不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/10/23
※2023/10/23 更新
マルウェア感染させると考えられるURLを検知（2023/10/23）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]129[.]14[.]83/fra[.]exe hxxp://45[.]129[.]14[.]83/ca[.]exe hxxps://novostiua[.]info/download/talde[.]exe hxxps://novostiua[.]info/talde[.]exe hxxp://81[.]161[.]229[.]93/fra[.]exe hxxp://81[.]161[.]229[.]93/ca[.]exe |
RedLine Stealer |
| URL | hxxp://104[.]194[.]128[.]170/svp/Hfxbflp[.]mp3 hxxp://104[.]194[.]128[.]170/svp/Enwpk[.]vdf |
PureCrypter |
| URL | hxxp://novostiua[.]io/bin/ws[.]exe hxxps://dubovoy[.]news/bin/ws[.]exe hxxps://remisat[.]com[.]uy/file/Tmceezlu[.]vdf hxxps://remisat[.]com[.]uy/file/Aviso%20de%20Pago_Banco%20BCP_Pdf[.]exe hxxps://api[.]telegram[.]org/bot6564962941:AAEWWFBvCJUfh4ZCVgXTE-QUYajcwLUCJU0/ hxxp://193[.]42[.]33[.]51/nix[.]txt hxxps://discord[.]com/api/webhooks/1163635718619398266/ERgskT5TUXRNuShSRL2IvgFmKByhDpJq120n5CTgjbTr3SRCaO97e0VU84C5dq-joTCS hxxps://vlasti[.]info/go/Audiosvr[.]exe hxxps://cdn[.]discordapp[.]com/attachments/1105731107867082817/1164662477942951966/ENQUIRY[.]zip hxxp://185[.]254[.]37[.]174/carstorebase644[.]txt hxxps://api[.]telegram[.]org/bot6379133890:AAGJOuhiVuDuvd6ZHHUAJ-h8KtZWJyxx3IY/ hxxps://api[.]telegram[.]org/bot6484918824:AAFOMUpr_dOtXFQpytr-SPaCddTWJ5LWf4I/ hxxps://discord[.]com/api/webhooks/1159280255119413409/OIqP2mSnppduKZmA2SrGwd6G_KnViZGlCVXwjMF3yE6fUJ6AthXz8txLYbQuMqz48Gvp hxxps://api[.]telegram[.]org/bot6566142526:AAEoHmc4Px4_G_seqJ1wlvgja20rNm-3iUQ/ hxxp://193[.]42[.]33[.]51/nicko[.]vbs hxxps://kenesrakishev[.]net/wp-admin/admin-ajax[.]php hxxp://94[.]156[.]253[.]236/adyfriday[.]vbs hxxp://94[.]156[.]253[.]236/HTMLcvdesiii[.]dOC |
Agent Tesla |
| URL | hxxps://02w65ijjohr1frm[.]com/lander/edge_1695214167/_index[.]php hxxps://frex[.]result[.]garrettcountygranfondo[.]org/editContent hxxps://ggu[.]result[.]garrettcountygranfondo[.]org/editContent hxxps://vzx[.]result[.]garrettcountygranfondo[.]org/editContent hxxps://uimx[.]result[.]garrettcountygranfondo[.]org/editContent hxxps://jau[.]result[.]garrettcountygranfondo[.]org/editContent |
FAKEUPDATES |
| URL | hxxp://193[.]42[.]33[.]7/mbSDvj3/index[.]php hxxp://109[.]107[.]182[.]2/race/bus50[.]exe |
Amadey |
| URL | hxxp://hacker[.]548848[.]xyz/shareu[.]exe hxxp://hacker[.]548848[.]xyz/shareu_2[.]exe |
Quasar RAT |
| URL | hxxps://arm-cc[.]com/msedge[.]exe | AsyncRAT |
| URL | hxxp://mxzexlog95[.]xyz/777/mtxALAm[.]exe | Phobos |
