不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/01/09
※2024/01/09 更新
マルウェア感染させると考えられるURLを検知（2024/01/09）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://137953cm[.]nyashtech[.]top/externalEternalVideosecureprocessservermulti[.]php hxxp://62[.]109[.]15[.]166/jspacket[.]php hxxp://276721cm[.]nyashtech[.]top/providertotemp[.]php hxxp://77[.]91[.]68[.]21/lend/ajajjajajaj[.]exe hxxp://185[.]103[.]101[.]0/Vm8Phpdatalife/7imageCentraldatalife/PhpLowLinuxgeneratorCdn[.]php hxxp://990489lm[.]nyashmyash[.]top/VmpipePythonlowProtectdefaultGeneratortraffic[.]php hxxp://77[.]83[.]173[.]248/Wordpress0low/Bigload/DefaultimageSql/Sql7/pollserverProtectDefaultsqlTraffictest[.]php hxxp://028874lm[.]nyashmyash[.]top/ServerLinuxTestWordpressPrivate[.]php hxxp://526775cm[.]nyashtech[.]top/eternallinejsPacketlowProtectsqlDbGeneratorCdn[.]php hxxp://045134cm[.]nyashtech[.]top/PhpjavascriptBaseWordpresstempDownloads[.]php hxxp://185[.]251[.]91[.]215/3Cdn/base5Securepublic/dle7sqlLine/1Video/php_/SqlDump/8pipePython/dumpTempTrafficexternal/Defaultjavascript0/externalimagevmRequestpolllowLongpollServercentral[.]php |
DCRat |
| URL | hxxp://159[.]69[.]156[.]219/fuckjewishpeople[.]sparc hxxp://93[.]123[.]85[.]88/a-r[.]m-7[.]RAZA hxxp://93[.]123[.]85[.]88/m-i[.]p-s[.]RAZA hxxp://93[.]123[.]85[.]88/m-p[.]s-l[.]RAZA hxxp://93[.]123[.]85[.]88/x-3[.]2-[.]RAZA hxxp://93[.]123[.]85[.]88/s-h[.]4-[.]RAZA hxxp://93[.]123[.]85[.]88/a-r[.]m-6[.]RAZA hxxp://93[.]123[.]85[.]88/a-r[.]m-5[.]RAZA hxxp://45[.]90[.]217[.]165/dss hxxp://45[.]90[.]217[.]165/mipsel hxxp://45[.]90[.]217[.]165/dc hxxp://45[.]90[.]217[.]165/i686 hxxp://45[.]90[.]217[.]165/x86 hxxp://45[.]90[.]217[.]165/586 hxxp://45[.]90[.]217[.]165/mips hxxp://45[.]90[.]217[.]165/co hxxp://45[.]90[.]217[.]165/arm61 hxxp://45[.]95[.]147[.]173/skid[.]arm6 hxxp://45[.]95[.]147[.]173/skid[.]sh4 hxxp://45[.]95[.]147[.]173/skid[.]m68k hxxp://45[.]90[.]217[.]165/m68k hxxp://45[.]90[.]217[.]165/ppc hxxp://45[.]90[.]217[.]165/sh4 hxxp://159[.]69[.]156[.]219/fuckjewishpeople[.]x86 hxxp://45[.]157[.]11[.]10/rus[.]mpsl hxxp://45[.]157[.]11[.]10/rus[.]arm7 hxxp://15[.]204[.]245[.]61/x86 hxxp://15[.]204[.]245[.]61/i586 hxxp://15[.]204[.]245[.]61/armv6l hxxp://15[.]204[.]245[.]61/armv4l hxxp://15[.]204[.]245[.]61/mips hxxp://15[.]204[.]245[.]61/mipsel hxxp://15[.]204[.]245[.]61/i686 hxxp://15[.]204[.]245[.]61/sh4 hxxp://15[.]204[.]245[.]61/powerpc hxxp://80[.]66[.]88[.]49/keksec[.]mips hxxp://45[.]157[.]11[.]10/rus[.]arm4 hxxp://159[.]69[.]156[.]219/fuckjewishpeople[.]mpsl hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangx86 