不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/08/28
※2023/08/28 更新
マルウェア感染させると考えられるURLを検知（2023/08/28）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://193[.]233[.]255[.]9/lend/finally[.]exe hxxp://194[.]169[.]175[.]232/autorun[.]exe hxxp://193[.]233[.]255[.]9/lend/fasfqwrqweqw[.]exe hxxps://oshi[.]at/ECri hxxp://95[.]214[.]24[.]244/Z2KNEW/Rrobknnz-Z2K[.]exe hxxp://77[.]91[.]68[.]1/new/fotod400[.]exe hxxp://77[.]91[.]68[.]1/new/foto4066[.]exe |
RedLine Stealer |
| URL | hxxp://193[.]233[.]255[.]9/lend/a15pupoq0[.]exe hxxp://feedeposit[.]uob[.]edu[.]pk/6a8ifVD8qEneo[.]exe hxxp://163[.]123[.]143[.]201/_errorpages/isbinzx[.]exe hxxp://163[.]123[.]143[.]201/_errorpages/nellyzx[.]exe |
Agent Tesla |
| URL | hxxp://84[.]54[.]50[.]31/ari/2[.]exe hxxp://84[.]54[.]50[.]31/Ari/NMK9938[.]exe hxxp://185[.]216[.]71[.]134/xpp[.]txt hxxp://163[.]123[.]143[.]201/_errorpages/ghostzx[.]exe |
Formbook |
| URL | hxxps://remot-crim[.]fun/criminal/contact[.]php?result=ok&action=upload&androidid= hxxps://remot-crim[.]fun/criminal/requests[.]php hxxps://sena-ebla-gh[.]org/ir/ap[.]php hxxps://remot-crim[.]fun/criminal/sms[.]php?result=ok&actio hxxps://remot-crim[.]fun/criminal/sms[.]php hxxps://remot-crim[.]fun/criminal hxxps://remot-crim[.]fun/criminal/id[.]txt hxxps://remot-crim[.]fun/Remoti/requests[.]php hxxps://remot-crim[.]fun/Remoti/sms[.]php hxxps://remot-crim[.]fun/Remoti hxxps://remot-crim[.]fun/Remoti/contact[.]php |
IRATA |
| URL | hxxp://388404cm[.]nyashkoon[.]top/nyashsupport[.]php hxxp://94[.]156[.]102[.]214/eternalPollMulti[.]php hxxp://898757cm[.]nyashkoon[.]top/nyashsupport[.]php hxxp://775515cm[.]n9shteam1[.]top/nyashsupport[.]php hxxp://221968cm[.]nyashkoon[.]top/nyashsupport[.]php hxxp://533261cm[.]n9shteam1[.]top/nyashsupport[.]php hxxp://193[.]37[.]71[.]142/ProviderExternal_longpollUploads[.]php hxxp://071900cm[.]n9shteam1[.]top/nyashsupport[.]php hxxp://149[.]154[.]71[.]81/PythonCpuhtopmessage/Django/searcherCam/AutobootMath/gamescript/ruledataanti/binbin/ServerflowerAsynctrack[.]php hxxp://82[.]146[.]60[.]137/WarMath/generatorPrefWar/htopgeneratorsupportCam/eternaldb[.]php hxxp://185[.]104[.]113[.]225/8Traffic/mariadb1/Wordpress/5hxxpeternal/api0/js/flower/External/Python87/wppoll8/To/pythonmultiCentral[.]php hxxp://217[.]144[.]103[.]11/8datalife/1/_ServerProtectApi/42/PythonApiBigload/Eternal7Generator/tempPublicWordpressJs/mariadb6privatePoll/27processor/Requestjavascript/updateauthlongpollgeneratorlocal[.]php |
DCRat |
