不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/10/13
※2023/10/13 更新
マルウェア感染させると考えられるURLを検知（2023/10/13）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://mjh[.]layout[.]oystergardens[.]us/editContent hxxps://chromiumtxt[.]space/get[.]html hxxps://wxj[.]layout[.]oystergardens[.]us/editContent |
FAKEUPDATES |
| URL | hxxp://171[.]22[.]28[.]212/12/difficultspecificprores[.]exe hxxp://signalknockrio[.]site/api hxxp://teleportfilmona[.]online/api hxxp://paratositologis[.]fun/api hxxp://hovelpubtrav[.]fun/api hxxp://cystnovor[.]fun/api hxxp://80[.]66[.]87[.]148/6Image6/to5datalifeProcessor/secureDump/Dleimage8Downloads/externaleternalimageGametemporary[.]php |
Lumma Stealer |
| URL | hxxp://elijahdiego[.]top/e9c345fc99a4e67e[.]php hxxp://94[.]130[.]186[.]149/7cbe0291fb78f157[.]php |
Stealc |
| URL | hxxp://193[.]42[.]33[.]63/investorlokiiiiiiFile[.]vbs hxxp://79[.]110[.]48[.]52/bulaeko[.]vbs hxxp://193[.]42[.]33[.]63/invlokiwedFile[.]vbs hxxp://79[.]110[.]48[.]52/kenjkt[.]vbs hxxp://79[.]110[.]48[.]52/kenspa[.]vbs hxxp://185[.]225[.]74[.]170/looksoprettyundertheroof[.]vbs hxxp://193[.]42[.]33[.]63/droiddfffffffffffffFile[.]vbs hxxps://tempfiles[.]ninja/d/1qyrPpLcWzyUlixZ/DMkgboszm4eg0DuiObJi4mYehYGIic23 hxxp://107[.]173[.]4[.]18/170/sihost[.]exe hxxp://kenesrakishev[.]net/wp-admin/admin-ajax[.]php hxxp://107[.]175[.]3[.]22/wgw/2/x9[.]x9[.]x9[.]x0[.]x0[.]x0[.]doc hxxps://discordapp[.]com/api/webhooks/1151596988136181840/QdgulOKX9Onw_VaSQk6b3c5Sm7_Mt-0_huxqLUgO5ybBxQL_jiC6-2Afk2vAsJOZSANp hxxp://172[.]245[.]185[.]28/350/audiodgse[.]exe hxxps://api[.]telegram[.]org/bot6532792584:AAF2gNCjgvnMdQfbZisraSYsSaCcykFC78Y/ hxxp://185[.]225[.]74[.]170/tellmesomething[.]vbs |
Agent Tesla |
| URL | hxxps://grapemundo[.]com/Apk/cmb[.]js | WSHRAT |
| URL | hxxp://www[.]rakishevkenes[.]com/search/ws hxxp://www[.]rakishevkenes[.]com/ws/ws hxxp://www[.]rakishevkenes[.]com/bin/ws hxxp://www[.]rakishevkenes[.]com/ws hxxps://www[.]rakishevkenes[.]com/search/ws/ws |
SparkRAT |
| URL | hxxp://xemtex534[.]xyz/777/skxm24Y[.]exe | SystemBC |
| URL | hxxp://84[.]38[.]129[.]114/setup/ansi[.]exe | LokiBot |
| URL | hxxp://5[.]206[.]227[.]148/f2q2kke5aadloo4aasdjjjfirbmw/0xh0roxxnavebusyoo[.]arm7 hxxp://79[.]110[.]48[.]91/0xd00f[.]mpsl hxxp://79[.]110[.]48[.]91/0xd00f[.]mips |
Bashlite |
| URL | hxxp://185[.]225[.]74[.]144/files/random[.]exe hxxp://futotarsakse[.]hu/wp-includes/FZrjKWfvIqobIXGz65[.]bin hxxp://futotarsakse[.]hu/wp-includes/YsMAdKdD97[.]bin hxxp://futotarsakse[.]hu/wp-includes/ftyaipvicmmc/Ntahnjnqydj hxxp://futotarsakse[.]hu/wp-includes/KrfRKrA54[.]bin hxxp://futotarsakse[.]hu/wp-includes/lVtUqXA167[.]bin hxxp://futotarsakse[.]hu/wp-includes/bITiYiP240[.]bin hxxp://futotarsakse[.]hu/wp-includes/IKwgfSKuudeveYP77[.]bin hxxp://futotarsakse[.]hu/wp-includes/HznaPHhB148[.]bin |
