不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様6社 -
2023/09/20
※2023/09/20 更新
マルウェア感染させると考えられるURLを検知（2023/09/20）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://192[.]3[.]176[.]153/311/TiWorker[.]exe hxxp://192[.]210[.]214[.]76/600/TiWorker[.]exe hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/arinzezx[.]exe hxxp://198[.]46[.]178[.]152/window/SHP[.]txt hxxp://198[.]46[.]178[.]152/window/document[.]vbs hxxp://198[.]46[.]178[.]152/window/Dsvxqdl[.]vdf hxxp://198[.]46[.]178[.]152/window/2/Runtime[.]txt hxxp://198[.]46[.]178[.]152/77/Bin[.]exe hxxp://194[.]180[.]49[.]211/bas/F[.]exe hxxp://194[.]180[.]49[.]211/bas/BIN[.]exe hxxp://192[.]3[.]176[.]153/422/TiWorker[.]exe hxxp://stephenmichaelsmith[.]com/babac/RrrjQpV84[.]bin hxxp://stephenmichaelsmith[.]com/inlw/ietZMUGAFhyzoxQOEqb200[.]bin hxxp://94[.]156[.]161[.]167/tl/iz8596[.]txt |
Agent Tesla |
| URL | hxxp://172[.]172[.]222[.]164/ratlanbu[.]exe hxxp://connect-redelivery00184online[.]com/wincorp[.]exe hxxp://87[.]121[.]221[.]58/c[.]exe hxxp://171[.]22[.]28[.]222/3[.]exe |
RedLine Stealer |
| URL | hxxp://serverlogins[.]com/pit[.]exe | Gozi |
| URL | hxxp://94[.]142[.]138[.]19/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://94[.]142[.]138[.]19/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://94[.]142[.]138[.]19/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://94[.]142[.]138[.]19/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://94[.]142[.]138[.]19/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://94[.]142[.]138[.]19/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/birthaneo2[.]1[.]exe | Nanocore RAT |
| URL | hxxp://45[.]132[.]1[.]43/Cl1ent[.]exe hxxp://806171cm[.]n9shteam1[.]top/nyashsupport[.]php hxxp://85[.]192[.]63[.]134/voiddbBetterGame6/apiasync/php/0externalimage2/Poll/Wordpress/_/4eternal03/asyncLine/central/downloadssecure4To/18LocalDatalife/linuxEternal/3FlowerProcessor5/1Longpoll/gamelongpollmultiprivateCdn[.]php |
DCRat |
| URL | hxxp://77[.]91[.]68[.]78/lend/stub[.]exe hxxp://77[.]91[.]68[.]78/lend/stubweb3[.]exe |
Coinminer |
| URL | hxxp://5[.]42[.]64[.]45/8bmeVwqx/index[.]php | Amadey |
| URL | hxxp://186[.]4[.]217[.]208:34901/Mozi[.]m | Mozi |
| URL | hxxps://bax-teko[.]com/data/1002063447/payment/7aX421V8/game/send[.]php hxxps://bax-teko[.]com/data/1002063447/payment/7aX421V8/Mellat[.]php hxxps://bax-teko[.]com/data/1002063447/payment/7aX421V8/game/index[.]php hxxps://navid[.]inthenameofnull[.]site/api/-1001228456341 hxxps://navid[.]inthenameofnull[.]site/api/ hxxps://navid[.]inthenameofnull[.]site/api |
IRATA |
| URL | hxxps://ug62r67uiijo2[.]com/vvmd54/ hxxps://ug62r67uiijo2[.]com/ZgbN19Mx hxxps://ug62r67uiijo2[.]com/lander/chrome/_index[.]php |
FAKEUPDATES |
| URL | hxxp://mktrex219[.]xyz/777/mtxnn0z[.]exe hxxp://mkstat227[.]xyz/777/mtxUcwO[.]exe |
Phobos |
| URL | hxxp://mktrex219[.]xyz/777/skxSXM9[.]exe | SystemBC |
| URL | hxxps://advocaciasch[.]com[.]br/tmp/index[.]php hxxps://alayyadcare[.]com/tmp/index[.]php hxxps://wahaaudit[.]ps/tmp/index[.]php |
SmokeLoader |
