不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/10/11
※2023/10/11 更新
マルウェア感染させると考えられるURLを検知（2023/10/11）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://141[.]98[.]6[.]154/b/login[.]php hxxp://94[.]156[.]161[.]167/EXX[.]vbs hxxp://192[.]3[.]101[.]8/360/sihost[.]exe hxxp://95[.]214[.]27[.]121/jinglebello[.]vbs hxxp://141[.]98[.]6[.]154/b/inc/bbc7e6ad6814b3[.]php hxxp://107[.]173[.]4[.]18/154/ishost[.]exe hxxp://omrat[.]ee/mix[.]bin hxxp://107[.]173[.]4[.]18/160/ishost[.]exe hxxp://85[.]31[.]45[.]8/googluk[.]exe hxxp://94[.]156[.]6[.]158/prag[.]hhp hxxp://94[.]156[.]6[.]158/JdfQRlaohAPmJ134[.]bin hxxp://94[.]156[.]6[.]158/eOCTrnBRdHb79[.]bin hxxp://94[.]156[.]6[.]158/zIPwHdpd231[.]bin hxxp://dcut[.]top/rty/yam[.]com |
Agent Tesla |
| URL | hxxps://upny[.]layout[.]oystergardens[.]us/editContent hxxps://kuwi[.]layout[.]oystergardens[.]us/editContent hxxps://eastrenclouds[.]com/cdn-js/minlen[.]php hxxps://eastrenclouds[.]com/cdn/qzwewmrqqgqnaww[.]php hxxps://cfc[.]2023[.]ebeenj[.]com/editContent hxxps://nen[.]layout[.]oystergardens[.]us/editContent hxxps://bno[.]layout[.]oystergardens[.]us/editContent |
FAKEUPDATES |
| URL | hxxps://thehoffmanagency[.]co/files5/ | DUCKTAIL |
| URL | hxxps://textbin[.]net/raw/1lkc5ccspw | Revenge RAT |
| URL | hxxp://91[.]103[.]252[.]74/9787806e0e289839[.]php hxxp://91[.]103[.]252[.]74/8536233f1d656e37/nss3[.]dll hxxp://91[.]103[.]252[.]74/8536233f1d656e37/vcruntime140[.]dll hxxp://91[.]103[.]252[.]74/8536233f1d656e37/mozglue[.]dll hxxp://91[.]103[.]252[.]74/8536233f1d656e37/msvcp140[.]dll hxxp://91[.]103[.]252[.]74/8536233f1d656e37/sqlite3[.]dll hxxp://91[.]103[.]252[.]74/8536233f1d656e37/softokn3[.]dll hxxp://91[.]103[.]252[.]74/8536233f1d656e37/freebl3[.]dll |
Stealc |
| URL | hxxp://165[.]227[.]141[.]64/en_US/all[.]js hxxp://119[.]29[.]106[.]110/pixel[.]gif hxxp://39[.]106[.]2[.]238:81/pixel hxxp://107[.]174[.]186[.]22:6666/visit[.]js hxxps://124[.]221[.]76[.]197/en_US/all[.]js hxxp://124[.]71[.]130[.]71/__utm[.]gif hxxp://123[.]249[.]101[.]92/en_US/all[.]js hxxp://8[.]130[.]128[.]97/updates[.]rss hxxps://39[.]107[.]113[.]250/fwlink hxxp://49[.]232[.]22[.]171/load hxxps://8[.]130[.]125[.]172/j[.]ad hxxps://146[.]56[.]118[.]82/ptj hxxps://47[.]100[.]180[.]123:3004/ca hxxps://8[.]134[.]85[.]39/ga[.]js hxxp://146[.]0[.]79[.]11/design/query/9X5M3SOE0F hxxp://123[.]207[.]29[.]252:55554/pixel hxxp://106[.]14[.]149[.]88:9091/g[.]pixel hxxps://cs[.]h1ll0[.]cs[.]in/fwlink hxxp://104[.]129[.]180[.]227:3552/updates[.]rss hxxp://47[.]99[.]79[.]203/ptj hxxps://206[.]189[.]191[.]54/jquery-3[.]3[.]1[.]min[.]js hxxp://107[.]163[.]223[.]242:82/IE9CompatViewList[.]xml hxxp://162[.]14[.]209[.]70:8000/visit[.]js hxxp://47[.]120[.]0[.]195:5555/visit[.]js hxxps://8[.]219[.]88[.]106/Compare/v2[.]66/G6EBS8VJR0 hxxp://carepassmedservices[.]com:8080/search hxxp://api[.]cert-ex[.]net/push |