| URL | hxxps://eblaguwonmir[.]cfd/A/V/A/c/h/e/t/o/r/e/h/Khone/app[.]apk hxxp://kameltarinyek[.]monster/F/O/N/SAHAM-edalat/app[.]apk hxxps://salamkhb[.]s70[.]xyz/Fon/requests[.]php hxxps://salamkhb[.]s70[.]xyz/Fon/contact[.]php hxxps://salamkhb[.]s70[.]xyz/Fon/sms[.]php?result=ok&action=upload&androidid= hxxps://salamkhb[.]s70[.]xyz/Fon/sms[.]php hxxps://salamkhb[.]s70[.]xyz/FoncFileOverrides= hxxps://salamkhb[.]s70[.]xyz/FoncFileOverrides hxxps://salamkhb[.]s70[.]xyz/Fonc hxxps://salamkhb[.]s70[.]xyz/Fon/id[.]txt hxxps://salamkhb[.]s70[.]xyz/Mr/contact[.]php hxxps://salamkhb[.]s70[.]xyz/Mr/sms[.]php hxxps://salamkhb[.]s70[.]xyz/Mr/contact[.]php?result=ok&action=upload&androidid= hxxps://salamkhb[.]s70[.]xyz/Mr/id[.]txt hxxps://salamkhb[.]s70[.]xyz/MrcFileOverrides= hxxps://salamkhb[.]s70[.]xyz/MrcFileOverrides hxxps://salamkhb[.]s70[.]xyz/Mr/requests[.]php hxxps://salamkhb[.]s70[.]xyz/Mrc hxxps://salamkhb[.]s70[.]xyz/Mr/sms[.]php?result=ok&action=upload&androidid= hxxps://sxsigami2021[.]cf/matin/web[.]txt hxxps://sxsigami2021[.]cf/matin/log[.]php hxxps://sxsigami2021[.]cf/sal/ hxxps://sxsigami2021[.]cf/sal/log[.]php hxxps://sxsigami2021[.]cf/sal/web[.]txt hxxps://sxsigami2021[.]cf/may/ hxxps://sxsigami2021[.]cf/may/log[.]php hxxps://sxsigami2021[.]cf/may/web[.]txt hxxps://sxsigami2021[.]cf/evil/web[.]txt hxxps://sxsigami2021[.]cf/evil/log[.]php hxxps://tedalat[.]hair/arsLan hxxps://tedalat[.]hair/arsLan/phone[.]txt hxxps://tedalat[.]hair/arsLan/log[.]php hxxps://adlriran[.]com/Edalathamrah[.]apk |
IRATA |
| URL | hxxp://hacker[.]548848[.]xyz/wechatservice[.]apk | SpyNote |
| URL | hxxps://hwthurmann[.]de/wp/chromium/LauncherChromium[.]zip hxxps://thiago-medeiros[.]com/engine/ChromiumBrowser[.]zip hxxp://45[.]61[.]128[.]156/PeaceInstructionovs[.]zip hxxps://vollfisioterapia[.]com[.]br/wp-content/browser/EngineChromium[.]zip hxxp://217[.]196[.]96[.]217/svchost[.]exe hxxps://borbrbmrtxtrbxrq[.]site/lander/chrome/_index[.]php hxxps://ojhggnfbcy62[.]com/lander/firefox_1695214415/_index[.]php hxxps://omdowqind[.]site/ZgbN19Mx hxxps://komomjinndqndqwf[.]store/ZgbN19Mx hxxps://wffewiuofegwumzowefmgwezfzew[.]site/ZgbN19Mx hxxps://adqdqqewqewplzoqmzq[.]site/ZgbN19Mx hxxps://wnimodmoiejn[.]site/ZgbN19Mx hxxps://ioiubby73b1n[.]com/ZgbN19Mx hxxps://weomfewnfnu[.]site/vvmd54/ hxxps://oiqwbuwbwqznjqsdfsfqhf[.]site/vvmd54/ hxxps://komomjinndqndqwf[.]store/vvmd54/ hxxps://borbrbmrtxtrbxrq[.]site/vvmd54 hxxps://borbrbmrtxtrbxrq[.]site/vvmd54/ hxxps://ewkekezmwzfevwvwvvmmmmmmwfwf[.]site/vvmd54/ hxxps://adqdqqewqewplzoqmzq[.]site/vvmd54 hxxps://reedx51mut[.]com/vvmd54 hxxps://oiouhvtybh291[.]com/vvmd54 hxxps://wsexdrcftgyy191[.]com/vvmd54 |
ClearFake |
