不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様9社 -
2023/11/29
※2023/11/29 更新
マルウェア感染させると考えられるURLを検知（2023/11/29）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://46[.]8[.]29[.]132/Dlepython/LongpollPacket/base/Low8voiddb/Uploads/Windows97/External50auth/defaultVmlongpollGame/Test/externaltracklongpoll/Datalife3multi/toGeneratorbigloadtemp/wordpressDownloads/MariadbHttpAuth/WordpressGamegeneratorDefault/_packetprocessDatalife[.]php hxxp://249782m[.]dccrk[.]top/vmpipelongpollBigloadSqlGeneratordatalife[.]php hxxp://767241cm[.]nyashland[.]top/TogeoProcessorgame[.]php |
DCRat |
| URL | hxxp://china[.]dhabigroup[.]top/_errorpages/maxziflowzx[.]exe hxxp://23[.]95[.]235[.]10/210/wlanext[.]exe hxxp://172[.]245[.]208[.]19/200/wlanext[.]exe |
Formbook |
| URL | hxxps://china[.]dhabigroup[.]top/_errorpages/samuelzx[.]exe hxxp://172[.]93[.]220[.]118/cNDZgRN239[.]bin hxxp://172[.]93[.]220[.]118/ifNmFBtX47[.]bin hxxp://172[.]93[.]220[.]118/tMQJLWGqVtJoTiz85[.]bin hxxp://172[.]93[.]220[.]118/qQamsWiByYpPbBe88[.]bin |
CloudEyE |
| URL | hxxps://www[.]transportesevaristomadero[.]com/mpscontent/mpcontetxzfkbxfzblzfxfzbxbfzvzdflvbsdfgsbcompser/mpscontents[.]exe | AsyncRAT |
| URL | hxxp://n-sanea[.]com/edur/ hxxps://kmcpokhara[.]edu[.]np/eo/ hxxps://grupomotobel[.]com[.]br/mti/ hxxp://seatapps[.]ma/pd/ hxxps://sameirotravel[.]com/su/ hxxps://esellbazar[.]com/pe/ hxxps://radiovivajuarez[.]com/emtu/ hxxps://cavaempaque[.]com/sedx/ hxxps://channeldistribution[.]net/evo/ hxxps://bossajazzbrasil[.]com/iii/ hxxps://crpao[.]ac[.]th/tade/ hxxps://ctherbal[.]com/qoul/ hxxps://books[.]ttc[.]edu[.]sg/leo/ hxxps://eighttimeseight[.]com/ah/ hxxps://caodangdaiviet[.]edu[.]vn/ros/ hxxps://drtemelkovski[.]mk/iu/ hxxps://defendamazon[.]com[.]br/et/ hxxps://djbaccess[.]co[.]uk/at/ hxxps://campovalepet[.]com[.]br/vqas/ hxxps://egocom[.]com[.]mx/eni/ hxxps://desdeelsentir[.]cl/sr/ hxxps://buildrs[.]com/vi/ hxxps://centralfinance[.]com[.]np/aiev/ |
IcedID |
| URL | hxxp://101[.]35[.]235[.]73:8888/load hxxp://20[.]97[.]19[.]69/jquery-3[.]3[.]1[.]min[.]js hxxps://64[.]225[.]108[.]159/owa/ hxxp://176[.]97[.]65[.]35/ptj hxxp://101[.]43[.]12[.]111:9999/en_US/all[.]js hxxp://106[.]54[.]181[.]10:808/push hxxp://43[.]249[.]9[.]208/cx hxxp://42[.]193[.]44[.]136/ga[.]js hxxp://47[.]113[.]204[.]90:8080/match hxxp://150[.]158[.]176[.]236:5555/load hxxp://8[.]137[.]48[.]121:8081/dot[.]gif hxxp://192[.]144[.]219[.]118/pixel[.]gif hxxp://124[.]71[.]5[.]199:6666/visit[.]js