Cobalt Strike |
| URL | hxxps://upload[.]vina-host[.]com/HQM42gUnRU/windows[.]exe hxxp://77[.]91[.]124[.]41/toJavascriptJsprocessorDatalifePublic[.]php hxxp://n9shteam2[.]top/nyashsupport[.]php |
DCRat |
| URL | hxxp://88[.]99[.]122[.]198:8000/images[.]zip hxxp://78[.]47[.]20[.]171/images[.]zip |
Vidar |
| URL | hxxps://kform[.]innan[.]net/comments[.]php hxxps://mein[.]miteinander[.]reisen/docs[.]php hxxps://laboratoriocitrico[.]com/comments[.]php hxxps://kwiatkifranciszka[.]edu[.]pl/comments[.]php hxxps://midwayfun[.]client[.]dev[.]rocketeffect[.]com/docs[.]php hxxps://meekoppelen[.]klimaatadaptatie[.]nl/docs[.]php hxxps://mercedes5pluss[.]no/docs[.]php hxxps://media-accelerator[.]it/docs[.]php hxxps://metodabls[.]pl/docs[.]php hxxps://mindfully[.]vn/docs[.]php |
GootLoader |
| URL | hxxp://45[.]128[.]232[.]115/Sakura[.]sh | QakBot |
| URL | hxxp://live[.]com[.]gt/unito/Azienda[.]zip hxxp://evolve-adv[.]com/impresa/Documenti[.]zip hxxp://ngarengan[.]com/impresa/Cliente[.]zip hxxp://nhatheptienchebinhduong[.]com/archivio/Informazioni[.]zip |
Gozi |
| URL | hxxps://primebuildcontractors[.]co[.]ke/Interorbit[.]deploy hxxp://74[.]84[.]150[.]168/sUnHLObvEZiX143[.]bin hxxp://74[.]84[.]150[.]168/KWPJghZUmKLIukFeaVhS180[.]bin hxxp://74[.]84[.]150[.]168/tpxLsfdVV106[.]bin hxxp://74[.]84[.]150[.]168/NeEaKGaRhRbbY1[.]bin hxxps://primebuildcontractors[.]co[.]ke/putrefact[.]fla |
CloudEyE |
| URL | hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/fbinzx[.]exe hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/marcolite2[.]1[.]exe hxxp://23[.]95[.]106[.]3/350/122/process[.]exe hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/romankon2[.]1[.]exe hxxp://23[.]95[.]106[.]3/350/sihost[.]exe |
Formbook |
| URL | hxxp://mktrex219[.]xyz/777/skxeEu0[.]exe | SystemBC |
| URL | hxxps://graydepellet[.]cl/atoi/ hxxps://pictopara[.]com/ptlr/ hxxps://decatoria[.]com/eutt/ hxxps://wholechildren[.]org/debu/ hxxps://shoppingleeds[.]us/usau/ hxxps://supplementsforsale[.]online/fio/ hxxps://naturalproducts[.]io/esai/ hxxps://mochilaeasas[.]com/vsu/ hxxps://180plan[.]com[.]au/ettu/ hxxps://insidepitchxl[.]com/rmu/ hxxps://mnfservice[.]com[.]my/mu/ hxxps://wagonslearning[.]net/si/ hxxps://coalizaobrasil[.]com[.]br/eut/ hxxps://boosterjp[.]co/sm/ hxxps://uploadian[.]com/aern/ hxxps://palpa[.]ps/otle/ hxxps://architecterp[.]com/teui/ hxxps://hbionline[.]live/vifl/ hxxps://follow[.]co[.]za/edbu/ hxxps://melbournerollershutters[.]net[.]au/sne/ hxxps://unrealpcs[.]com[.]au/etoe/ hxxps://cswr[.]com[.]au/po/ hxxps://theprimacare[.]in/cmu/ hxxps://aleeftrade[.]com/vtl/ hxxps://managerial[.]email/iaut/ hxxps://strongpg[.]xyz/emr/ hxxps://katsuamber[.]site/pg/ hxxps://hptest[.]ro/al/ hxxps://atlanticosystems[.]com/eeae/ hxxps://yac[.]org[.]pk/roe/ hxxps://casaconstructorhomecenter[.]com/nt/ hxxps://currylounge[.]ca/pni/ hxxps://arge[.]pt/il/ hxxps://cafewarmi[.]com/qm/ hxxps://livetectelecom[.]com[.]br/ul/ hxxps://cannamed[.]org[.]za/at/ hxxps://eaasee[.]com/car/ hxxps://dulcettieolic[.]com[.]br/tr/ hxxps://stjohnsbd[.]com/sbir/ hxxps://alcodshop[.]ro/tmu/ hxxps://mediatrends[.]live/vmni/ hxxps://sigetec[.]com[.]mx/oam/ hxxps://tepor[.]it/lqas/ hxxps://mapwo[.]org[.]af/smui/ hxxps://harsiddhindustries[.]com/leo/ hxxps://vojvodina[.]co[.]rs/ao/ hxxps://arishhomeschool[.]com[.]ng/nut/ hxxps://rtp-kapuas88[.]com/snr/ hxxps://ittrainingbd[.]com/pner/ hxxps://ar[.]itr[.]works/iv/ hxxps://jiandikie[.]com/ai/ hxxps://bakewell-eg[.]com/il/ hxxps://udettc[.]com/uq/ hxxps://loginguide[.]pro/si/ hxxps://califholdings[.]com/utqs/ hxxps://kidsneedsbd[.]com/trs/ hxxps://numberozo[.]com/uqq/ hxxps://tavantakplastic[.]com/uu/ hxxps://aavn-school[.]ac[.]th/iuq/ hxxps://sondoscamisas[.]com/au/ hxxps://bepvugiang[.]vn/uirv/ hxxps://tyg[.]cl/stsi/ hxxps://adimogi[.]com[.]br/te/ hxxps://viadigitalconsulting[.]com/tiiu/ hxxps://oencantadordecaes[.]pt/eaad/ hxxps://ecosing[.]com/qc/ hxxps://coffesso[.]com/urra/ hxxps://xuyentri[.]com/ti/ hxxps://outletbelleza[.]cl/ucrn/ hxxps://merret[.]cl/msn/ hxxps://wirkaleufu[.]cl/do/ hxxps://aarzu[.]com[.]pk/rebr/ hxxps://corporatelawsector[.]us/uoam/ hxxps://vividsalonindia[.]com/lvu/ hxxps://jjbpo[.]com[.]co/tp/ hxxps://boacavaimoveis[.]com[.]br/qate/ hxxps://maesthetics[.]pk/qaa/ hxxps://moltaqa[.]net/blar/ hxxps://softwaresbuilders[.]com/ltu/ hxxps://noujoumtounes[.]com/ed/ hxxps://mariaworlds[.]com/ambu/ hxxps://clyeducation[.]com/evit/ hxxps://lendbright[.]com[.]au/eu/ hxxps://infocuankerajaan[.]xyz/pe/ hxxps://basketballdrillsxl[.]com/saen/ hxxps://wagonslearning[.]org/os/ hxxps://egyfarm-eg[.]com/ieeo/ hxxps://tigersproductos[.]com/ign/ hxxps://essex-communications[.]com/lo/ hxxps://capacbi[.]com[.]mx/tal/ hxxps://flaviopavim[.]com[.]br/alua/ hxxps://avemariacare[.]com/tso/ hxxps://pickleballera[.]com/iaei/ hxxps://impeccableafricatour[.]com/imd/ hxxps://yaseenahmed[.]com/ti/ hxxps://aksheraa[.]com/sene/ hxxps://abodeclime[.]com/liu/ hxxps://parladonna[.]com[.]br/ol/ hxxps://idsaperu[.]com/nq/ hxxps://zeytuni[.]net/su/ hxxps://fivestareducational[.]com/id/ hxxps://amv2[.]org/ecc/ hxxps://lumafacturacion[.]com/ap/ hxxps://perfectutilities[.]co[.]in/nci/ hxxps://empirewindowfurnishings[.]com[.]au/oa/ hxxps://taxagentuae[.]com/cq/ hxxps://sorkarshop[.]com/dai/ hxxps://nationalsurveysearch[.]com/nuae/ hxxps://hosps[.]co[.]za/esp/ hxxps://ascent[.]edu[.]my/lfg/ hxxps://botanistudio[.]com/aui/ hxxps://kalos[.]com[.]ar/ai/ hxxps://prnts[.]cc/trxe/ hxxps://productsinoffer[.]shop/nuat/ hxxps://grocerycorridor[.]com/aso/ hxxps://wpconversionking[.]com/acu/ hxxps://jilmondeconsulting[.]com/dt/ hxxps://texttospeechconverter[.]com/oau/ hxxps://lider[.]fm/an/ hxxps://desentupidoradepalmas[.]com[.]br/ptoa/ hxxps://alkawsar[.]org/ets/ hxxps://proshantika[.]com/qbie/ hxxps://africaillustriousawards[.]org/nfe/ hxxps://sexsecret[.]com[.]mx/tqe/ hxxps://h4ac[.]com/bg/ hxxps://yunaxtech[.]com/iut/ hxxps://allseocheckertools[.]com/etum/ hxxps://alanayamassagespa[.]com/ofr/ hxxps://camerazone[.]lk/qia/ hxxps://inducleandecolombia[.]com/ped/ hxxps://livescorekapuas88[.]com/oo/ hxxps://psorientalmarket[.]com/iip/ hxxps://division9kw[.]com/ap/ hxxps://elsafeer[.]travel/iegu/ hxxps://lvcsac[.]com[.]pe/raee/ hxxps://tnkdeals[.]com/se/ hxxps://daijo[.]com[.]br/coto/ hxxps://sinnap[.]com[.]my/earm/ hxxps://tucanosimports[.]com[.]br/lsti/ hxxps://landhuisbelnem[.]com/cqsa/ hxxps://eduook[.]com/ume/ hxxps://divinfosystem[.]com/aei/ hxxps://addoxygenempowermentfoundation[.]org/utae/ hxxps://ibigerservices[.]com/ei/ hxxps://usenata[.]com/isma/ hxxps://keeptrending[.]com/cit/ hxxps://bepvugiang[.]vn/uua/ hxxps://nustreamdevsite[.]com/qte/ hxxps://fulldeckproductions[.]co[.]za/opa/ hxxps://trinityuniversity[.]edu[.]ng/son/ hxxps://lqlop[.]com/ff/ hxxps://xuyentri[.]com/do/ hxxps://drmanojaggarwal[.]com/ssu/ hxxps://alessiadegaspari[.]it/nu/ hxxps://bertam[.]com[.]my/ae/ hxxps://baisoya[.]com[.]pk/cuaa/ hxxps://africanempowermenthubuganda[.]org/aa/ hxxps://yamaclis[.]com/ns/ hxxps://webcarbrasil[.]com[.]br/gu/ hxxps://artejoy[.]co[.]in/inl/ hxxps://seguridaduls[.]cl/at/ hxxps://tgcinternational[.]net/tse/ hxxps://moltaqa[.]net/ul/ hxxps://impeccableafricatour[.]com/iaia/ hxxps://iacademy[.]fit/dq/ hxxps://lucaspena[.]com/hee/ hxxps://sihtna[.]com/spni/ hxxps://managerial[.]email/qut/ hxxps://polipositiva[.]com[.]br/cc/ hxxps://ascent[.]edu[.]my/od/ hxxps://balletstudiobogota[.]com/ruui/ hxxps://constrowins[.]eng[.]br/tete/ hxxps://solutionforum[.]au/ui/ hxxps://cerodamed[.]com/ei/ hxxps://fleexmobile[.]com/aqmu/ hxxps://kidcocandy[.]com/gq/ hxxps://tutorialadda[.]com/iu/ hxxps://amtrakdeals[.]com/os/ hxxps://sondoscamisas[.]com/ut/ hxxps://dosaenterprise[.]com/to/ hxxps://co-create2071[.]org/stqs/ hxxps://naveeslawconsultants[.]com/eave/ hxxps://neednoneedles[.]com/daa/ hxxps://empirewindowfurnishings[.]com[.]au/feic/ hxxps://capacitecbi[.]com[.]mx/ssiu/ hxxps://eventionevents[.]com/tnau/ hxxps://clonhadas[.]com[.]co/si/ hxxps://protechsecuritysolutions[.]com/rct/ hxxps://excelabridge[.]com/vls/ hxxps://mercyconsultancyhq[.]com/neiu/ hxxps://enviro-boise[.]com/eluo/ hxxps://svhhealthcare[.]com/apli/ hxxps://cyberi[.]org/iu/ hxxps://heightfreight[.]com/eest/ hxxps://mneonsigns[.]com/qaa/ hxxps://yfeqqsy03mvt[.]com/ol/ hxxps://hilyers[.]com/eett/ hxxps://revangenclik[.]org[.]az/uqq/ hxxps://okakafc[.]com/smup/ hxxps://gruporosagoncalves[.]com[.]br/iee/ hxxps://rosretail[.]co[.]in/umt/ hxxps://fbbazar[.]com/rerv/ hxxps://tecnoyar[.]com/suet/ hxxps://learn-conversation[.]com/ll/ hxxps://jarsofwinepress[.]com/uiot/ hxxps://idreamtravel[.]com[.]my/ad/ hxxps://autrequotidien[.]bj/uvai/ hxxps://krv[.]edu[.]my/adei/ hxxps://esdgroup[.]in/qa/ hxxps://dynamicindustries[.]com[.]pk/rrbe/ hxxps://eshraqa[.]co/iav/ hxxps://tbgroop[.]ir/tsm/ hxxps://nurin[.]ug/utse/ hxxps://alzorahvipmassagespa[.]com/lasi/ hxxps://wccchealthfacilitieswholesalers[.]co[.]za/qli/ hxxps://conventionalservices[.]com/pdno/ hxxps://escuelacaninabigdog[.]com[.]mx/inmi/ hxxps://meetgirl24[.]online/qei/ hxxps://zisafsolutions[.]com/rerm/ hxxps://anurajfragrances[.]com/mu/ hxxps://videfi[.]org/oai/ hxxps://psp-news[.]org/som/ hxxps://timewiseconsulting[.]co[.]uk/lae/ hxxps://cearabomconforto[.]com[.]br/idt/ hxxps://totaltaxi[.]net[.]br/li/ hxxps://arqsustancial[.]com[.]ar/er/ hxxps://suad[.]group/orr/ hxxps://growontech[.]com/ait/ hxxps://lycosnutrients[.]com[.]ng/osr/ hxxps://omegaservices[.]fr/ia/ hxxps://celebtribune[.]com/ucii/ hxxps://htulyb[.]com/hi/ hxxps://clubhousefinancialgroup[.]com/aiqu/ hxxps://travel2deals[.]com/me/ hxxps://lecabine[.]com[.]mx/moe/ hxxps://ecofloorcorp[.]com/uicm/ hxxps://jelitamultimedia[.]com/sda/ hxxps://getacfo[.]com[.]au/iuoq/ hxxps://cctvsecuritycamerapros[.]com/mo/ hxxps://codelimd[.]com/ta/ hxxps://simplimoney[.]co[.]in/iqe/ hxxps://growrewardcard[.]com/ue/ hxxps://flynas-sudan[.]com/man/ hxxps://hfd[.]com[.]tr/qs/ hxxps://cannamed[.]org[.]za/otas/ hxxps://theprimacare[.]in/romo/ hxxps://wholechildren[.]org/vpvt/ hxxps://strongkapten[.]xyz/su/ hxxps://clautedomex[.]mx/masm/ hxxps://jextoban[.]com/ru/ hxxps://multiversooracular[.]com[.]br/qal/ hxxps://deepayan[.]org/am/ hxxps://strongbooster[.]xyz/cutu/ hxxps://best4you[.]live/tipd/ hxxps://infocuankerajaan[.]xyz/ch/ hxxps://bornomalaschool[.]org/tp/ hxxps://sabiaempresaa[.]com[.]co/oai/ hxxps://pclap[.]com[.]mx/roi/ hxxps://yaseenahmed[.]com/eo/ hxxps://inavco[.]com/ele/ hxxps://vallartaconcierges[.]com/oe/ hxxps://bluskyglobal[.]com/tir/ hxxps://suestanley[.]com/riao/ hxxps://ahmetaltinok[.]av[.]tr/uaq/ hxxps://petittool[.]com/qt/ hxxps://unrealpcs[.]com[.]au/up/ hxxps://acs-maroc[.]org/uera/ hxxps://tepor[.]it/lord/ hxxps://gentlemanstore[.]cl/omei/ hxxps://ruttiks[.]com/se/ hxxps://expertcol[.]com[.]co/scnu/ hxxps://chekodi[.]com/qsuu/ hxxps://ourlunchclub[.]com/mei/ hxxps://onlygist[.]com[.]ng/adi/ hxxps://institutonuevapompeya[.]com/tvsi/ hxxps://airesdemoscatel[.]com/nfu/ hxxps://sykmm[.]com/tsia/ hxxps://reeseschoolofinsurance[.]com/tt/ hxxps://portalbola168[.]com/sie/ hxxps://maxsolution[.]in/teo/ hxxps://vigsecol[.]com/ti/ hxxps://butgeneraltrading[.]com/guni/ hxxps://futurefibered[.]com/iee/ hxxps://microtrimsltd[.]com[.]bd/ua/ hxxps://apuntotelecom[.]com/auiu/ hxxps://ayturk[.]world/svim/ hxxps://dominoqq401[.]com/ses/ hxxps://normacsales[.]com/aa/ hxxps://srcdevelop[.]com/ba/ hxxps://cceco[.]org/ova/ hxxps://simontradingrdc[.]com/sio/ hxxps://policytv[.]com[.]ng/fioi/ hxxps://thanhlapweb[.]com/teut/ hxxps://taskole[.]com/amsa/ hxxps://celebranteclovisespinosa[.]com[.]br/teet/ hxxps://tanukuinfo[.]com/met/ hxxps://compunetplc[.]com/tiu/ hxxps://dessur[.]mx/rmiu/ hxxps://maestheticsclinic[.]com/ued/ hxxps://powermustangclub[.]cl/rdpr/ hxxps://geocentric[.]co[.]in/us/ hxxps://thejojostores[.]com/tau/ hxxps://bhalmaskin[.]com/me/ hxxps://vawmax[.]com/it/ hxxps://girocopterobrasil[.]com[.]br/or/ hxxps://sandiamagazine[.]com/sn/ hxxps://91mobiles[.]site/fnf/ hxxps://stronggila[.]xyz/gm/ hxxps://waterproofingexperts[.]pk/iam/ hxxps://ijeuwa[.]com/aqii/ hxxps://adone[.]in/uiqi/ hxxps://centralautomotrizrosas[.]co/nl/ hxxps://pizza10delivery[.]com[.]br/ch/ hxxps://sisidb[.]co[.]uk/qama/ hxxps://playfairltd[.]info/etut/ hxxps://agatino[.]net/amre/ hxxps://etereo[.]in/tqum/ hxxps://cdan[.]gov[.]co/toro/ hxxps://rocknetwork[.]org/aao/ hxxps://califholdings[.]com/es/ hxxps://asperiabd[.]com/sodu/ hxxps://datahunter[.]mx/tsu/ hxxps://kelidsazan[.]com/iutq/ hxxps://flaviopavim[.]com[.]br/faux/ hxxps://soiti[.]com[.]co/eii/ hxxps://mnfservice[.]com[.]my/aan/ hxxps://miracle-manufacturing[.]com/slui/ hxxps://livetectelecom[.]com[.]br/prqu/ hxxps://goalintense[.]com[.]ng/ueua/ hxxps://strongsuper[.]xyz/tcta/ hxxps://somosmejortv[.]com/ui/ hxxps://dalaibeauty[.]com/tie/ hxxps://watchsports[.]wine/ol/ hxxps://alriyada[.]edu[.]sa/qui/ hxxps://siliconsquad[.]in/mru/ hxxps://smechannels[.]com/nel/ hxxps://supereconomias[.]com/uur/ hxxps://agromusala[.]ba/itlu/ hxxps://sharethatbiz[.]com/gait/ hxxps://mohasanteck[.]com/rhu/ hxxps://astrologia[.]com[.]co/aius/ hxxps://ipminc[.]ca/dl/ hxxps://raadsolution[.]site/em/ hxxps://depositomh[.]com/si/ hxxps://llumarsaudi[.]com/rer/ hxxps://formalsports[.]com/pcal/ hxxps://jibaleysolution[.]com/it/ hxxps://kosamcindustrieslimited[.]com[.]ng/ieas/ hxxps://athenas[.]com[.]pe/ient/ hxxps://westcommerce[.]com[.]br/he/ hxxps://hys[.]com[.]co/iaea/ hxxps://hypospray[.]com/eosd/ hxxps://megalista[.]com[.]br/eqs/ hxxps://nstqb[.]org/sott/ hxxps://platformintl[.]pk/on/ hxxps://medcenter[.]app[.]br/uhn/ hxxps://breederexports[.]com/sda/ hxxps://superanunciosweb[.]com/as/ hxxps://travelimages[.]com[.]br/iqa/ hxxps://conscienciayvibracion369[.]com/ql/ hxxps://insanmadanijambi[.]org/xms/ hxxps://ai4fs[.]com[.]ng/umqu/ hxxps://hoteljimmybd[.]com/qm/ hxxps://makemoney[.]bond/ag/ hxxps://hiremeclean[.]com/vi/ hxxps://bolhf[.]org/ae/ hxxps://avemariacare[.]com/uamr/ hxxps://hbionline[.]live/ed/ hxxps://nativafmtubarao[.]com/nu/ hxxps://iqsoftwebsystems[.]com/vl/ hxxps://imperiocreativo[.]com[.]mx/aqi/ hxxps://sorvss[.]org[.]rs/pt/ hxxps://madeinbots[.]com/ioa/ hxxps://vivekwp[.]com/vas/ hxxps://abundarma[.]com/te/ hxxps://kobena[.]com[.]my/ie/ hxxps://malikironstore[.]com/te/ hxxps://omalworldwide[.]com/lidn/ hxxps://hlcombustibles[.]com/taee/ hxxps://clyeducation[.]com/itai/ hxxps://gyngojuice[.]com/unmn/ hxxps://imperatizdaconcertina[.]com[.]br/oose/ hxxps://bestpricesa[.]com/ds/ hxxps://donhallsprimerib[.]com/eld/ hxxps://locatemee[.]com/oon/ hxxps://propertystock[.]co[.]in/ins/ hxxps://existay[.]com/iu/ hxxps://claseco[.]com/ifta/ hxxps://bittraderfx[.]com/op/ hxxps://redperifericaaqp[.]gob[.]pe/merr/ hxxps://ajkerbaazar[.]com/outs/ hxxps://fxareba[.]com/dal/ hxxps://sms-my[.]com/ea/ hxxps://suppliededucation[.]co[.]uk/gat/ hxxps://photonupstudio[.]com/euq/ hxxps://quikstationsa[.]com/ss/ hxxps://myhairven[.]com/hnun/ hxxps://industriastornometaljr[.]com/eu/ hxxps://transportescsc[.]com/ai/ hxxps://compuhost[.]org/uqa/ hxxps://unimerfertilizzanti[.]it/ste/ hxxps://primlypremiumsolutions[.]com[.]ng/ia/ hxxps://aygun-digital[.]com[.]bo/tt/ hxxps://melinternationalschool[.]co[.]za/or/ hxxps://nasa2000[.]com[.]mx/rnt/ hxxps://xirconhomes[.]com[.]au/ta/ hxxps://premiumwellpro[.]com/ce/ hxxps://petraacademy[.]com[.]ng/fi/ hxxps://muilee[.]com[.]my/met/ hxxps://deangelisfilmes[.]com[.]br/aqui/ hxxps://colegiostellamaris[.]cl/nuui/ hxxps://eletroportseg[.]com[.]br/se/ hxxps://onlinejournalism[.]pk/dlr/ hxxps://finesseplates[.]co[.]uk/tcus/ hxxps://hpiflogistics[.]com/acq/ hxxps://glaretech[.]net/qai/ hxxps://kambohsoftec[.]com/aoou/ hxxps://closebit[.]com/fa/ hxxps://tyg[.]cl/iqsu/ hxxps://jagobulletin[.]com/cp/ hxxps://nazibmahfuz[.]com/vtoc/ hxxps://mahmoodsadeghi13[.]com/la/ hxxps://ctep[.]edu[.]co/etc/ hxxps://herbalspoon[.]com/otds/ hxxps://empowermobility[.]com[.]au/mnn/ hxxps://getimmobilier[.]com/ai/ hxxps://waterproofing24[.]pk/escr/ hxxps://carvan[.]app/texm/ hxxps://therealrealtor[.]lk/ut/ hxxps://sacfyf[.]com[.]mx/lig/ hxxps://pastelerosentrerios[.]com[.]ar/toe/ hxxps://helpuc[.]org/ilve/ hxxps://certucheabogados[.]com/osi/ hxxps://adimogi[.]com[.]br/oidn/ hxxps://ndonoenergy[.]com/seet/ hxxps://runnerspacegifts[.]com/iql/ hxxps://canvasfisd[.]info/aeui/ hxxps://wrightway[.]ae/eur/ hxxps://kapuas88livescore[.]com/ram/ hxxps://chasedigitalllc[.]com/rapq/ hxxps://centraldistrict[.]ro/opi/ hxxps://efhamcomputer[.]com/qae/ hxxps://teuwebsite[.]com/fs/ hxxps://loanbtc[.]org/rut/ hxxps://tatthopunzo[.]com/mop/ hxxps://aranytrade[.]com/teet/ hxxps://value-studio[.]com/tirv/ hxxps://pakistan1[.]tv/sau/ hxxp://prestige-castom[.]com:2351/hnbidn hxxp://prestige-castom[.]com:2351/dflqow hxxps://iconaatamaker[.]in/oruc/ hxxps://thefortivpn[.]com/1[.]php |
DarkGate |
| URL | hxxps://api[.]telegram[.]org/bot6356895858:AAHmcm_akjP0cvCFDNWqZ-6D8aFLszf0BKU/sendMessage?chat_id=5262627523 | Snake Keylogger |
| URL | hxxp://45[.]79[.]191[.]142/exp/general[.]docx hxxp://45[.]79[.]191[.]142/exp/screen[.]scr hxxp://45[.]79[.]191[.]142/exp/X0[.]x0[.]x0[.]x0[.]doc |
LokiBot |
| URL | hxxp://mkstat227[.]xyz/777/mtxtBVT[.]exe | Phobos |
| URL | hxxps://discord[.]com/api/webhooks/1115957523032318044/mGxbpCYnP4RV2GG-pwDh863-_wBVcHMZ3equQyiqt-XHXh1DZvd0YqcfBF9oNobCkjdG | Umbral |
| URL | hxxp://allcentrlizeqweq[.]fun/api hxxp://oxygendwelli[.]fun/api hxxp://171[.]22[.]28[.]212/12/carryspend[.]exe hxxp://171[.]22[.]28[.]212/carryspend[.]exe hxxp://171[.]22[.]28[.]212/12/sufferdemand[.]exe hxxp://peersneaps[.]fun/api |
Lumma Stealer |
| URL | hxxp://82[.]147[.]84[.]248:8000/1[.]exe | RedLine Stealer |
| URL | hxxp://35[.]230[.]66[.]101/hydro[.]arm7 hxxp://93[.]123[.]85[.]14/snype[.]arm5 hxxp://93[.]123[.]85[.]14/snype[.]mpsl hxxp://93[.]123[.]85[.]14/snype[.]sparc hxxp://93[.]123[.]85[.]14/snype[.]mips hxxp://93[.]123[.]85[.]14/snype[.]arm6 hxxp://93[.]123[.]85[.]14/snype[.]arm4 hxxp://93[.]123[.]85[.]14/snype[.]x86 hxxp://93[.]123[.]85[.]14/snype[.]ppc |
Bashlite |
| URL | hxxp://213[.]232[.]114[.]116/cngd[.]exe | Raccoon |
| URL | hxxp://213[.]232[.]114[.]116/gncd[.]exe | RecordBreaker |