hxxp://45[.]140[.]141[.]180/Demon[.]i686 hxxp://45[.]140[.]141[.]180/Demon[.]i586 hxxp://45[.]140[.]141[.]180/Demon[.]arm4 hxxp://45[.]140[.]141[.]180/Demon[.]arm5 hxxp://45[.]140[.]141[.]180/Demon[.]ppc hxxp://45[.]140[.]141[.]180/Demon[.]arm7 hxxp://45[.]140[.]141[.]180/Demon[.]sparc hxxp://45[.]140[.]141[.]180/Demon[.]m68k hxxp://45[.]140[.]141[.]180/Demon[.]arm6 hxxp://82[.]165[.]215[.]205/bins/mips hxxp://82[.]165[.]215[.]205/bins/sh4 hxxp://82[.]165[.]215[.]205/bins/m68k hxxp://45[.]140[.]141[.]180/Demon[.]mips hxxp://45[.]140[.]141[.]180/Demon[.]mpsl hxxp://45[.]140[.]141[.]180/Demon[.]sh4 hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangarmv4l hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangarmv6l hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangsh4 hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangsparc hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangi686 hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangpowerpc hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangi586 hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangmips hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangmipsel hxxp://45[.]131[.]108[.]210/NokiaRawPoweaOnTopGangGangarmv5l hxxp://80[.]66[.]88[.]49/tsuki[.]sh4 hxxp://176[.]97[.]210[.]240/bins/VRsh4 |
Bashlite |
| URL | hxxp://77[.]91[.]68[.]21/lend/YT[.]exe hxxp://77[.]91[.]68[.]21/lend/golden[.]exe hxxp://89[.]23[.]96[.]177/pdf/file[.]exe hxxp://91[.]92[.]251[.]179/exodus[.]exe hxxp://77[.]91[.]68[.]21/lend/legend[.]exe hxxp://77[.]91[.]68[.]21/lend/crypted1234[.]exe hxxp://77[.]91[.]68[.]21/lend/2024[.]exe hxxp://77[.]91[.]68[.]21/lend/cryptedgolden123[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]215[.]113[.]68/theme/Plugins/clip64[.]dll hxxp://185[.]215[.]113[.]68/theme/Plugins/cred64[.]dll hxxp://185[.]172[.]128[.]19/newbuild[.]exe hxxp://185[.]215[.]113[.]68/theme/index[.]php hxxp://185[.]215[.]113[.]68/theme/Login[.]php hxxp://rubyonthewal[.]xyz/g9jjjbnAdshZ/index[.]php |
Amadey |
| URL | hxxp://193[.]117[.]208[.]148:7800/7bnN3Shf4KLzpvKnlvobIgNqpSWNXCMQMVqyVSViS7vMVf1iAKbd2nCHvw3oPEvMCHZK-l4GsYtJANxJbyE5eZKBElDNR1ZWi_gAl7db hxxp://193[.]117[.]208[.]148:7800/-55P7pqBpQdijWOMB9Nd5w7x4wsLqUJqZS-N33VLPVJhDR2Aa4VA hxxp://193[.]117[.]208[.]148:7800/LKjfnzOJyXWM8I3x6a2B7ATw-f2d2825i0ecBaHZDzrJmkbJkwb5tYAjBKQllS7wpM3k8VC7GH5DI4vSMyAiPPF58p3DkYpjk5EgUslD229ERKm74SxjQBR2VQwTjG7cfJGw3JeJR80LACMmKx8KxzQPk hxxp://193[.]117[.]208[.]148:7800/-1qPSm49BTLNAswDqEY0qwcwi0RIaadZGgEFzd6732pPQK__p4QmW hxxp://193[.]117[.]208[.]148/Payload[.]exe hxxp://193[.]117[.]208[.]148/baseline[.]exe hxxp://193[.]117[.]208[.]148/baseline[.]zip |
