不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/09/14
※2023/11/06 更新
マルウェア感染させると考えられるURLを検知（2023/09/14）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://77[.]91[.]68[.]78/lend/z9lupld56bdv[.]exe hxxps://easyxgame[.]com/setup[.]rar hxxp://194[.]180[.]49[.]211/D/B[.]exe hxxp://77[.]91[.]124[.]231/new/foto5445[.]exe hxxp://79[.]137[.]192[.]18/Mar[.]exe hxxps://protonvpn[.]uno/zakz/TrueCrypt_yAdpIh[.]exe hxxp://194[.]180[.]49[.]211/D/CB[.]exe hxxps://ptasoftware[.]com/Build[.]exe hxxps://scamalert[.]finance/pages/newlife[.]exe |
RedLine Stealer |
| URL | hxxp://194[.]180[.]49[.]211/D/rain[.]exe hxxp://103[.]182[.]16[.]23/T129W/smss[.]exe hxxp://77[.]91[.]68[.]78/lend/file[.]exe |
Formbook |
| URL | hxxps://heike[.]teofilius[.]de/blog[.]php hxxps://ikhwarn[.]com/blog[.]php |
GootLoader |
| URL | hxxp://5[.]75[.]212[.]216:27015/htdocs[.]zip hxxp://116[.]203[.]7[.]16/htdocs[.]zip hxxps://martinelliglobal[.]com/Ml8gJiUqkS hxxps://martinelliglobal[.]com/p9awiydFdo hxxps://martinelliglobal[.]com/file/dmM2PGCY[.]gif hxxps://martinelliglobal[.]com/JiNZYvfDpE |
Vidar |
| URL | hxxp://23[.]236[.]203[.]81/gEUBYPspBNL33[.]bin hxxp://172[.]93[.]187[.]222/ziVgZdlsgxZyQDsFVXtj230[.]bin hxxp://172[.]93[.]187[.]222/WOqSxVaNbJ196[.]bin hxxp://172[.]93[.]187[.]222/vlgOy108[.]bin hxxp://5[.]78[.]84[.]125/EPcnJsbG195[.]bin |
CloudEyE |
| URL | hxxp://185[.]225[.]75[.]151/jasonity[.]exe hxxp://194[.]180[.]49[.]211/D/fweb[.]exe hxxp://194[.]180[.]49[.]211/D/F[.]exe hxxp://192[.]3[.]176[.]153/101/igccu[.]exe hxxp://194[.]180[.]49[.]211/D/hamzavic[.]txt hxxp://194[.]180[.]49[.]211/D/financee[.]txt hxxp://194[.]180[.]49[.]211/D/tbow[.]txt hxxp://194[.]180[.]49[.]211/D/cborinew[.]txt hxxp://194[.]180[.]49[.]211/D/gerenciaa[.]txt hxxp://194[.]180[.]49[.]211/D/Nbin[.]txt hxxp://194[.]180[.]49[.]211/D/Gen[.]exe hxxp://192[.]3[.]176[.]153/102/igccu[.]exe hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/centralimac2[.]1[.]exe hxxp://194[.]180[.]49[.]211/D/allen[.]txt hxxp://192[.]3[.]176[.]153/60/hkcmd[.]exe |
Agent Tesla |
| URL | hxxp://139[.]155[.]90[.]81:8001/IE9CompatViewList[.]xml hxxps://43[.]138[.]218[.]97/pixel[.]gif hxxps://casualscorner[.]com/design/query/9X5M3SOE0F hxxps://137[.]184[.]97[.]84:8989/inquiry/META-INF/YVHAC4J11I hxxps://54[.]251[.]198[.]129/dot[.]gif hxxp://111[.]67[.]195[.]154:8011/cm hxxp://134[.]122[.]204[.]140:10011/en_US/all[.]js hxxp://47[.]120[.]9[.]35/g[.]pixel hxxps://sectorzerosecurity[.]com/__utm[.]gif hxxps://85[.]31[.]233[.]108/visit[.]js