| URL | hxxp://118[.]89[.]133[.]137:12306/en_US/all[.]js hxxp://162[.]14[.]109[.]90:8448/pixel hxxps://192[.]241[.]131[.]103/___utm[.]gif hxxp://124[.]220[.]205[.]253/push hxxps://109[.]205[.]56[.]206/ga[.]js hxxps://124[.]220[.]205[.]253/activity hxxps://103[.]239[.]245[.]14:8443/match hxxps://141[.]98[.]234[.]17:8443/image/ hxxps://103[.]133[.]176[.]247/image/ hxxp://20[.]83[.]148[.]22:5000/loadercrypt_823EF8A810513A4071485C36DDAD4CC3[.]php hxxps://cs[.]fighter-team[.]xyz/updates hxxp://43[.]134[.]228[.]170/__utm[.]gif hxxp://8[.]130[.]18[.]218/load hxxps://176[.]113[.]115[.]145/pixel[.]gif hxxp://googlecloudsvcs[.]com/cx hxxp://139[.]59[.]139[.]136:8888/cx hxxps://newstatisc[.]googleinfo[.]se:2053/IE9CompatViewList[.]xml hxxps://107[.]174[.]95[.]78/load hxxp://213[.]142[.]159[.]117/match hxxps://82[.]156[.]125[.]53:6443/api/x hxxp://82[.]156[.]125[.]53:8889/api/x hxxp://107[.]172[.]201[.]137/push hxxps://googlecloudsvcs[.]com/g[.]pixel hxxp://107[.]174[.]95[.]78:9999/visit[.]js hxxps://bks[.]loginke[.]com:8443/js/main[.]js hxxps://47[.]120[.]11[.]176/updates[.]rss hxxps://3[.]108[.]202[.]101/__utm[.]gif hxxp://112[.]124[.]14[.]64/dpixel hxxp://121[.]5[.]147[.]57:30132/load hxxp://147[.]78[.]47[.]135/_/scs/mail-static/_/js/ hxxps://qlvbsnv[.]binhphuoc[.]unixkernelhelp[.]com/pixel hxxp://208[.]70[.]76[.]100:3443/cx hxxp://208[.]70[.]76[.]100:3443/sJUK hxxps://104[.]248[.]242[.]202:8080/push hxxp://101[.]43[.]117[.]80/jquery-3[.]3[.]1[.]min[.]js hxxps://47[.]120[.]11[.]176/visit[.]js hxxps://95[.]169[.]25[.]166/r_config[.]html hxxps://106[.]14[.]141[.]187:8443/g[.]pixel hxxps://173[.]242[.]121[.]173:8443/ptj hxxps://43[.]142[.]60[.]207:6668/en_US/all[.]js hxxp://101[.]35[.]235[.]73:8888/j[.]ad hxxp://aspmx5[.]clsr[.]ca/fwlink hxxp://103[.]30[.]43[.]148:4500/pixel hxxps://aspmx5[.]clsr[.]ca/ga[.]js hxxp://137[.]184[.]137[.]107/push hxxp://154[.]221[.]17[.]44:2090/updates[.]rss hxxp://107[.]174[.]95[.]78/g[.]pixel hxxp://106[.]12[.]129[.]225:81/IE9CompatViewList[.]xml hxxp://123[.]56[.]128[.]182/ca hxxp://aw0[.]awsstatic[.]om/j[.]ad hxxp://89[.]44[.]9[.]133/design/query/9X5M3SOE0F hxxps://107[.]189[.]12[.]159/IE9CompatViewList[.]xml hxxps://47[.]120[.]11[.]176/cm hxxp://85[.]175[.]101[.]203/dot[.]gif hxxps://18[.]162[.]116[.]128/c/msdownload/update/others/2023/07/29136388_ hxxps://223[.]26[.]57[.]26/en_US/all[.]js hxxps://20[.]249[.]211[.]187/IE9CompatViewList[.]xml hxxps://38[.]147[.]173[.]210/dot[.]gif hxxps://111[.]230[.]71[.]116/dpixel hxxps://43[.]136[.]96[.]116/load hxxp://43[.]139[.]235[.]226:8089/visit[.]js hxxp://106[.]55[.]181[.]108/j[.]ad hxxps://194[.]156[.]98[.]197/cx hxxps://170[.]178[.]201[.]156/cx hxxps://47[.]120[.]11[.]176/activity hxxp://101[.]200[.]190[.]119:9111/updates[.]rss hxxps://23[.]29[.]115[.]179/j[.]ad |