Metasploit |
| URL | hxxp://104[.]243[.]44[.]136:666/fKOlQZO5rX4KYBIi[.]txt hxxp://104[.]243[.]44[.]136:666/g4[.]txt hxxp://104[.]243[.]44[.]136:666/donneforthedoxxtotheus[.]jpg hxxp://104[.]243[.]44[.]136:666/moh[.]jpg hxxp://185[.]81[.]157[.]142:222/mVyiIbwGS1q5DBX2[.]txt hxxps://api[.]telegram[.]org/bot6342313307:AAFKd4P2Qn-FrHlxYQr9imHCnOVc5Cl4eMI/sendMessage?chat_id=1059970907 hxxp://85[.]209[.]176[.]59/server/execution/WinDir[.]exe hxxps://textbin[.]net/raw/dbxah8sw1f hxxp://5[.]249[.]163[.]134:333/ClipP/GnylZIoVXpphFLE[.]jpg hxxp://5[.]249[.]163[.]134:333/dhcpsapi/DevicePairing[.]jpg hxxp://5[.]249[.]163[.]134:333/dhcpsapi/kyyfVcNqPAZsljgVAniIvESksBhh[.]txt hxxp://5[.]249[.]163[.]134:333/ClipP/rSkkGdEHSouyGxHFVBtLxxXuoSLUgLlbFNQOpD[.]txt |
AsyncRAT |
| URL | hxxp://77[.]91[.]68[.]21/lend/MRK[.]exe hxxp://77[.]91[.]68[.]21/lend/bakhtiar[.]exe hxxps://bufetesanchezabogados[.]com/correo/1/VoiceChangerAi[.]exe hxxps://tollactionancestorw[.]pw/api hxxps://realitysocialiolee[.]site/api hxxp://77[.]91[.]68[.]21/lend/bhgt79yuh[.]exe hxxp://77[.]91[.]68[.]21/lend/birge_two[.]exe hxxps://diagramfiremonkeyowwa[.]fun/api hxxps://cakecoldsplurgrewe[.]pw/api hxxps://soupinterestoe[.]fun/api hxxps://neighborhoodfeelsa[.]fun/api hxxps://dayfarrichjwclik[.]fun/api hxxps://ratefacilityframw[.]fun/api hxxp://77[.]91[.]68[.]21/lend/hvthvjgfr6tyghgdtrtyigkhvjggft[.]exe hxxps://evokenumberpottruckere[.]fun/api hxxps://goddirtybrilliancece[.]fun/api hxxps://revivalconflictgrippe[.]site/api |
Lumma Stealer |
| URL | hxxps://my-vidar[.]net/auth/login/ hxxps://my-odin[.]com/auth/login/ hxxps://egetfile[.]top/sellers/auth/login hxxps://testingversion[.]my-vidar[.]net/auth/login/ |
Vidar |
| URL | hxxp://77[.]91[.]68[.]21/mine/nocry[.]exe hxxp://77[.]91[.]68[.]21/lend/test3[.]exe hxxp://77[.]91[.]68[.]21/lend/movie[.]exe |
Rhadamanthys |
| URL | hxxp://77[.]91[.]68[.]21/lend/alex[.]exe hxxp://103[.]171[.]0[.]200/mrcheng/Qgkltuqpt[.]vdf hxxps://103[.]171[.]0[.]200/mrcheng/Nmszdiichnu[.]mp3 hxxps://103[.]171[.]0[.]200/mrcheng/Ogzgi[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Pqcdghctwi[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Mpsenzr[.]mp3 hxxps://103[.]171[.]0[.]200/mrcheng/Alucmon[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Ikfnlucrfeq[.]dat hxxp://103[.]171[.]0[.]200/mrcheng/Kzdzejqjq[.]mp4 hxxps://103[.]171[.]0[.]200/mrcheng/Qfvxqoncr[.]wav hxxp://103[.]171[.]0[.]200/mrcheng/Qjwhtxehdqw[.]mp3 hxxp://103[.]171[.]0[.]200/mrcheng/Qfvxqoncr[.]wav