hxxps://104[.]168[.]201[.]195/ga[.]js hxxp://172[.]111[.]50[.]113/updates[.]rss hxxp://app[.]baidu-soft[.]com/IE9CompatViewList[.]xml hxxps://143[.]198[.]26[.]169/ga[.]js hxxps://212[.]192[.]15[.]231:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://34[.]124[.]197[.]156:8443/dpixel hxxp://104[.]168[.]201[.]195/ca hxxp://124[.]70[.]53[.]30:8000/ptj hxxp://82[.]157[.]57[.]66/pixel[.]gif hxxp://139[.]155[.]154[.]67:8089/match hxxps://43[.]138[.]62[.]36/dpixel hxxp://124[.]70[.]129[.]64:9090/api/x hxxps://incitewebsolution[.]com/av hxxp://43[.]136[.]14[.]250/load hxxp://43[.]138[.]62[.]36:8080/fwlink hxxps://43[.]138[.]179[.]199:1811/pixel[.]gif hxxp://43[.]138[.]30[.]109:7524/ca hxxp://47[.]101[.]170[.]17:8888/push hxxp://42[.]193[.]44[.]136/g[.]pixel hxxp://82[.]115[.]223[.]34/pixel hxxp://43[.]138[.]179[.]199:808/ca hxxp://106[.]75[.]2[.]57:7000/g[.]pixel hxxp://43[.]138[.]62[.]36:7001/pixel hxxp://103[.]30[.]43[.]148:4500/ga[.]js hxxps://101[.]32[.]186[.]170/pixel[.]gif hxxps://34[.]92[.]125[.]242/cm hxxps://api[.]0nedriveup[.]com/fwlink hxxps://120[.]48[.]74[.]67/ga[.]js hxxps://3[.]72[.]68[.]180/dot[.]gif hxxps://139[.]155[.]154[.]67/IE9CompatViewList[.]xml hxxps://www[.]5cq[.]com/ms hxxps://134[.]122[.]204[.]140/load hxxp://43[.]138[.]62[.]36:8081/en_US/all[.]js hxxps://47[.]101[.]170[.]17/dot[.]gif hxxp://150[.]158[.]181[.]243:8011/dpixel hxxp://111[.]231[.]24[.]230:54322/dpixel hxxp://120[.]78[.]156[.]73:12345/pixel[.]gif hxxp://8[.]142[.]117[.]220/updates[.]rss hxxps://43[.]138[.]179[.]199/ca hxxp://124[.]223[.]22[.]86/g[.]pixel hxxps://101[.]43[.]127[.]45:8443/pixel hxxps://47[.]120[.]11[.]176/fwlink hxxps://1[.]117[.]93[.]65/visit[.]js hxxp://110[.]41[.]11[.]72/dot[.]gif hxxp://107[.]172[.]201[.]137/IE9CompatViewList[.]xml hxxps://124[.]71[.]84[.]65/g[.]pixel hxxps://43[.]138[.]30[.]109:7777/ptj hxxp://175[.]24[.]235[.]158:6060/match hxxps://43[.]153[.]222[.]28/ca hxxps://47[.]101[.]41[.]158:37676/dpixel hxxp://43[.]138[.]30[.]109:8888/dot[.]gif hxxps://download[.]updatebrowser[.]cn:8443/0RZDKXR/ADGJJ4B3VRSPAV9KC3MXI80OFD[.]css hxxp://120[.]48[.]74[.]67:8001/dot[.]gif hxxps://sunshine[.]nicetrue[.]one:8443/login[.]jsp hxxp://154[.]90[.]57[.]70:9090/cm hxxp://139[.]196[.]191[.]50:8099/g[.]pixel hxxp://143[.]198[.]26[.]169/activity hxxps://devopszone[.]org/template hxxp://update[.]edgeupdates[.]com:8080/api/getStatus hxxp://34[.]92[.]125[.]242/pixel[.]gif |
Cobalt Strike |
| URL | hxxp://samnex158[.]xyz/777/mtxTuZq[.]exe | Phobos |