Cobalt Strike |
| URL | hxxp://45[.]9[.]74[.]80/super[.]exe hxxp://vrecepte[.]com[.]ua/Blazerstreetavenu[.]exe |
Amadey |
| URL | hxxp://118[.]89[.]133[.]137:12306/Kth5 hxxp://121[.]5[.]147[.]57:30132/o6qF |
Metasploit |
| URL | hxxps://thecreativelion[.]com/wp-content/uploads/2021/12/cold-dwnld-restartneeded(info)[.]url hxxp://94[.]156[.]253[.]211/Downloads/run-dwnl-restart[.]lnk hxxps://thecreativelion[.]com/wp-content/uploads/2021/11/xczxcxzcxzcxzcxzc23[.]hta hxxps://all-access-media[.]com/media/templates/SunnyFa[.]zip hxxps://all-access-media[.]com/media/templates/client32[.]exe |
NetSupportManager RAT |
| URL | hxxp://193[.]233[.]255[.]9/lend/installs[.]exe hxxp://193[.]233[.]255[.]9/lend/LummaC[.]exe hxxp://fullppc[.]xyz/c2conf hxxp://gapi-node[.]io/c2conf hxxp://sieratools[.]xyz/c2conf hxxp://boxhappines[.]xyz/c2conf |
Lumma Stealer |
| URL | hxxp://2[.]59[.]254[.]225/loki[.]mpsl hxxp://2[.]59[.]254[.]225/loki[.]sh4 hxxp://2[.]59[.]254[.]14/bins/skid[.]sh4 hxxp://45[.]13[.]119[.]116/pXdN91[.]x68 hxxp://45[.]13[.]119[.]116/pXdN91[.]armv4l hxxp://45[.]13[.]119[.]116/pXdN91[.]mips hxxp://45[.]13[.]119[.]116/pXdN91[.]armv7l hxxp://45[.]13[.]119[.]116/pXdN91[.]i686 hxxp://45[.]13[.]119[.]116/pXdN91[.]sparc hxxp://45[.]13[.]119[.]116/pXdN91[.]armv5l hxxp://45[.]13[.]119[.]116/pXdN91[.]sh4 hxxp://45[.]13[.]119[.]116/pXdN91[.]mipsel hxxp://45[.]13[.]119[.]116/pXdN91[.]i586 hxxp://45[.]13[.]119[.]116/pXdN91[.]m68k hxxp://37[.]44[.]238[.]213/bins/neko[.]arm5 |
Bashlite |
| URL | hxxp://colisumy[.]com/dl/buildp[.]exe | STOP |
| URL | hxxp://103[.]143[.]29[.]28:3325/m1[.]txt | Nitol |
| URL | hxxp://80[.]92[.]206[.]215/628ddfb216f373ea[.]php hxxps://www[.]arrawdha[.]com/PunisherDefault[.]exe hxxp://91[.]103[.]252[.]212/1afb7d7c2e47bc96[.]php hxxp://91[.]103[.]252[.]212/546d4bd95ad60cb8/nss3[.]dll hxxp://91[.]103[.]252[.]212/546d4bd95ad60cb8/mozglue[.]dll hxxp://91[.]103[.]252[.]212/546d4bd95ad60cb8/vcruntime140[.]dll hxxp://91[.]103[.]252[.]212/546d4bd95ad60cb8/msvcp140[.]dll hxxp://91[.]103[.]252[.]212/546d4bd95ad60cb8/softokn3[.]dll hxxp://91[.]103[.]252[.]212/546d4bd95ad60cb8/freebl3[.]dll hxxp://91[.]103[.]252[.]212/546d4bd95ad60cb8/sqlite3[.]dll hxxp://80[.]92[.]206[.]215/9954bf7d8d4b2b9d/msvcp140[.]dll hxxp://80[.]92[.]206[.]215/9954bf7d8d4b2b9d/nss3[.]dll hxxp://80[.]92[.]206[.]215/9954bf7d8d4b2b9d/vcruntime140[.]dll hxxp://80[.]92[.]206[.]215/9954bf7d8d4b2b9d/freebl3[.]dll hxxp://80[.]92[.]206[.]215/9954bf7d8d4b2b9d/mozglue[.]dll hxxp://80[.]92[.]206[.]215/9954bf7d8d4b2b9d/softokn3[.]dll hxxp://80[.]92[.]206[.]215/9954bf7d8d4b2b9d/sqlite3[.]dll |
Stealc |