hxxp://103[.]171[.]0[.]200/mrcheng/Fmbidfqiew[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Qjwhtxehdqw[.]mp3 hxxp://103[.]171[.]0[.]200/mrcheng/Alucmon[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Hreelq[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Fmbidfqiew[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Sxkainlspoh[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Kzdzejqjq[.]mp4 hxxp://103[.]171[.]0[.]200/mrcheng/Mpsenzr[.]mp3 hxxp://103[.]171[.]0[.]200/mrcheng/Dxwxrelllvk[.]wav hxxp://103[.]171[.]0[.]200/mrcheng/Pqcdghctwi[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Dxwxrelllvk[.]wav hxxp://103[.]171[.]0[.]200/mrcheng/Ogzgi[.]wav hxxp://103[.]171[.]0[.]200/mrcheng/Fujgch[.]mp3 hxxp://103[.]171[.]0[.]200/mrcheng/Qwuhtbm[.]mp4 hxxp://103[.]171[.]0[.]200/mrcheng/Jystkgzqv[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Jystkgzqv[.]wav hxxp://103[.]171[.]0[.]200/mrcheng/Nmszdiichnu[.]mp3 hxxps://103[.]171[.]0[.]200/mrcheng/Wyfeklim[.]pdf hxxp://103[.]171[.]0[.]200/mrcheng/Eucjlrz[.]vdf hxxp://103[.]171[.]0[.]200/mrcheng/Hreelq[.]wav hxxps://103[.]171[.]0[.]200/mrcheng/Qwuhtbm[.]mp4 hxxps://103[.]171[.]0[.]200/mrcheng/Eucjlrz[.]vdf hxxps://103[.]171[.]0[.]200/mrcheng/Qgkltuqpt[.]vdf hxxp://103[.]171[.]0[.]200/mrcheng/Ikfnlucrfeq[.]dat hxxp://103[.]171[.]0[.]200/mrcheng/Sxkainlspoh[.]wav hxxp://103[.]171[.]0[.]200/mrcheng/Wyfeklim[.]pdf hxxps://103[.]171[.]0[.]200/mrcheng/Fujgch[.]mp3 hxxps://103[.]171[.]0[.]200/mrcheng/ hxxp://crypticgamings[.]com/Runtime[.]exe |
zgRAT |
| URL | hxxp://43[.]138[.]30[.]109:8888/pixel[.]gif hxxp://123[.]207[.]46[.]13:8081/pixel hxxps://43[.]136[.]84[.]234/api/x hxxps://194[.]116[.]191[.]52/apiv8/getStatus hxxps://110[.]42[.]213[.]232/cm hxxps://120[.]55[.]82[.]147/activity hxxps://ongmanibeimeihong[.]cdnaliyun[.]top/wp-admin hxxp://165[.]22[.]184[.]218/_ hxxp://103[.]164[.]81[.]74:8080/push hxxp://47[.]108[.]175[.]149:6666/match hxxp://47[.]99[.]34[.]158:8080/IE9CompatViewList[.]xml hxxp://45[.]121[.]48[.]43/safebrowsing/rd/C1ktwIbHehcmdFEBAd2h12nW1-IOkU7h2 hxxp://152[.]32[.]210[.]127/cm hxxp://20[.]5[.]43[.]62/dot[.]gif hxxp://20[.]5[.]43[.]62/pixel hxxp://45[.]93[.]20[.]242/pixel[.]gif hxxp://152[.]136[.]128[.]162:12345/ca hxxps://www[.]xss[.]mba:10328/activity hxxp://locall[.]navybd-gov[.]info/jquery-3[.]3[.]1[.]min[.]js hxxp://79[.]124[.]40[.]106:82/ga[.]js hxxp://79[.]124[.]40[.]106:81/activity hxxps://188[.]166[.]214[.]231/__utm[.]gif hxxps://updataus[.]com/navigation hxxp://47[.]100[.]199[.]201/ca hxxp://23[.]95[.]197[.]194/push hxxp://47[.]109[.]102[.]98/en_US/all[.]js hxxp://16[.]171[.]112[.]33:8010/j[.]ad