| URL | hxxp://193[.]142[.]59[.]12/myblog/posts/file[.]exe | Mars Stealer |
| URL | hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/nellyzx[.]exe hxxp://194[.]180[.]49[.]211/bas/RRA[.]exe hxxp://103[.]182[.]16[.]23/s179m/smss[.]exe hxxp://192[.]3[.]23[.]242/80/mtdocs[.]exe hxxp://103[.]182[.]16[.]23/M189T/smss[.]exe hxxp://77[.]105[.]147[.]20/hih/IMG_710596pdf[.]exe hxxp://192[.]3[.]101[.]21/602/TiWorker[.]exe |
Formbook |
| URL | hxxps://pasteio[.]com/raw/xYD4p7T7jeTT hxxps://pasteio[.]com/raw/x1k89wcuxGSu hxxps://pasteio[.]com/raw/xuwAUQyf9juZ hxxps://pasteio[.]com/raw/xOSohYO1wrVu |
VoidRAT |
| URL | hxxp://47[.]105[.]69[.]34:8000/api/3 hxxp://118[.]24[.]128[.]43/push hxxp://182[.]92[.]218[.]99/match hxxps://upload[.]flash-update[.]info:2083/api/3 hxxp://ns3[.]vpn[.]baidusec[.]top:53/newspaper[.]js hxxp://ns2[.]vpn[.]baidusec[.]top:53/js[.]js hxxp://ns1[.]vpn[.]baidusec[.]top:53/js[.]js hxxps://101[.]34[.]71[.]193/jquery-3[.]3[.]1[.]min[.]js hxxp://harmonyshoused[.]com:443/design/query/9X5M3SOE0F hxxps://39[.]107[.]113[.]250/IE9CompatViewList[.]xml hxxp://82[.]115[.]223[.]34/ptj hxxp://nexgenemi[.]com/index[.]get/files/ajaxonly/saveprogress hxxp://1[.]116[.]156[.]228:8078/ptj hxxp://106[.]75[.]232[.]107/match hxxp://81[.]68[.]194[.]174:8002/IE9CompatViewList[.]xml hxxp://124[.]221[.]76[.]197/visit[.]js hxxp://8[.]134[.]122[.]165:8099/cx hxxp://111[.]231[.]24[.]230:54322/ptj hxxps://129[.]211[.]211[.]145/dpixel hxxps://124[.]221[.]76[.]197/pixel[.]gif hxxp://120[.]46[.]39[.]64:8080/g[.]pixel hxxp://82[.]157[.]57[.]66/fwlink hxxps://www[.]baidusec[.]top:2053/eo[.]js hxxps://1[.]116[.]156[.]228/g[.]pixel hxxp://147[.]78[.]47[.]241/cx hxxps://www[.]5cq[.]com/link[.]html hxxps://www[.]baidusec[.]top:2096/dom[.]js hxxp://116[.]62[.]138[.]47:1000/ga[.]js hxxp://116[.]62[.]138[.]47:1000/8yHd hxxp://8[.]140[.]37[.]238/ca |
Cobalt Strike |
| URL | hxxp://194[.]180[.]49[.]211/bas/Rain[.]exe hxxp://80[.]76[.]51[.]33:2606/ie hxxp://80[.]76[.]51[.]33:2606/give-me-ffpv hxxp://80[.]76[.]51[.]33:2606/give-me-chpv hxxp://80[.]76[.]51[.]33:2606/moz-sdk hxxp://80[.]76[.]51[.]33:2606/is-ready |
WSHRAT |
| URL | hxxp://lone1vt[.]top/zip[.]php | CryptBot |
| URL | hxxp://74[.]84[.]150[.]168/vmxUP42[.]bin hxxp://74[.]84[.]150[.]168/vpcKwSFAQCu204[.]bin hxxp://103[.]237[.]86[.]138/KTNsBaKIursj39[.]bin hxxp://103[.]237[.]86[.]138/ztwDUInm166[.]bin hxxp://103[.]237[.]86[.]138/IQiiPV79[.]bin hxxp://stephenmichaelsmith[.]com/babr/Modparter[.]asd hxxp://stephenmichaelsmith[.]com/inlw1/Limsypr[.]sea |
CloudEyE |
| URL | hxxps://wordpress[.]ductai[.]xyz/file/ps/ni2n[.]ps1 | DUCKTAIL |
| URL | hxxp://193[.]42[.]32[.]101/files/get3[.]exe hxxp://193[.]42[.]32[.]101/files/UM[.]exe |
LgoogLoader |
| URL | hxxp://teishin[.]org/treasury/resources/admin/wp-admin/attack[.]php hxxp://teishin[.]org/treasury/wp_asist[.]php |
Kimsuky |
| URL | hxxps://pasteio[.]com/raw/x38kbgLd6bPu | NjRAT |
| URL | hxxp://hncelectric[.]cf/PWS/fre[.]php | LokiBot |
| URL | hxxp://bryanzachary[.]top/e9c345fc99a4e67e[.]php | Stealc |
| URL | hxxp://closhemone[.]fun/c2conf hxxp://castomdroms[.]xyz/c2conf |
Lumma Stealer |
