不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/09/08
※2023/11/06 更新
マルウェア感染させると考えられるURLを検知（2023/09/08）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://imagestorage[.]top/top/github/1[.]exe hxxp://77[.]91[.]68[.]78/file/lega[.]exe hxxp://77[.]91[.]68[.]238/love/no230[.]exe hxxp://77[.]91[.]124[.]231/smo/zur[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/jeffzx[.]exe hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/arinzezx[.]exe hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/arinzezx[.]doc hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/obizx[.]doc hxxp://94[.]156[.]253[.]116/tualiop[.]vbs hxxp://95[.]214[.]27[.]56/dloidvbsssss[.]vbs hxxp://163[.]123[.]143[.]164/jatropkaq[.]vbs hxxp://95[.]214[.]27[.]56/droidnewwwwwwww[.]hta hxxp://95[.]214[.]27[.]56/hhhhhhhhhhhhhhhh[.]hta hxxp://185[.]225[.]75[.]151/fantasy[.]vbs hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/jeffzx[.]doc hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/damianozx[.]doc |
Agent Tesla |
| URL | hxxps://dispatchweekly[.]com/wp-admin/admin-ajax[.]php | Mars Stealer |
| URL | hxxps://vvooowkdqddcqcqcdqggggl[.]site/vvmd54/ hxxps://poqwjoemqzmemzgqegzqzf[.]online/vvmd54/ hxxps://bercx[.]workout[.]oystergardener[.]net/editContent hxxps://ldsjx[.]workout[.]oystergardener[.]net/editContent hxxps://gvcc[.]workout[.]oystergardener[.]net/editContent |
FAKEUPDATES |
| URL | hxxp://46[.]18[.]107[.]229/wordpressvmImagepacket/1/temporarySql76/phpLow2Eternal/TemphttpVoiddb0/ToGeo/ImageBase/To/64packetTest/SecureLongpoll/better/7/windows58/Line/6voiddbCentral/jsupdateWordpress[.]php hxxp://62[.]109[.]0[.]255/uploadsLinuxImage5/Processor6/Cdn/DbGenerator/mariadbGeo/FlowerLinux5/MariadbPipeSecure/5secure/Polldle1Provider/Protectdownloads/7update2Test/LocalDefault/Line/track/eternal8/trackJavascriptapi/pollasyncCdncentral[.]php |
DCRat |
| URL | hxxp://192[.]3[.]108[.]47/Msoffice/SecurityHealthSystray[.]exe | Remcos |
| URL | hxxp://tulk2op[.]top/build[.]exe | Arkei Stealer |
| URL | hxxp://micasaab[.]com/oawmKfn169[.]bin hxxp://micasaab[.]com/iQULyeJ10[.]bin hxxp://micasaab[.]com/XQrvvk112[.]bin hxxp://micasaab[.]com/ZcMyBCehEtPGyY46[.]bin hxxp://micasaab[.]com/dDcElXzJWhqocpCKJV76[.]bin hxxp://104[.]168[.]99[.]21/jVioNAFuhmVlMCd36[.]bin hxxp://66[.]63[.]162[.]71/wldDRYmglVyCZRkZUE7[.]bin hxxp://66[.]63[.]162[.]71/wWJOZH35[.]bin hxxp://66[.]63[.]162[.]71/jbCuB194[.]bin hxxp://82[.]115[.]209[.]99/PTwGaE198[.]bin hxxp://vahid[.]intendemo[.]ir/NAyxDcqKCa35[.]bin hxxp://185[.]255[.]114[.]30/fdmeetUHeItsPlWlRvAl21[.]bin hxxp://185[.]255[.]114[.]30/wPnjNvbrhWDHNO216[.]bin hxxp://185[.]255[.]114[.]30/sJifeTMgZw48[.]bin |
CloudEyE |
| URL | hxxp://5[.]161[.]188[.]133/305c71184cbb36ff/sqlite3[.]dll hxxp://5[.]161[.]188[.]133/305c71184cbb36ff/nss3[.]dll hxxp://5[.]161[.]188[.]133/305c71184cbb36ff/mozglue[.]dll hxxp://5[.]161[.]188[.]133/305c71184cbb36ff/softokn3[.]dll hxxp://5[.]161[.]188[.]133/305c71184cbb36ff/freebl3[.]dll hxxp://5[.]161[.]188[.]133/305c71184cbb36ff/vcruntime140[.]dll hxxp://5[.]161[.]188[.]133/305c71184cbb36ff/msvcp140[.]dll hxxp://77[.]105[.]146[.]175/a06b15f9db5e7871/mozglue[.]dll hxxp://77[.]105[.]146[.]175/a06b15f9db5e7871/nss3[.]dll hxxp://77[.]105[.]146[.]175/a06b15f9db5e7871/vcruntime140[.]dll hxxp://77[.]105[.]146[.]175/a06b15f9db5e7871/msvcp140[.]dll hxxp://77[.]105[.]146[.]175/a06b15f9db5e7871/freebl3[.]dll hxxp://77[.]105[.]146[.]175/a06b15f9db5e7871/softokn3[.]dll hxxp://77[.]105[.]146[.]175/a06b15f9db5e7871/sqlite3[.]dll hxxp://5[.]161[.]188[.]133/69b3ae67feef2db7[.]php |