| URL | hxxp://20[.]150[.]193[.]101/v/modelo[.]zip hxxp://20[.]150[.]193[.]101/w/modulo1[.]zip |
Metamorfo |
| URL | hxxps://ayhy[.]workout[.]oystergardener[.]net/editContent hxxps://hlgx[.]workout[.]oystergardener[.]net/editContent hxxps://fyxk[.]workout[.]oystergardener[.]net/editContent hxxps://unquu[.]workout[.]oystergardener[.]net/editContent hxxps://zwxe[.]workout[.]oystergardener[.]net/editContent |
FAKEUPDATES |
| URL | hxxps://treebank[.]vn/wp-content/plugins/wordpress-seo/src/exceptions/addon-installation/9798[.]7z hxxps://vocesdelatinoamerica[.]com/personification/ hxxps://scauditora[.]cl/absorbability hxxps://vocesdelatinoamerica[.]com/personification hxxps://monkey-lab[.]net/ggl-live/wp/wp-admin/css/colors/blue/7197[.]7z hxxps://scauditora[.]cl/outside hxxps://sysobra[.]com[.]br/freshly hxxps://www[.]jpspeed[.]biz/paleontological hxxps://comercial-sanjose[.]cl/effector hxxps://vocesdelatinoamerica[.]com/premise hxxps://mariotimm[.]com[.]br/countermining hxxps://iptvdienst[.]shop/armature hxxps://blog[.]cafezinho[.]group/suspended hxxps://webtesting[.]bumpkindigital[.]com/synthesized hxxps://forms[.]hurtadovidalplasticsurgery[.]com/raveling hxxps://brunettifamily[.]org/assumed hxxps://forms[.]hurtadovidalplasticsurgery[.]com/stakeout hxxps://www[.]jpspeed[.]biz/toughen hxxps://comercial-sanjose[.]cl/banknote hxxps://sysobra[.]com[.]br/ramble hxxps://brunettifamily[.]org/muniment hxxps://mariotimm[.]com[.]br/alkaline hxxps://iptvdienst[.]shop/gunwale hxxps://webtesting[.]bumpkindigital[.]com/goddess hxxps://galaxypharmacysl[.]com/truckler hxxps://blog[.]cafezinho[.]group/convalescent hxxps://galaxypharmacysl[.]com/unmannerly |
IcedID |
| URL | hxxp://49[.]13[.]17[.]71/1[.]exe | RecordBreaker |
| URL | hxxp://5[.]180[.]183[.]1/pftp hxxp://5[.]180[.]183[.]1/sh hxxp://5[.]180[.]183[.]1/apache2 hxxp://5[.]180[.]183[.]1/openssh hxxp://5[.]180[.]183[.]1/ftp hxxp://5[.]180[.]183[.]1/bash hxxp://5[.]180[.]183[.]1/cron hxxp://5[.]180[.]183[.]1/wget hxxp://5[.]180[.]183[.]1/sshd hxxp://5[.]180[.]183[.]1/tftp hxxp://5[.]180[.]183[.]1/ntpd |
Bashlite |
| URL | hxxp://171[.]22[.]28[.]208/download/rise/StealerClient_Cpp[.]exe | PrivateLoader |
| URL | hxxp://171[.]22[.]28[.]208/download/Services[.]exe | Raccoon |
| URL | hxxp://gapi-alpha[.]io/c2conf | Lumma Stealer |
| URL | hxxp://185[.]244[.]48[.]221/753e391766d6b25f[.]php | Stealc |
| URL | hxxp://185[.]215[.]113[.]35/bkd7djmsa/index[.]php | Amadey |
| URL | hxxps://obituaryforfree[.]com/Installer[.]exe | DarkComet |