hxxp://8[.]134[.]161[.]181:4848/fwlink hxxp://43[.]143[.]125[.]110:8080/pixel[.]gif hxxp://47[.]113[.]218[.]234/g[.]pixel hxxp://47[.]108[.]175[.]149:4444/activity hxxp://47[.]236[.]13[.]182:8888/g[.]pixel hxxp://www[.]qzyp[.]buzz:2086/j[.]ad hxxps://149[.]104[.]23[.]199/__utm[.]gif hxxps://47[.]109[.]102[.]98/dot[.]gif hxxps://nutiensel[.]com/Dequeue/odbc/1VXDSW2OHJOE |
Cobalt Strike |
| URL | hxxp://zang1[.]almashreaq[.]top/_errorpages/szx[.]exe hxxp://146[.]70[.]35[.]211/setoff/kung[.]exe |
LokiBot |
| URL | hxxp://china[.]dhabigroup[.]top/_errorpages/mmtradezx[.]exe hxxp://193[.]26[.]115[.]83/mondaybrazillll[.]vbs hxxp://193[.]26[.]115[.]83/Microsoftdeletedentirehistorycachefromthepc[.]Doc hxxp://107[.]173[.]229[.]146/175/wlanext[.]exe hxxp://103[.]29[.]3[.]200/M2711T/wininit[.]exe hxxps://api[.]telegram[.]org/bot5168654140:AAE_I-CRa2apQXXWxhBTEaeIEr1Ln5pw69s/ hxxps://api[.]telegram[.]org/bot6471053992:AAFUlrUxhi5Jrpjikoc-P4r9ZbsXV_T9vj8/ hxxp://88[.]209[.]206[.]215/O[.]ini |
Agent Tesla |
| URL | hxxp://185[.]196[.]8[.]238/supstrim[.]exe hxxp://185[.]196[.]8[.]238/strim[.]exe hxxp://185[.]196[.]8[.]238/Klkypmnqw[.]exe |
zgRAT |
| URL | hxxp://45[.]125[.]57[.]96:8888/123[.]exe | Ghost RAT |
| URL | hxxps://alicortech[.]com/a3A7qLVn hxxps://alicortech[.]com/fEOV2v/ hxxps://concgc[.]com/lander/hyk7789hgd/_cf[.]php hxxps://concgc[.]com/a3A7qLVn hxxps://concgc[.]com/fEOV2v/ hxxps://beksystems[.]com/a3A7qLVn hxxps://beksystems[.]com/fEOV2v/ hxxps://doctorkiki[.]me/a3A7qLVn hxxps://doctorkiki[.]me/fEOV2v/ |
ClearFake |
| URL | hxxp://116[.]203[.]200[.]249/file/Booking_information[.]exe hxxp://159[.]69[.]145[.]188/file/pdf[.]exe |
RedLine Stealer |
| URL | hxxp://eraport[.]dfirma[.]pl/attivita/index[.]php | Remcos |
| URL | hxxp://222[.]135[.]221[.]130:42088/Mozi[.]m | Mozi |
| URL | hxxps://gobo30cl[.]top/build[.]exe hxxps://gons31cl[.]top/build[.]exe |
Vidar |
| URL | hxxp://phoenixexec[.]icu/2a7743b8bbd7e4a7/freebl3[.]dll hxxp://phoenixexec[.]icu/2a7743b8bbd7e4a7/sqlite3[.]dll hxxp://5[.]42[.]64[.]41/40d570f44e84a454[.]php |
Stealc |
| URL | hxxp://shohetrc[.]com/forum/Plugins/cred[.]dll hxxp://tceducn[.]com/forum/Plugins/clip[.]dll hxxp://tceducn[.]com/forum/Plugins/cred[.]dll hxxp://shohetrc[.]com/forum/Plugins/clip[.]dll hxxp://atozrental[.]cc/atoz/index[.]php |
Amadey |
| URL | hxxps://navai[.]sync[.]oystergardens[.]club/editContent | FAKEUPDATES |
| URL | hxxps://pl[.]mamutert[.]com/app[.]apk | IRATA |