Stealc |
| URL | hxxp://moplex355[.]xyz/777/mtx8bZf[.]exe hxxp://moplex355[.]xyz/777/mtxRwzg[.]exe |
Phobos |
| URL | hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/undergroundzx[.]exe hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/undergroundzx[.]doc hxxp://80[.]76[.]51[.]248/keninv[.]exe hxxp://80[.]76[.]51[.]248/kenpol[.]exe hxxp://192[.]3[.]23[.]247/350/ChromeSetup[.]exe |
Formbook |
| URL | hxxp://fresh1[.]oracover[.]buzz/_errorpages/fresh1/five/fre[.]php hxxp://141[.]98[.]6[.]249:8383/vdgfsh/Panel/five/fre[.]php hxxp://141[.]98[.]6[.]249/vdgfsh/Panel/five/fre[.]php |
LokiBot |
| URL | hxxp://moplex355[.]xyz/777/skxCn8U[.]exe hxxp://moplex355[.]xyz/777/skxIkUT[.]exe |
SystemBC |
| URL | hxxp://80[.]85[.]241[.]108/liux[.]zip | Vidar |
| URL | hxxps://13[.]229[.]134[.]180/_/scs/mail-static/_/js/ hxxps://sybercodesilver[.]lol/ptj hxxps://qianxin[.]edr-down[.]uk/owa/ hxxps://124[.]223[.]222[.]199/IE9CompatViewList[.]xml hxxp://qianxin[.]edr-down[.]uk/owa/ hxxps://cs[.]sharksbaby[.]pro/destroy/v6[.]82/E4QYN5HVXJ hxxp://175[.]24[.]163[.]235/match hxxp://1[.]15[.]244[.]128:8088/dpixel hxxps://api[.]0nedriveup[.]com/__utm[.]gif hxxps://110[.]40[.]184[.]247/pixel hxxp://118[.]89[.]71[.]205:9999/cm hxxps://152[.]136[.]47[.]4/fwlink hxxps://43[.]153[.]222[.]28/cx hxxp://192[.]144[.]234[.]209/ptj hxxp://198[.]98[.]52[.]184:20001/en_US/all[.]js hxxp://139[.]155[.]42[.]254:111/j[.]ad hxxp://124[.]220[.]189[.]137:8888/clemente/details hxxp://43[.]153[.]222[.]28:4646/ga[.]js hxxps://120[.]53[.]86[.]130:8443/level/v5[.]7/AZF0ZH83YKV hxxp://139[.]159[.]203[.]44:8001/load hxxp://49[.]232[.]197[.]218:8092/g[.]pixel hxxp://82[.]157[.]101[.]73:88/push hxxps://139[.]199[.]180[.]136/pixel hxxp://119[.]3[.]177[.]241:8888/ca hxxp://124[.]221[.]183[.]95:9966/__utm[.]gif hxxp://165[.]154[.]130[.]222:1234/ga[.]js hxxps://165[.]154[.]130[.]222:4444/match hxxp://152[.]136[.]35[.]240/en_US/all[.]js hxxp://116[.]62[.]138[.]140:8081/IE9CompatViewList[.]xml hxxps://fxe12[.]danamoninternal[.]com/jquery-3[.]6[.]1[.]min[.]js hxxps://fwe43[.]danamoninternal[.]com/jquery-3[.]6[.]1[.]min[.]js hxxps://listen[.]appstored[.]store/apple-3[.]3[.]1[.]min[.]js hxxp://116[.]62[.]114[.]96:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://116[.]204[.]104[.]60:808/push hxxps://38[.]207[.]179[.]124/pixel hxxp://45[.]94[.]42[.]61:8091/activity hxxp://13[.]229[.]134[.]180/_/scs/mail-static/_/js/ |
Cobalt Strike |
| URL | hxxps://buypropertyinuae[.]com/[.]QnWrd9ratf6jwsVf[.]txt | AsyncRAT |
| URL | hxxps://www[.]advisingdealers[.]com/wp-content/uploads/2018/01/TempPlayerMediaContent[.]zip hxxps://www[.]advisingdealers[.]com/wp-content/uploads/2018/02/local-en(brwrs-update(stable))[.]zip |
NetSupportManager RAT |
| URL | hxxp://85[.]204[.]116[.]38/bins/arm7 | Bashlite |
| URL | hxxp://br3dq[.]shop/PL341/index[.]php | Azorult |