| URL | hxxps://betola[.]de/news[.]php hxxps://www[.]vrouwenversierentips[.]net/faq[.]php hxxps://1life1loveflower[.]com/download[.]php hxxps://1fc-muelheim[.]de/download[.]php hxxps://apparences-magazine[.]be/content[.]php hxxps://aemgroup[.]net[.]au/download[.]php hxxps://www[.]waffen-seilz[.]de/faq[.]php hxxps://www[.]zhongguotese[.]net/faq[.]php hxxps://dolphins[.]needeepindesign[.]com[.]au/download[.]php hxxps://aderbuild[.]com[.]au/download[.]php hxxps://agent[.]seektobe[.]com[.]au/download[.]php hxxps://drumties[.]com/download[.]php hxxps://www[.]southernstylebowfishing[.]com/content[.]php hxxps://www[.]xn--ddkl-0rabc[.]com/faq[.]php hxxps://bfa[.]csrcpall[.]com/news[.]php hxxps://www[.]seitz-tegtmeyer[.]de/content[.]php hxxps://amatosport[.]pl/content[.]php hxxps://erdalcengiz[.]com/go[.]php hxxps://blog[.]atelierceline[.]fr/news[.]php hxxps://advokatpersonskaderett[.]no/download[.]php hxxps://bociankris[.]mazowsze[.]pl/news[.]php hxxps://bildwein[.]pieroth[.]de/news[.]php hxxps://www[.]wtcomms[.]co[.]uk/faq[.]php hxxps://bna[.]tframe[.]de/news[.]php hxxps://www[.]werbefirma[.]hamburg/faq[.]php hxxps://www[.]tavernelentrepot[.]be/faq[.]php hxxps://www[.]worpswede-blog[.]de/faq[.]php hxxps://bosqueurbanoapp[.]nowalia[.]com/news[.]php hxxps://www[.]shisharealty[.]com/content[.]php hxxps://www[.]thekyhomeinspector[.]org/faq[.]php hxxps://www[.]srilankareisenprivat[.]de/content[.]php hxxps://1c-kursy[.]online/download[.]php hxxps://www[.]webdesignbrabant[.]net/faq[.]php hxxps://drewhuddleston[.]com/download[.]php hxxps://architectuur[.]webdesignbrabant[.]net/content[.]php hxxps://estarque[.]com[.]br/download[.]php hxxps://www[.]tillit-hjarta[.]se/faq[.]php hxxps://acquisit[.]io/download[.]php hxxps://duinbehoud[.]nl/download[.]php hxxps://e-ability[.]nl/download[.]php hxxps://ertbike[.]com/download[.]php hxxps://ganthor[.]se/go[.]php hxxps://alexeasytechnology[.]co[.]za/download[.]php hxxps://duebendorfer-abendmusiken[.]ch/download[.]php hxxps://escritosamano[.]com/download[.]php hxxps://aaa-studios[.]de/download[.]php hxxps://www[.]vojens-trailerudlejning[.]dk/faq[.]php hxxps://alaynabowman[.]com/content[.]php hxxps://dpiadmin[.]dpipreview[.]nl/download[.]php hxxps://elektrykstaszow[.]pl/download[.]php hxxps://easiestbatteryrepair[.]com/download[.]php hxxps://encompassproperties[.]com/download[.]php hxxps://www[.]vasktextil[.]com/faq[.]php hxxps://www[.]zen-altitude[.]fr/faq[.]php hxxps://boston-creditrepair[.]net/news[.]php hxxps://anclegalbusiness[.]com/content[.]php hxxps://blakwaveproductions[.]com/news[.]php hxxps://blog[.]denelan[.]com/news[.]php hxxps://abysswalkers[.]es/download[.]php