]top/zip[.]php |
CryptBot |
| URL | hxxp://185[.]17[.]0[.]167/assailant[.]ppc hxxp://185[.]17[.]0[.]167/assailant[.]i686 hxxp://185[.]17[.]0[.]167/assailant[.]sh4 hxxp://185[.]17[.]0[.]167/assailant[.]sparc hxxp://185[.]17[.]0[.]167/assailant[.]mpsl hxxp://185[.]17[.]0[.]167/assailant[.]x86 hxxp://185[.]17[.]0[.]167/assailant[.]arm5 hxxp://185[.]17[.]0[.]167/assailant[.]m68k hxxp://185[.]17[.]0[.]167/assailant[.]arm4 hxxp://185[.]17[.]0[.]167/assailant[.]arm7 hxxp://185[.]17[.]0[.]167/assailant[.]arm6 hxxp://185[.]17[.]0[.]167/assailant[.]mips hxxp://185[.]17[.]0[.]167/assailant[.]i586 hxxp://172[.]105[.]94[.]82/x86 hxxp://172[.]105[.]94[.]82/armv6l hxxp://172[.]105[.]94[.]82/sparc hxxp://172[.]105[.]94[.]82/armv5l hxxp://172[.]105[.]94[.]82/mipsel hxxp://172[.]105[.]94[.]82/mips hxxp://172[.]105[.]94[.]82/powerpc hxxp://172[.]105[.]94[.]82/armv4l hxxp://172[.]105[.]94[.]82/i586 hxxp://172[.]105[.]94[.]82/sh4 hxxp://172[.]105[.]94[.]82/i686 hxxp://5[.]181[.]80[.]141/snype[.]arm5 hxxp://5[.]181[.]80[.]141/snype[.]mpsl hxxp://5[.]181[.]80[.]141/snype[.]mips hxxp://5[.]181[.]80[.]141/snype[.]sparc hxxp://5[.]181[.]80[.]141/snype[.]arm6 hxxp://5[.]181[.]80[.]141/snype[.]ppc hxxp://198[.]98[.]60[.]57/d/arm7 |
Bashlite |
| URL | hxxp://92[.]63[.]189[.]63/vm/cpuprocessDatalifepublic[.]php hxxp://45[.]91[.]8[.]171/4/5/06tempgame/4processor/2DleGenerator/test/ProcessorProtect/CpuTemporary3/ApiPoll2Cdn/serverLinuxasync/windows4/WordpressProcess0/cdn/7/8/Multihxxp/1/4External/Geo7cpu/videoPython[.]php hxxp://89[.]23[.]97[.]153/16Track3/VideoapiTestPublic[.]php hxxp://45[.]8[.]230[.]157/WpAsyncbase/ProviderAsync0datalife/ProtectVideoJsBigload/External8LinuxPipe/7WpPython/Processor3Temporary/Sql0/Db/Temporary/geotrack[.]php hxxp://185[.]146[.]157[.]98/ProviderPythonupdate[.]php hxxp://80[.]90[.]185[.]107/videolowgameDatalife[.]php hxxp://188[.]120[.]236[.]114/externalflower2/local4Imagegame/Dump3Javascripttest/js8/Downloadsvmgenerator/flowerLowUploads7/2Sql/UniversalProcessor/TestCentral[.]php hxxp://92[.]255[.]107[.]38/ProtectEternalJsmulti/MultiSecureproton/multi1Temporary/voiddb/5game/External/Vm1/linuxMariadbtraffic/GamevmProcessorProvider/Python/6Voiddb/Downloadsbaseexternal/MariadbGeo/5Universal8/cpucentralexternal/phpgame[.]php hxxp://5[.]42[.]65[.]49/Gameapi_/Process_eternaljs/3Central/Universal/PacketWp/Datalifebase1async/Js/PythonserverPacketSql/updatebasecentral[.]php |
DCRat |
| URL | hxxp://185[.]252[.]179[.]228/lend/norway_cr[.]exe hxxp://185[.]252[.]179[.]228/lend/rcoekta[.]exe hxxp://185[.]252[.]179[.]228/file/lega[.]exe hxxp://77[.]91[.]68[.]16/smo/du[.]exe hxxp://77[.]91[.]124[.]31/smo/du[.]exe |
RedLine Stealer |
| URL | hxxp://carambasti[.]info/v2/doward[.]exe hxxp://ambasoft[.]info/app/files/dc/id27315001/compan[.]exe |