| URL | hxxps://82[.]157[.]30[.]43:4433/ptj hxxp://165[.]227[.]141[.]64/match hxxp://121[.]40[.]66[.]171:85/pixel[.]gif hxxps://ts[.]ibuilder360[.]com/pixel[.]gif hxxps://39[.]100[.]83[.]53/api/3 hxxp://47[.]113[.]204[.]127:8020/fwlink hxxp://124[.]221[.]156[.]245/updates[.]rss hxxp://43[.]139[.]79[.]52:7777/dot[.]gif hxxps://121[.]40[.]66[.]171/load hxxp://47[.]94[.]221[.]227/ga[.]js hxxps://165[.]227[.]141[.]64:4433/match hxxp://wordstt182[.]com/develop/v5[.]10/M3HCONPDRLQ hxxps://45[.]130[.]147[.]26/c/msdownload/update/others/2022/03/29136388_ hxxps://101[.]34[.]204[.]38/__utm[.]gif hxxp://129[.]226[.]201[.]214:8080/ga[.]js hxxps://103[.]70[.]59[.]35/jquery-3[.]3[.]1[.]min[.]js hxxp://47[.]98[.]36[.]254/jquery-3[.]3[.]1[.]min[.]js hxxp://129[.]226[.]92[.]29:81/pixel hxxp://150[.]158[.]139[.]244:4321/cm hxxp://43[.]137[.]51[.]122/cx hxxp://59[.]110[.]239[.]104/cx hxxp://120[.]79[.]64[.]164:8081/dpixel hxxp://43[.]138[.]30[.]109:9999/updates[.]rss hxxp://123[.]207[.]20[.]16:7777/ga[.]js hxxps://165[.]154[.]145[.]148/dot[.]gif hxxp://123[.]56[.]27[.]185:5555/match hxxp://45[.]152[.]67[.]31/push hxxp://39[.]107[.]107[.]245/fwlink hxxps://172[.]247[.]189[.]234:9443/Claim/v5[.]6/ZZ1QB9MLS hxxps://3[.]76[.]127[.]43/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://kscupdate[.]com/c/msdownload/update/others/2020/10/29136388_ hxxps://43[.]138[.]188[.]41:4443/fwlink hxxp://8[.]130[.]128[.]168:8099/cm hxxps://sebasticookhospital[.]org/wp-content/themes/am43-6/dist/records hxxps://cdn[.]microsolt[.]top:8443/wp-admin hxxp://123[.]56[.]27[.]185/ga[.]js hxxps://122[.]112[.]252[.]8/www/handle/doc hxxps://47[.]108[.]117[.]51:8443/img/sugbg_1762fe7[.]png hxxp://c[.]shpdzf[.]top/clemente/details hxxp://122[.]112[.]252[.]8/www/handle/doc hxxps://147[.]139[.]32[.]75/visit[.]js hxxp://120[.]79[.]64[.]164:8123/push hxxps://baltlifeapp[.]com/d_config hxxps://54[.]173[.]169[.]3/tab_home_active hxxp://39[.]105[.]201[.]3/cx hxxp://43[.]143[.]18[.]42:8080/cx hxxps://123[.]249[.]101[.]92/pixel hxxp://120[.]79[.]64[.]164:8090/ga[.]js hxxp://1[.]14[.]45[.]126/pixel hxxp://185[.]239[.]87[.]176/cx hxxp://43[.]136[.]98[.]30:8083/visit[.]js hxxp://43[.]137[.]51[.]122/ca hxxps://wordst7512[.]net/promote/v10[.]26/GMLZ7S5R7Z3 hxxps://198[.]12[.]71[.]104/mht_image/ hxxp://165[.]154[.]174[.]166/cx hxxp://139[.]224[.]188[.]139:50000/updates hxxp://216[.]250[.]96[.]223:8888/ca hxxp://185[.]225[.]74[.]128/compare/v1[.]44/VXK7P0GBE8 hxxp://49[.]232[.]22[.]171:1234/j[.]ad hxxp://116[.]205[.]177[.]123/activity hxxps://185[.]225[.]74[.]128/compare/v1[.]44/VXK7P0GBE8 