hxxps://www[.]smartcontracts[.]nl/content[.]php hxxps://www[.]serphero[.]com/content[.]php hxxps://4uherbals[.]com/download[.]php hxxps://alumbramento[.]com[.]br/download[.]php hxxps://aidemy[.]net/download[.]php hxxps://www[.]wild-confetti[.]com/faq[.]php hxxps://www[.]sicilyin[.]com/content[.]php hxxps://blog[.]progamma[.]com/news[.]php hxxps://ar-d[.]jp/content[.]php hxxps://adila[.]sabluxgroup[.]com/download[.]php hxxps://www[.]secora[.]cl/content[.]php hxxps://bigbobspizza[.]com/news[.]php hxxps://alteronreit[.]com/download[.]php hxxps://barwyszkla[.]pl/content[.]php hxxps://adolphi-stiftung[.]de/download[.]php hxxps://dwe[.]amaseon[.]com/download[.]php hxxps://www[.]vrouwenversierentips[.]org/faq[.]php hxxps://blog[.]cerebelum[.]net/news[.]php hxxps://www[.]whitepanama-films[.]com/faq[.]php hxxps://alpharealestate[.]amaseon[.]com/download[.]php hxxps://annett[.]ca/content[.]php hxxps://aadesignstudio[.]it/download[.]php hxxps://bfasa[.]co[.]za/news[.]php hxxps://www[.]wyndemeredesigns[.]jonfarrell[.]io/faq[.]php hxxps://beta[.]voxpublica[.]no/news[.]php hxxps://artisanvinegar[.]co[.]uk/content[.]php hxxps://antbee-corp[.]demodemo[.]link/content[.]php hxxps://www[.]setman[.]es/content[.]php hxxps://blog[.]annelie-voyage[.]com/news[.]php hxxps://www[.]sicherheitsingenieure-huber[.]de/content[.]php hxxps://ahp-microsite[.]knockmedia[.]dev/download[.]php hxxps://dozecomunicacao[.]com[.]br/download[.]php hxxps://www[.]studio-lapinternet[.]fr/content[.]php hxxps://al-hazam[.]com/download[.]php hxxps://www[.]verlaghausundmarkt[.]de/faq[.]php hxxps://ets2[.]gr/download[.]php hxxps://alethium[.]com/download[.]php hxxps://8659design[.]se/download[.]php hxxps://www[.]szipe[.]org/faq[.]php hxxps://blog[.]wo365[.]com/news[.]php hxxps://www[.]valentinhenning[.]de/faq[.]php hxxps://erikenlevi[.]nl/download[.]php hxxps://biosage-saudrune[.]fr/news[.]php hxxps://www[.]vacanzenelmediterraneo[.]com/faq[.]php hxxps://energiemc2[.]com/download[.]php hxxps://birbeslenme[.]com/news[.]php hxxps://espacoememoria[.]org/download[.]php hxxps://www[.]satoyamasafu[.]com/content[.]php hxxps://acuicultura[.]ihcantabria[.]com/download[.]php hxxps://amthanhthongbao[.]com/content[.]php hxxps://embroiderybadge[.]rfstaging[.]co[.]uk/download[.]php hxxps://formacion[.]energy-minus[.]es/go[.]php hxxps://emailbuilder[.]a6uat[.]co[.]uk/download[.]php hxxps://bevdev[.]freshcreative[.]com[.]au/news[.]php hxxps://www[.]thediarytours[.]com/faq[.]php hxxps://elmartecnologia[.]com[.]br/download[.]php hxxps://armin[.]mls-test[.]ch/content[.]php hxxps://www[.]wonderfulegypttours[.]com/faq[.]php hxxps://xaderbuild[.]com[.]au/download[.]php