Arkei Stealer |
| URL | hxxp://77[.]105[.]147[.]158:5001/upload/ | XMRig |
| URL | hxxp://185[.]66[.]88[.]192/savvd[.]exe hxxp://185[.]66[.]88[.]192/spamshelldd44[.]exe hxxp://91[.]213[.]50[.]74/new/mofers/Rmz[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/R[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/Rm[.]txt hxxp://141[.]95[.]16[.]111:8080/recover[.]bat hxxp://141[.]95[.]16[.]111:8080/RiotGames[.]exe hxxp://141[.]95[.]16[.]111:8080/newpy[.]exe hxxp://212[.]192[.]219[.]52/ntwSMNfFx216[.]bin |
Remcos |
| URL | hxxps://virvatulishop[.]com/labda[.]zip hxxps://ecotree[.]co[.]in/images/files/cora[.]zip hxxps://ecotree[.]co[.]in/images/cora[.]zip hxxps://turvavalaisin[.]fi/loco[.]zip hxxps://turvavalaisin[.]fi/files/ hxxps://virvatulishop[.]eu/costa[.]zip hxxps://virvatulishop[.]eu/files/ hxxps://virvatulishop[.]com/files/ |
NetSupportManager RAT |
| URL | hxxp://179[.]43[.]155[.]195/Logic[.]exe | RecordBreaker |
| URL | hxxp://79[.]137[.]205[.]112/s[.]exe | SmokeLoader |
| URL | hxxp://ss[.]tanye[.]online/WHBTestDll[.]exe | Ghost RAT |
| URL | hxxp://cryptersandtools[.]minhacasa[.]tv/e/js | zgRAT |
| URL | hxxp://46[.]183[.]221[.]76/rothschild/Panel/index[.]php hxxp://46[.]183[.]221[.]106/work/6326381[.]txt hxxp://46[.]183[.]221[.]106/work/9203819[.]txt hxxp://46[.]183[.]221[.]106/work/09362837[.]txt hxxp://46[.]183[.]221[.]106/work/73028308[.]txt |
Azorult |
| URL | hxxp://www[.]mrjaques[.]fr/TXT/NJRAT[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/njz[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/ny1[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/SP/MC/BANDI99[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/Nx[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/ZX2[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/njx[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/SP/nxj[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/NJ[.]txt hxxp://542199235l[.]com/Mr/1963[.]txt |
NjRAT |
| URL | hxxp://91[.]213[.]50[.]74/new/mofers/Lx6[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/L8[.]txt |
Gozi |
| URL | hxxp://91[.]213[.]50[.]74/new/mofers/Arrw[.]txt hxxp://91[.]213[.]50[.]74/new/mofers/Async[.]txt |
AsyncRAT |
| URL | hxxp://91[.]213[.]50[.]74/new/mofers/Arhvn[.]txt | ArrowRAT |
| URL | hxxp://www[.]mrjaques[.]fr/TXT/xworm[.]txt hxxp://45[.]61[.]129[.]99:8080/XWorm_DNS[.]exe |
XWorm |
| URL | hxxp://45[.]61[.]129[.]99:8080/888_IP[.]exe | Loda |
| URL | hxxp://203[.]115[.]85[.]249:41102/Mozi[.]m hxxp://27[.]40[.]117[.]9:53548/Mozi[.]m hxxp://175[.]107[.]0[.]182:39097/Mozi[.]m |
Mozi |
| URL | hxxps://zzz[.]fhauiehgha[.]com/m/okka25[.]exe | Fabookie |
| URL | hxxps://klusolutoins[.]com/nanocore/H1eZ2N4PyqjrcK0[.]exe | Nanocore RAT |