hxxps://epsonupdate[.]uk/jquery-3[.]3[.]1[.]min[.]js hxxps://121[.]40[.]66[.]171/g[.]pixel hxxps://124[.]222[.]141[.]231:1443/pixel[.]gif hxxp://42[.]193[.]101[.]234/cm hxxp://123[.]207[.]213[.]191/fwlink hxxp://8[.]131[.]84[.]239:111/push hxxp://43[.]143[.]248[.]98:8099/j[.]ad hxxp://39[.]105[.]191[.]1:8080/updates[.]rss hxxp://45[.]120[.]9[.]35/load hxxp://124[.]222[.]141[.]231:8080/cx hxxps://139[.]224[.]188[.]139/updates hxxp://162[.]14[.]209[.]70:8000/ga[.]js hxxps://42[.]193[.]101[.]234/updates[.]rss hxxp://121[.]5[.]178[.]154/load hxxp://43[.]143[.]191[.]86/en_US/all[.]js hxxps://104[.]243[.]47[.]82/ca hxxp://5[.]101[.]0[.]241/push hxxp://5[.]101[.]0[.]241/load hxxp://121[.]40[.]66[.]171:85/ca hxxp://43[.]143[.]191[.]86/ptj hxxp://150[.]158[.]50[.]177:7779/ca hxxp://43[.]138[.]52[.]211/pages[.]jsp hxxp://8[.]130[.]64[.]49/ptj hxxp://121[.]5[.]178[.]154/ptj hxxps://121[.]40[.]66[.]171/pixel[.]gif hxxps://117[.]50[.]188[.]226/image/ hxxp://106[.]12[.]116[.]233:8009/pixel hxxp://43[.]136[.]101[.]223/activity hxxps://43[.]136[.]101[.]223/match hxxp://117[.]50[.]182[.]224/jquery-3[.]3[.]1[.]min[.]js hxxp://156[.]225[.]2[.]71:85/activity hxxp://85[.]209[.]11[.]206/activity hxxps://157[.]245[.]193[.]163/jquery-3[.]3[.]1[.]min[.]js hxxp://20[.]62[.]170[.]205/_/scs/mail-static/_/js/ hxxp://68[.]183[.]220[.]248/owa/ hxxps://117[.]50[.]182[.]224/jquery-3[.]3[.]1[.]min[.]js hxxp://101[.]37[.]20[.]206/g[.]pixel |
Cobalt Strike |
| URL | hxxp://88[.]99[.]46[.]168/runhb_rev[.]exe hxxps://www[.]thepuzzleshop[.]co[.]uk/js/spacer[.]gif hxxps://www[.]thepuzzleshop[.]co[.]uk/js/blank[.]html |
Vjw0rm |
| URL | hxxp://89[.]105[.]219[.]43/tFBvEAEoaootz106[.]bin hxxp://gleaming[.]cfd/chub[.]bin |
CloudEyE |
| URL | hxxp://mxzexlog95[.]xyz/777/skxIq6K[.]exe hxxp://zoptex375[.]xyz/777/skx3hHI[.]exe |
SystemBC |
| URL | hxxp://fresh1[.]ironoreprod[.]top/_errorpages/chungzx[.]exe hxxps://pasteio[.]com/raw/xCvecthUdXEH hxxps://pasteio[.]com/raw/x48IASCE9Ajt hxxp://greenrootslandscaping[.]ae/grl/255_Epwegnhbcni |
Remcos |
| URL | hxxps://api[.]telegram[.]org/bot6564714997:AAEB5Qyq9hSihv7iw6Fa5RV1VfNvFH6t4oU/sendMessage?chat_id=5328986207 hxxps://api[.]telegram[.]org/bot6243209595:AAGECSmdSqJiVZcdFoBvotoaKcKT9Lz5Gvw/sendMessage?chat_id=1070926352 hxxps://api[.]telegram[.]org/bot6454266704:AAGc7MbDFOw3VJ52r1hPLsjSZvjH8GUmylk/sendMessage?chat_id=1467583453 hxxps://api[.]telegram[.]org/bot6581815121:AAHhziZ2mQS5qcx02h_Vx6A5dDt8ehDjIWw/sendMessage?chat_id=5262627523 |
Snake Keylogger |