hxxps://artidesign[.]studio/content[.]php hxxps://foblesproject[.]pl/go[.]php hxxps://bestervergleich24[.]de/news[.]php hxxps://drift[.]rayna-web[.]fr/download[.]php hxxps://bluefrontmagnetics[.]com/news[.]php hxxps://www[.]twoviewsmovies[.]com/faq[.]php hxxps://admisiones[.]ipac[.]edu[.]ec/download[.]php hxxps://atelierceline[.]fr/content[.]php hxxps://freeintalk[.]co/go[.]php hxxps://fondazione[.]studioata[.]com/go[.]php hxxps://accessi[.]altaroma[.]it/download[.]php hxxps://abe[.]bethmcmillian[.]com/download[.]php hxxps://www[.]wiccinigeria[.]org/faq[.]php hxxps://www[.]villa-rosenrausch[.]de/faq[.]php hxxps://www[.]yvesrobert-decoration[.]com/faq[.]php hxxps://existeraboutdeplume[.]fr/go[.]php hxxps://blog[.]france-langue[.]fr/news[.]php hxxps://almazova[.]space/download[.]php hxxps://boatgoldcoast[.]com[.]au/news[.]php hxxps://apc-projects[.]eu/content[.]php hxxps://asairsensors[.]com/content[.]php hxxps://alma[.]glogow[.]pl/download[.]php hxxps://blog[.]sakaiya1901[.]com/news[.]php hxxps://www[.]smartnatation[.]com/content[.]php hxxps://blog[.]bigbird[.]biz/news[.]php hxxps://akkeshimori[.]net/download[.]php hxxps://9livespress[.]com/download[.]php hxxps://abckashikaigishitu[.]com/download[.]php hxxps://www[.]werbetechnik-hamburg[.]de/faq[.]php hxxps://blog[.]boutiquebio[.]fr/news[.]php hxxps://www[.]zeldamag[.]com/faq[.]php hxxps://www[.]wortzunder[.]de/faq[.]php hxxps://www[.]shift-m[.]com/content[.]php hxxps://dynamico[.]com[.]au/download[.]php hxxps://bestsellermastery[.]co[.]il/news[.]php hxxps://www[.]vecctor[.]lazyls[.]com/faq[.]php hxxps://ag-kw[.]de/download[.]php hxxps://archiv[.]nexthamburg[.]de/content[.]php hxxps://allsign[.]nl/download[.]php hxxps://drachtstercompagnie[.]frl/download[.]php hxxps://erziehung[.]leben-mit-zwillingen[.]de/download[.]php hxxps://blackwoolholiday[.]com/news[.]php hxxps://arbotechniek[.]dpipreview[.]nl/content[.]php hxxps://bionier-richli[.]ch/news[.]php hxxps://www[.]wege-ins-ausland-messe[.]de/faq[.]php hxxps://alpha[.]amaseon[.]com/download[.]php hxxps://www[.]vykladkaretonline[.]cz/faq[.]php hxxps://aaaconstructionusa[.]com/download[.]php hxxps://bierealaferme[.]be/news[.]php hxxps://1055thehawk[.]com/download[.]php hxxps://bergenadvokatene[.]no/news[.]php hxxps://bernasconi[.]mls-test[.]ch/news[.]php hxxps://alfcommunication[.]com/download[.]php hxxps://fredrikstadadvokatene[.]no/go[.]php hxxps://www[.]travelingwithmj[.]com/faq[.]php hxxps://applefinanceconsulting[.]com/content[.]php hxxps://events[.]amiloisirs[.]com/go[.]php hxxps://2019dev1[.]freshcreative[.]com[.]au/download[.]php hxxps://academy[.]yael-yavin[.]com/download[.]php