CloudEyE |
| URL | hxxp://85[.]209[.]11[.]199/b9djs2g/index[.]php | Amadey |
| URL | hxxp://182[.]43[.]71[.]62:8888/ca hxxps://47[.]100[.]180[.]123:3004/include/template/isx[.]php hxxp://47[.]100[.]180[.]123:3003/include/template/isx[.]php hxxp://150[.]158[.]137[.]72:10010/fwlink hxxp://8[.]140[.]198[.]4/pixel[.]gif hxxps://114[.]132[.]76[.]158/g[.]pixel hxxp://124[.]221[.]76[.]197/dot[.]gif hxxps://www[.]siriusxm[.]online/gv hxxps://8[.]130[.]97[.]243/updates hxxps://cmtscbt[.]bsnl[.]wiki/Contact/termsofuse/ITU8UYG7 hxxp://111[.]229[.]142[.]238:88/api/x hxxp://144[.]34[.]167[.]87:2096/api/x hxxps://117[.]72[.]8[.]192/jquery-3[.]3[.]1[.]min[.]js hxxps://47[.]96[.]116[.]171:8080/match hxxps://1[.]117[.]176[.]254/IE9CompatViewList[.]xml hxxp://82[.]157[.]142[.]84:18081/qNFDjUI0pGiF6zu1/content-search[.]html hxxps://43[.]135[.]22[.]17:4443/ga[.]js hxxps://47[.]109[.]102[.]98/j[.]ad hxxp://121[.]5[.]64[.]8:4448/visit[.]js hxxp://45[.]79[.]99[.]161/fwlink |
Cobalt Strike |
| URL | hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/owenzx[.]exe | Formbook |
| URL | hxxp://xemtex534[.]xyz/777/mtx8hu9[.]exe | Phobos |
| URL | hxxps://karo[.]ca/nw/5p/khpz3x0b688 hxxps://brandworks[.]com[.]au/7e8/p1x/ylj2q8q86j5 hxxps://jonanna[.]com/vwp/1de/bgt1pgh8y9w hxxps://naughtycharlotte[.]com/0y/9v/l0c6v6gzr7b hxxps://cornerbakeryrestaurant[.]net/on7/9sr/np8am22g5zr7 |
IcedID |
| URL | hxxp://www[.]morin-fioul[.]com/processo/Informazioni[.]zip hxxp://www[.]morin-fioul[.]com/processo/Azienda[.]zip hxxp://www[.]morin-fioul[.]com/processo/Documenti[.]zip hxxp://www[.]morin-fioul[.]com/processo/Cliente[.]zip hxxp://www[.]morin-fioul[.]com/processo/Amministrazione[.]zip hxxp://sms[.]essmatrix[.]in/centro/ZTBkqrBEigSGkg hxxp://ercyazilim[.]com/centro/MSvZZEHkNvHEvDBf hxxp://202[.]28[.]69[.]138/centro/BSLiZTnMOCmLs |
Gozi |
| URL | hxxp://193[.]142[.]59[.]12/myblog/posts/191[.]exe | Cutwail |
| URL | hxxp://195[.]211[.]98[.]105/public/gffdgfdgfdg[.]msi hxxp://148[.]113[.]1[.]180:8080/HomeLingiang/Lingiang%20Cosmetic%20Campaign%202023[.]pdf[.]lnk hxxp://148[.]113[.]1[.]180:8080/HomeTMDT/ECOMMERCE%20PLATFORM%20AGREEMENT[.]pdf[.]lnk hxxp://148[.]113[.]1[.]180:8080/HomeCd/PRODUCTS%20-%20Sale%20Campains[.]pdf[.]lnk hxxp://148[.]113[.]1[.]180:8080/otoke[.]vbs hxxp://148[.]113[.]1[.]180:8080/TMDT[.]hta hxxp://148[.]113[.]1[.]180:8080/LG[.]hta hxxp://148[.]113[.]1[.]180:8080/CD[.]hta |
DarkGate |