| URL | hxxp://gonberusha[.]fun/api hxxp://fenduqs[.]fun/api hxxp://bluesaks[.]fun/api hxxp://suprafox[.]fun/api hxxp://traillit[.]fun/api |
Lumma Stealer |
| URL | hxxps://ruskompromat[.]com/lua[.]exe hxxps://ruskompromat[.]com/css/meltdown[.]exe |
Arkei Stealer |
| URL | hxxp://46[.]17[.]104[.]60/8Bigloadmulti/PollWordpressimage/processorWordpress/Externalrequest7Process/wpJsImage/Downloads/0Vm/image_/Provider1image/Temporaryasync/packet/VoiddbEternalTest/5Mariadb5/4547/EternalImageTo_securetrafficDleprivateTemp[.]php hxxp://012315cm[.]n9shteam1[.]top/nyashsupport[.]php hxxp://304588cm[.]nyashnyash[.]top/nyashsupport[.]php hxxp://82[.]146[.]39[.]98/1request4/datalifeJsServerprocessor/Http/Public52/httpLocalDumpAuth/Protect4/centralprocess/TemptempTrack/5pipe/Server5/6dbvm8/Cpuupdate6/To/WordpressVideoProcessLine/Image2/proton/serverDatalifeProton/Localcentral[.]php hxxp://790199cm[.]nyashtyan[.]top/SecureserverflowerTrafficdatalifetemp[.]php hxxp://753139cl[.]nyashtop[.]top/PythonPhpPollProtectTrackcdnUploadsDownloads[.]php |
DCRat |
| URL | hxxp://77[.]91[.]97[.]146/6ccf1f8d6fe7b779/vcruntime140[.]dll hxxp://77[.]91[.]97[.]146/6ccf1f8d6fe7b779/sqlite3[.]dll hxxp://77[.]91[.]97[.]146/6ccf1f8d6fe7b779/mozglue[.]dll hxxp://77[.]91[.]97[.]146/6ccf1f8d6fe7b779/softokn3[.]dll hxxp://77[.]91[.]97[.]146/6ccf1f8d6fe7b779/nss3[.]dll hxxp://77[.]91[.]97[.]146/6ccf1f8d6fe7b779/msvcp140[.]dll hxxp://77[.]91[.]97[.]146/6ccf1f8d6fe7b779/freebl3[.]dll hxxp://193[.]233[.]232[.]98/098d08abcf2b586b/vcruntime140[.]dll hxxp://193[.]233[.]232[.]98/098d08abcf2b586b/msvcp140[.]dll hxxp://193[.]233[.]232[.]98/098d08abcf2b586b/softokn3[.]dll hxxp://193[.]233[.]232[.]98/098d08abcf2b586b/nss3[.]dll hxxp://193[.]233[.]232[.]98/098d08abcf2b586b/freebl3[.]dll hxxp://193[.]233[.]232[.]98/098d08abcf2b586b/mozglue[.]dll hxxp://193[.]233[.]232[.]98/098d08abcf2b586b/sqlite3[.]dll hxxp://193[.]233[.]232[.]98/1f1ba0e25ee80277[.]php hxxp://wyattsebastian[.]top/e9c345fc99a4e67e[.]php |
Stealc |
| URL | hxxp://175[.]107[.]0[.]119:35346/Mozi[.]m | Mozi |
| URL | hxxp://193[.]168[.]141[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://193[.]168[.]141[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://193[.]168[.]141[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://193[.]168[.]141[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://193[.]168[.]141[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://193[.]168[.]141[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://193[.]168[.]141[.]10/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://141[.]98[.]10[.]13/9k9/audiodgse[.]exe hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/finakolad2[.]1[.]exe |