hxxps://4emme[.]it/download[.]php hxxps://dzikibez[.]pl/download[.]php hxxps://blog[.]tobuz[.]com/news[.]php hxxps://altafolkehogskole[.]no/download[.]php hxxps://www[.]sswleiden[.]nl/content[.]php hxxps://www[.]smartnatation[.]co/content[.]php hxxps://www[.]venetoeconomia[.]it/faq[.]php hxxps://agroturystykaborowka[.]com/download[.]php hxxps://alfio-photos[.]com/download[.]php hxxps://docs[.]paymoney[.]techvill[.]net/download[.]php hxxps://www[.]voicerebels[.]de/faq[.]php hxxps://www[.]sfl[.]hu/content[.]php hxxps://www[.]vecctor[.]lazyls[.]co/faq[.]php hxxps://akademos[.]com[.]ar/download[.]php hxxps://boyarskymurphy[.]com/news[.]php hxxps://anee[.]ee/content[.]php hxxps://apuestagolf[.]com/content[.]php hxxps://blessed-trinity-parish[.]org/news[.]php hxxps://albertoferreira[.]art[.]br/download[.]php hxxps://acc[.]odrtechinc[.]com/download[.]php hxxps://askyadoc[.]org/content[.]php hxxps://www[.]seyhanaluminyum[.]com/content[.]php hxxps://alabuscnc[.]com/download[.]php hxxps://eromannga[.]net/download[.]php hxxps://anphatedu[.]com/content[.]php hxxps://el-bosque[.]net/download[.]php hxxps://www[.]srdemolition[.]com/content[.]php hxxps://aikido-secrets[.]co[.]il/download[.]php hxxps://bannisterministry[.]org/content[.]php hxxps://dogsfun[.]net/download[.]php hxxps://acil[.]m-g-n[.]me/download[.]php hxxps://www[.]spyadviser[.]com/content[.]php hxxps://aaronzonka[.]com/download[.]php hxxps://bialpro[.]pl/news[.]php hxxps://afschools[.]vermilion[.]com/download[.]php hxxps://antoun[.]com[.]au/content[.]php hxxps://blog[.]defouw[.]org/news[.]php hxxps://aboveandbeyondmovers[.]com/download[.]php hxxps://alfabets[.]pl/download[.]php hxxps://ambersdogwise[.]nl/content[.]php hxxps://apostocatering[.]gr/content[.]php hxxps://ecomuseodellegrigne[.]it/download[.]php hxxps://adriaticdeluxeapartments[.]com/download[.]php hxxps://freisein-blog[.]de/go[.]php hxxps://drammensadvokatene[.]no/download[.]php hxxps://adamolam[.]co[.]il/download[.]php hxxps://aandjaudhali[.]com/download[.]php hxxps://www[.]sheffieldcoronarysociety[.]org[.]uk/content[.]php hxxps://biyuu[.]net/news[.]php hxxps://explorer[.]ee/go[.]php hxxps://eiradio[.]com/download[.]php hxxps://aktoto[.]eu/download[.]php hxxps://esmmprev[.]dev[.]interstrand[.]com/download[.]php hxxps://druczki[.]pl/download[.]php hxxps://drguentert[.]mls-test[.]ch/download[.]php hxxps://5esaison[.]ch/download[.]php hxxps://airtechsystem[.]co[.]jp/download[.]php hxxps://adamsarhan[.]com/download[.]php hxxps://www[.]slimdiet[.]eu/content[.]php hxxps://bng-old[.]theapsgroup[.]scot/news[.]php hxxps://agtta[.]org/download[.]php |
GootLoader |