hxxp://165[.]154[.]132[.]129/IE9CompatViewList[.]xml hxxp://147[.]78[.]47[.]184:8092/load hxxp://ns[.]tqrjfru[.]cn/updates[.]rss hxxp://ns[.]tqrjfru[.]cn/IE9CompatViewList[.]xml hxxp://101[.]34[.]222[.]38:8081/pixel[.]gif hxxp://47[.]100[.]199[.]201/updates[.]rss hxxp://47[.]108[.]175[.]149:6666/ga[.]js hxxp://154[.]204[.]60[.]179/fwlink hxxp://updates[.]adobe-soft[.]net:8000/dot[.]gif hxxp://194[.]87[.]218[.]132/j[.]ad hxxps://164[.]90[.]169[.]184/dpixel hxxps://101[.]43[.]215[.]118/activity hxxps://124[.]221[.]178[.]17/match hxxps://d8g[.]lol:8443/api/3 hxxps://8[.]140[.]147[.]193/ptj hxxps://106[.]14[.]144[.]30:4433/ga[.]js hxxps://165[.]3[.]113[.]96/jquery-3[.]3[.]1[.]min[.]js hxxps://164[.]155[.]212[.]249:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://152[.]32[.]210[.]127/j[.]ad hxxps://erihudeg[.]com/Validate/Account/KDIKPCOYWU hxxps://8[.]142[.]117[.]162:8443/__utm[.]gif hxxps://47[.]109[.]102[.]98/dpixel hxxps://8[.]142[.]5[.]148/ca hxxps://47[.]112[.]137[.]119:8880/cx hxxps://metersphere[.]zenmen[.]cloud:8880/ga[.]js hxxps://www[.]goodljlagfhss[.]live:2096/owa/ hxxp://121[.]4[.]50[.]245:801/activity hxxps://120[.]27[.]148[.]91:8443/api/3 hxxps://service-oca34jj9-1257331363[.]sh[.]tencentapigw[.]com/api/x hxxps://47[.]112[.]137[.]119/dot[.]gif hxxps://111[.]231[.]22[.]61/activity hxxps://erihudeg[.]com:8080/Validate/Account/KDIKPCOYWU hxxps://39[.]107[.]242[.]130/updates hxxps://165[.]154[.]132[.]129/cx hxxps://194[.]87[.]218[.]132/dot[.]gif hxxp://4[.]194[.]41[.]34/match hxxps://120[.]55[.]82[.]147/ptj hxxp://47[.]90[.]247[.]182/updates[.]rss hxxp://47[.]100[.]199[.]201/visit[.]js hxxps://1[.]13[.]17[.]173:2020/IE9CompatViewList[.]xml hxxps://101[.]35[.]253[.]212:1443/g[.]pixel hxxp://147[.]78[.]47[.]184:8092/__utm[.]gif hxxps://101[.]43[.]127[.]45:8443/activity hxxps://helloone[.]accountants[.]monster:8443/users[.]jsp hxxp://43[.]138[.]30[.]109:8888/dpixel hxxp://79[.]124[.]40[.]106:82/j[.]ad hxxp://79[.]124[.]40[.]106:81/ca hxxps://101[.]43[.]30[.]194:8443/j[.]ad hxxps://locall[.]miragov[.]info/_/scs/mail-static/_/js/ hxxps://146[.]56[.]234[.]203/load hxxps://88[.]214[.]27[.]53:4443/updates[.]rss hxxps://107[.]172[.]16[.]172:8443/jquery-4[.]6[.]0[.]min[.]js hxxps://124[.]222[.]173[.]133:9443/cm hxxps://101[.]201[.]57[.]173/load hxxps://42[.]193[.]119[.]4/en_US/all[.]js hxxps://47[.]100[.]199[.]201:4443/updates[.]rss hxxp://52[.]226[.]247[.]32:2525/ptj hxxps://159[.]65[.]150[.]184/jquery-3[.]7[.]1[.]min[.]js hxxps://success[.]165gov[.]cyou:8443/wp06/wp-includes/po[.]php hxxp://120[.]27[.]212[.]14/pixel