Formbook |
| URL | hxxp://23[.]239[.]26[.]165/armv4l hxxp://23[.]239[.]26[.]165/i686 |
Bashlite |
| URL | hxxp://23[.]239[.]26[.]165/sparc hxxp://23[.]239[.]26[.]165/armv5l hxxp://23[.]239[.]26[.]165/armv6l hxxp://23[.]239[.]26[.]165/mips hxxp://23[.]239[.]26[.]165/x86 hxxp://23[.]239[.]26[.]165/mipsel hxxp://23[.]239[.]26[.]165/i586 hxxp://23[.]239[.]26[.]165/powerpc hxxp://23[.]239[.]26[.]165/sh4 |
QakBot |
| URL | hxxps://quangcaolcd[.]com/save[.]php hxxps://rbarcia[.]pt/save[.]php hxxps://reisebloggerwelt[.]de/save[.]php hxxps://restauracekup[.]cz/save[.]php hxxps://portugal[.]qolsys[.]com/news[.]php hxxps://radium-audio[.]com/save[.]php hxxps://rezetennisclub[.]fr/save[.]php hxxps://restaurangfolkparken[.]se/save[.]php hxxps://rechtsanwalt-wucherpfennig[.]de/save[.]php hxxps://reformasceibo[.]es/save[.]php hxxps://rencontrenationaledanse[.]fr/save[.]php hxxps://powerthruconsulting[.]com/news[.]php hxxps://rallysweden[.]com/save[.]php hxxps://quote[.]keydesignwebsites[.]com/save[.]php hxxps://pokojechancza[.]pl/news[.]php hxxps://pepelu-staging[.]01staging[.]site/news[.]php hxxps://pitt[.]com[.]br/news[.]php hxxps://path4hosts[.]com/news[.]php hxxps://pecatonicabeer[.]com/news[.]php hxxps://parencyivf[.]com/news[.]php hxxps://pasta-mania[.]it/news[.]php hxxps://palitaliawines[.]com/news[.]php hxxps://parentpipelineproject[.]org/news[.]php hxxps://orangeprint[.]pl/news[.]php hxxps://parafianieboczowy[.]pl/news[.]php hxxps://paragonprinting[.]co[.]uk/news[.]php hxxps://ouchi-work-mei[.]com/news[.]php hxxps://pacoprian[.]es/news[.]php hxxps://ringco[.]ir/save[.]php hxxps://ringkhodro[.]ir/save[.]php hxxps://rishish[.]com/save[.]php hxxps://rodrigofischer[.]com/save[.]php hxxps://running[.]hkcosmo[.]com/save[.]php hxxps://russondesign[.]com/save[.]php hxxps://rvonkruger[.]com[.]br/save[.]php hxxps://rz-menden[.]de/save[.]php hxxps://salarquitectura[.]es/save[.]php hxxps://salsadk[.]dk/save[.]php hxxps://sandbox[.]herzek[.]net/save[.]php hxxps://sato-transport[.]net/save[.]php hxxps://sbc[.]gold-ichiba[.]com/save[.]php hxxps://scheiff[.]eu/save[.]php hxxps://schoolreport[.]belperschool[.]co[.]uk/save[.]php hxxps://schroederdennis[.]de/save[.]php hxxps://schuitemaker[.]twentepc[.]nl/save[.]php hxxps://shodo[.]cosavostra[.]com/save[.]php hxxps://shop[.]roseofsharon[.]hk/save[.]php hxxps://racingclub-saintcernin[.]fr/save[.]php hxxps://railway[.]net[.]tw/save[.]php hxxps://ranmabooks[.]com/save[.]php hxxps://orsomedia[.]cosavostra[.]com/news[.]php |
GootLoader |
