不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/10/12
※2023/10/12 更新
マルウェア感染させると考えられるURLを検知（2023/10/12）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://sempersim[.]su/a11/fre[.]php hxxps://sempersim[.]su/a11/fre[.]php hxxp://sempersim[.]su/a16/fre[.]php |
LokiBot |
| URL | hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/Olfumi[.]exe hxxp://172[.]245[.]185[.]28/280/audiodgse[.]exe hxxp://192[.]3[.]101[.]8/350/sihost[.]exe hxxp://193[.]42[.]33[.]91/obiii[.]txt hxxp://107[.]175[.]3[.]22/9w9/sihost[.]exe hxxp://185[.]225[.]74[.]170/blalalalalalalala[.]hta |
Agent Tesla |
| URL | hxxp://23[.]95[.]106[.]3/479/process[.]exe hxxp://23[.]95[.]106[.]3/479/qw/0iuoioooUIOIOiiiu0u0uioiui0iuiooi0i0u0%23%23%23%23%23%23%23%23%23%23%23%23%23%230iuI00UIuoioioU00I0uiuiuiuIUIUiuiu000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000[.]doc hxxp://23[.]95[.]106[.]3/479/qw/Ooseha[.]exe hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/macbomard2[.]1[.]exe hxxps://onedrive[.]live[.]com/download?resid=F6CFB1B6019B1562%21218&authkey=!AHjKZHpZnNv-3RA |
Formbook |
| URL | hxxps://mirazbakery[.]com/docs[.]php hxxps://motociclistagiapponese[.]com/docs[.]php hxxps://mps[.]rfstaging[.]co[.]uk/docs[.]php hxxps://mittnyahem[.]com/docs[.]php hxxps://mooreinsure[.]net/docs[.]php hxxps://moeve-schmelz[.]de/docs[.]php hxxps://mitgliederbereich[.]frederik-malsy[.]com/docs[.]php hxxps://mkbwindows[.]co[.]uk/docs[.]php hxxps://modatrends[.]nl/docs[.]php hxxps://mirabilismusic[.]net/docs[.]php hxxps://new[.]clovercars[.]net/docs[.]php hxxps://new[.]scratch-build[.]com/docs[.]php hxxps://nbconstructor[.]com/docs[.]php hxxps://nebo-trk[.]com/docs[.]php hxxps://netherlands[.]qolsys[.]com/docs[.]php hxxps://naniwa-ginzaaward[.]hisaki-design[.]com/docs[.]php hxxps://natrumax[.]com[.]vn/docs[.]php hxxps://myuoh[.]org/docs[.]php hxxps://nado[.]ca/docs[.]php hxxps://newireluck2[.]com/docs[.]php hxxps://newperspectivellc[.]com/docs[.]php hxxps://news[.]soxo[.]bet/docs[.]php hxxps://nextgenlead[.]org/docs[.]php |
GootLoader |
| URL | hxxp://185[.]225[.]74[.]144/files/Akh[.]exe hxxp://49[.]12[.]118[.]151:8000/images[.]zip hxxp://116[.]203[.]167[.]36/images[.]zip |
Vidar |
| URL | hxxp://tipsydulljaui[.]website/api hxxp://wakeupperion[.]site/api |
Lumma Stealer |
| URL | hxxp://sms[.]vbglimited[.]com/Amda[.]exe hxxps://justentertainer[.]us/5ea275[.]exe hxxp://enfantfoundation[.]com/amday[.]exe hxxp://portmarine[.]co[.]tz/5ea275[.]exe hxxp://77[.]91[.]68[.]52/fuza/sus[.]exe |
Amadey |
| URL | hxxp://moknex158[.]xyz/777/skxEpuM[.]exe | SystemBC |
| URL | hxxp://213[.]232[.]114[.]116/rengad[.]exe hxxp://93[.]185[.]166[.]154/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://93[.]185[.]166[.]154/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://93[.]185[.]166[.]154/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://93[.]185[.]166[.]154/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://93[.]185[.]166[.]154/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://93[.]185[.]166[.]154/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://93[.]185[.]166[.]154/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://dbxo[.]shop/PL341/index[.]php | Azorult |