hxxps://107[.]175[.]247[.]197:4443/fwlink hxxps://143[.]198[.]101[.]149/jquery-3[.]3[.]1[.]min[.]js hxxps://8[.]134[.]80[.]227/jquery-3[.]3[.]1[.]min[.]js hxxps://47[.]110[.]253[.]157/push hxxps://199[.]195[.]252[.]200:9443/dpixel hxxps://1[.]94[.]67[.]222/load hxxps://cins[.]hin7lostvas[.]pro:8443/case[.]css hxxp://101[.]200[.]72[.]45:5432/updates[.]rss hxxps://47[.]99[.]151[.]68:4443/en_US/all[.]js hxxp://154[.]204[.]60[.]179:88/en_US/all[.]js hxxps://121[.]4[.]59[.]117:4443/cm hxxps://test[.]wiiooiij[.]tk:8443/api/3 hxxps://185[.]196[.]9[.]234:9443/dot[.]gif hxxps://124[.]223[.]64[.]88/pixel hxxps://116[.]198[.]11[.]22/visit[.]js hxxp://147[.]78[.]47[.]183:82/push hxxp://110[.]41[.]11[.]72/__utm[.]gif hxxps://123[.]249[.]101[.]92/pixel[.]gif hxxp://43[.]138[.]62[.]36:7001/ptj hxxps://sanjianke[.]icu/updates hxxp://74[.]235[.]187[.]46/async/newtab_ogb hxxps://147[.]139[.]32[.]75/g[.]pixel hxxps://www[.]xss[.]mba:10328/ga[.]js hxxps://74[.]235[.]187[.]46/async/newtab_ogb hxxps://36[.]99[.]39[.]121:55443/__utm[.]gif hxxps://192[.]144[.]220[.]12:55555/ca hxxps://20[.]49[.]255[.]240/secure[.]html hxxps://101[.]132[.]182[.]180:5111/visit[.]js hxxp://43[.]138[.]30[.]109:7524/match hxxps://121[.]37[.]206[.]148:2083/login[.]jsp hxxps://45[.]207[.]45[.]188/fwlink hxxp://161[.]35[.]186[.]154:8080/j[.]ad hxxps://85[.]208[.]109[.]15:4433/jquery-3[.]3[.]1[.]min[.]js hxxps://43[.]129[.]187[.]60/_/scs/mail-static/_/js/ hxxps://111[.]231[.]31[.]198/pixel hxxps://111[.]230[.]119[.]183/api/x |
Cobalt Strike |
| URL | hxxp://63[.]151[.]28[.]34[.]bc[.]googleusercontent[.]com/812800/advice@advice[.]com hxxp://0tuiwp[.]mariomanagement[.]biz[.]id/?39359152003632970 hxxp://0tuiwp[.]mariomanagement[.]biz[.]id/?42711059845628717 hxxp://0tuiwp[.]mariomanagement[.]biz[.]id/?48774310886678028 hxxp://0tuiwp[.]mariomanagement[.]biz[.]id/?77440781682613953 hxxp://0tuiwp[.]mariomanagement[.]biz[.]id/?31902432992639076 |
Astaroth |
| URL | hxxp://new-tech-savvy[.]com/1/podrobici[.]hta hxxp://new-tech-savvy[.]com/2/img2[.]hta hxxp://new-tech-savvy[.]com/2/img1[.]hta hxxp://new-tech-savvy[.]com/2/img3[.]hta hxxp://new-tech-savvy[.]com/2/img5[.]hta |
Remcos |
| URL | hxxps://pasteio[.]com/raw/x9VKXBr3lFx3 | NjRAT |
| URL | hxxp://esmic[.]at/tmp/ hxxp://reitaust[.]com/tmp/ hxxp://cittrans[.]ru/tmp/ hxxp://channelpi[.]com/tmp/ hxxp://piratia-life[.]ru/tmp/ hxxp://piratia[.]su/tmp/ hxxps://15[.]204[.]49[.]148/files/Had[.]exe hxxp://15[.]204[.]49[.]148/files/Had[.]exe |
SmokeLoader |