| URL | hxxp://95[.]214[.]24[.]244/autotask/Eppzjtedzmk[.]exe | Quasar RAT |
| URL | hxxp://45[.]9[.]74[.]80/helpstool[.]exe hxxps://ledentiste[.]ma/12/religion/religiousplanpro[.]zip hxxps://ledentiste[.]ma/12/religion/reliigiousplanpro[.]zip hxxp://5[.]42[.]65[.]80/toolwork[.]exe hxxp://79[.]137[.]192[.]18/helptool[.]exe hxxp://5[.]42[.]65[.]80/toolspub2[.]exe |
SmokeLoader |
| URL | hxxp://45[.]9[.]74[.]80/alotdatas[.]exe hxxp://79[.]137[.]192[.]18/alotdata[.]exe |
Glupteba |
| URL | hxxp://163[.]123[.]143[.]201/_errorpages/pablozx[.]exe | Warzone RAT |
| URL | hxxp://193[.]233[.]255[.]9/lend/Lrbaski[.]exe | zgRAT |
| URL | hxxp://95[.]214[.]24[.]244/Z2KNEW/Mfceum-4[.]exe | Coinminer |
| URL | hxxp://95[.]214[.]24[.]244/Z2KNEW/Ivnut-Z2K-2[.]exe hxxp://95[.]214[.]24[.]244/newz2k/Ivnut-Z2K-2[.]exe hxxps://sbs-sysco[.]com/Client[.]exe |
AsyncRAT |
| URL | hxxp://95[.]214[.]24[.]244/Z2KNEW/Z2K-1[.]exe hxxp://95[.]214[.]24[.]244/HEXO-SOFTWARE/HEXO-SOFTWARE-1[.]exe hxxp://95[.]214[.]24[.]244/update/TPB-1[.]exe hxxp://94[.]142[.]138[.]147:77/cvxzbczvbcvzbzcvb/nss3[.]dll hxxp://94[.]142[.]138[.]147:77/cvxzbczvbcvzbzcvb/softokn3[.]dll hxxp://94[.]142[.]138[.]147:77/cvxzbczvbcvzbzcvb/vcruntime140[.]dll hxxp://94[.]142[.]138[.]147:77/cvxzbczvbcvzbzcvb/freebl3[.]dll hxxp://94[.]142[.]138[.]147:77/cvxzbczvbcvzbzcvb/mozglue[.]dll hxxp://94[.]142[.]138[.]147:77/cvxzbczvbcvzbzcvb/msvcp140[.]dll hxxp://94[.]142[.]138[.]147:77/cvxzbczvbcvzbzcvb/sqlite3[.]dll hxxp://91[.]103[.]252[.]249/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://91[.]103[.]252[.]249/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://91[.]103[.]252[.]249/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://91[.]103[.]252[.]249/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://91[.]103[.]252[.]249/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://91[.]103[.]252[.]249/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://91[.]103[.]252[.]249/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://sentrex219[.]xyz/skx111[.]exe | SystemBC |
| URL | hxxp://185[.]225[.]75[.]154/files/Asd11[.]exe | LgoogLoader |
| URL | hxxp://163[.]123[.]143[.]202/_errorpages/collins/fre[.]php | LokiBot |
| URL | hxxp://212[.]193[.]30[.]32/upload/libssl[.]dll | Rhadamanthys |
| URL | hxxps://213[.]226[.]123[.]14/8bmeVwqx/index[.]php | Remcos |
| URL | hxxp://79[.]137[.]206[.]192/dark[.]zip hxxp://5[.]42[.]76[.]165/elosx[.]zip hxxp://135[.]181[.]198[.]32/base[.]zip hxxp://135[.]148[.]113[.]144/kopas[.]zip |
Vidar |
| URL | hxxps://goigt[.]photo[.]beyoudcor[.]com/editContent | FAKEUPDATES |
| URL | hxxp://plateaufoods[.]com[.]au/new/image/index[.]php | Azorult |