| URL | hxxps://45[.]145[.]229[.]116/activity hxxps://103[.]145[.]107[.]213/__utm[.]gif hxxp://43[.]134[.]28[.]64:81/image/ hxxp://43[.]135[.]22[.]17:6667/pixel[.]gif hxxp://162[.]14[.]209[.]70:6666/en_US/all[.]js hxxp://206[.]238[.]42[.]198/updates[.]rss hxxp://39[.]107[.]113[.]250:8888/push hxxp://118[.]25[.]16[.]4:60030/api/3 hxxp://124[.]221[.]219[.]154:8888/ptj hxxp://162[.]14[.]209[.]70/pixel hxxps://106[.]14[.]141[.]187:8443/pixel hxxps://115[.]159[.]115[.]41/activity hxxps://165[.]227[.]141[.]64:4433/g[.]pixel hxxp://165[.]227[.]141[.]64/g[.]pixel hxxp://47[.]99[.]79[.]203/load hxxps://198[.]98[.]57[.]148/ga[.]js hxxps://194[.]26[.]29[.]99:9443/updates[.]rss hxxp://47[.]120[.]0[.]195/IE9CompatViewList[.]xml hxxp://110[.]40[.]195[.]32/ptj hxxp://198[.]98[.]57[.]148/dpixel hxxps://124[.]221[.]76[.]197/ga[.]js hxxp://154[.]204[.]60[.]102:81/image/ hxxp://1[.]117[.]176[.]254/cm hxxps://larrymarket[.]com/Dequeue/core/6BD5T1N8SRR5 hxxp://175[.]178[.]3[.]16/jquery-3[.]3[.]1[.]min[.]js hxxp://117[.]72[.]8[.]192/jquery-3[.]3[.]1[.]min[.]js |
Cobalt Strike |
| URL | hxxp://moknex158[.]xyz/777/mtxAm5W[.]exe hxxp://mktrex219[.]xyz/777/mtxsQWD[.]exe |
Phobos |
| URL | hxxp://eugelens[.]com:2351/idzktm hxxp://eugelens[.]com:2351/msiqpwucsyz |
DarkGate |
| URL | hxxps://gnavigatio[.]com/cdn-vs/minlen[.]php hxxps://gnavigatio[.]com/cache/qzwewmrqqgqnaww[.]php hxxps://dswhq[.]layout[.]oystergardens[.]us/editContent hxxps://dofza[.]layout[.]oystergardens[.]us/editContent hxxps://cra[.]layout[.]oystergardens[.]us/editContent |
FAKEUPDATES |
| URL | hxxps://documentos-cert[.]com/90[.]htm hxxp://18[.]118[.]199[.]163:353/sa[.]exe |
AsyncRAT |
| URL | hxxp://74[.]84[.]150[.]168/SBuQAJQiWxR152[.]bin hxxp://74[.]84[.]150[.]168/kEpQLt144[.]bin hxxp://74[.]84[.]150[.]168/mqlXMTFUJRF33[.]bin hxxp://74[.]84[.]150[.]168/DSlBWwGls6[.]bin hxxp://74[.]84[.]150[.]168/VggSxrgiR97[.]bin |
Remcos |
| URL | hxxp://103[.]72[.]68[.]128/M0910T/smss[.]exe hxxp://103[.]72[.]68[.]128/pcd/RhQWuWpqgx97[.]bin hxxp://103[.]72[.]68[.]128/pcd/wAYOlXAIjrMljL79[.]bin hxxp://103[.]72[.]68[.]128/pcd/ygcrnsVvq3[.]bin hxxp://103[.]72[.]68[.]128/pcd/saMXTtljy97[.]bin hxxp://185[.]255[.]114[.]16/qyGpdNrI144[.]bin hxxp://185[.]255[.]114[.]16/SbxZTWhYZFiaVflBFzSvO88[.]bin |
CloudEyE |
| URL | hxxps://api[.]telegram[.]org/bot6429805701:AAEngMg5r6ewcqgGwVjFKJpjYF7Sc8nwhxA/sendMessage?chat_id=5262627523 hxxps://api[.]telegram[.]org/bot6339928612:AAF--PH7Kfwf4Dph8taQxUsHJm3oLkMeciE/sendMessage?chat_id=5532763142 hxxps://api[.]telegram[.]org/bot6675876060:AAEydIMROdr0XsdBN7fk_mjJRQvyv_ectv4/sendMessage?chat_id=5262627523 |
Snake Keylogger |
| URL | hxxps://bax[.]eliyahost[.]ir/core/src/Revolution/File/saham/download/app[.]apk | IRATA |
| URL | hxxps://gestionhqse[.]com/qd/ hxxps://cornerbakeryrestaurant[.]net/s8/2zq1glerei2 |
IcedID |