| URL | hxxps://194[.]33[.]191[.]206/M2I3ZWFjNjNhM2I5/ hxxps://xex2napggq[.]com/M2I3ZWFjNjNhM2I5/ hxxps://cccd1xzaza[.]com/M2I3ZWFjNjNhM2I5/ hxxps://vittixx2q[.]com/M2I3ZWFjNjNhM2I5/ hxxps://sabaasbaor[.]com/M2I3ZWFjNjNhM2I5/ hxxps://176[.]113[.]115[.]188/Nzg1YTc1N2RlNWQ4/ hxxps://91[.]92[.]242[.]212/Nzg1YTc1N2RlNWQ4/ hxxps://176[.]111[.]174[.]151/Y2NlMmYyMmYwMGI5/ hxxps://ghost23241312[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://ghost232412512[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://ghost232412312[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://epinciifirarda227[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://epinciifirarda27[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://epi2nciifirarda227[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://epinciifirarda237[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://epi3nciifirarda27[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://epi5nciifirarda237[.]xyz/Y2NlMmYyMmYwMGI5/ hxxps://pubettttg[.]top/M2EyOTM2M2FlY2My/ hxxps://pubeggggoa[.]top/M2EyOTM2M2FlY2My/ hxxps://pubetjokotg[.]top/M2EyOTM2M2FlY2My/ hxxps://gebasgao[.]shop/M2EyOTM2M2FlY2My/ hxxps://fexggohii[.]top/M2EyOTM2M2FlY2My/ hxxps://vukyggtou[.]top/M2EyOTM2M2FlY2My/ hxxps://c2c2adfff[.]com/OGY2YWU5OTM4OTQ3/ hxxps://g232ddxda[.]com/OGY2YWU5OTM4OTQ3/ hxxps://ebwaebaw23xx[.]com/OGY2YWU5OTM4OTQ3/ hxxps://verhovuh[.]top/ZTZkNTJjNTkwYzk3/ |
Coper |
| URL | hxxp://5[.]42[.]66[.]0/newrock[.]exe hxxp://185[.]172[.]128[.]19/latestbuild[.]exe hxxp://5[.]42[.]64[.]35/InstallSetup3[.]exe |
Stealc |
| URL | hxxps://api[.]telegram[.]org/bot6796626947:AAGohe-IHhj5LD7VpBLcRBukReMwBcOmiTo/sendDocument hxxp://91[.]92[.]253[.]245/ndexut[.]exe hxxps://discord[.]com/api/webhooks/1179754620189409280/cvGxRVK_PSI2O0lg_7WaqKbN5d7xo4hk02LOF1QlJexNT6csSiv2fJwBfFcsGuZBRqCm |
Agent Tesla |
| URL | hxxps://lcmk[.]scheme[.]corycabana[.]net/editContent hxxps://hpgbf[.]scheme[.]corycabana[.]net/editContent hxxps://yaz[.]scheme[.]corycabana[.]net/editContent hxxps://ebmw[.]scheme[.]corycabana[.]net/editContent hxxps://choosetotruck[.]com/cdn-vs/cache[.]php hxxps://choosetotruck[.]com/ewmrgqnaww[.]php?regtime= hxxps://choosetotruck[.]com/cache/letter[.]php?741074 hxxps://boxtechcompany[.]com/data[.]php?12617 hxxps://nowordshere[.]org/bjz1khVv |
FAKEUPDATES |
| URL | hxxp://47[.]236[.]140[.]86/s/twty[.]exe hxxp://47[.]236[.]140[.]86/s/ninet[.]exe hxxp://47[.]236[.]140[.]86/s/twtyoe[.]exe |
CloudEyE |
| URL | hxxp://91[.]92[.]251[.]179/2w[.]exe hxxp://91[.]92[.]251[.]179/1[.]exe |
Coinminer |
| URL | hxxp://144[.]48[.]8[.]28:789/123[.]exe | Nitol |
| URL | hxxp://prime[.]topendpower[.]top/_errorpages/ugopoundzx[.]exe | Formbook |
