不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2024/01/11
※2024/01/11 更新
マルウェア感染させると考えられるURLを検知（2024/01/11）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://veal[.]scheme[.]corycabana[.]net/editContent hxxps://lewio[.]scheme[.]corycabana[.]net/editContent hxxps://dufhl[.]scheme[.]corycabana[.]net/editContent hxxps://jhvqt[.]scheme[.]corycabana[.]net/editContent hxxps://jngdf[.]scheme[.]corycabana[.]net/editContent |
FAKEUPDATES |
| URL | hxxp://146[.]0[.]41[.]68/index[.]php/s/nLfDcqpHXtkp5pZ/download/TrueCrypt_JfDCWj[.]exe hxxp://89[.]23[.]99[.]252/pdf/file[.]exe hxxp://77[.]91[.]68[.]21/lend/cryptedgolden123sss[.]exe hxxp://77[.]91[.]68[.]21/lend/cryptedpix12321[.]exe hxxp://77[.]91[.]68[.]21/lend/crypted214124[.]exe hxxp://77[.]91[.]68[.]21/lend/setuplll[.]exe |
RedLine Stealer |
| URL | hxxp://91[.]92[.]253[.]220/pic/2[.]exe hxxp://146[.]0[.]41[.]68/index[.]php/s/agR5Q8tFdxKsFE8/download/luma[.]exe hxxps://sideindexfollowragelrew[.]pw/api hxxp://77[.]105[.]166[.]156/files/c[.]exe hxxps://thisisinternet[.]pl/wtz/1/Voice_a[.]i_beta[.]exe hxxp://77[.]91[.]68[.]21/lend/125[.]exe hxxp://77[.]91[.]68[.]21/lend/cryptedggggg[.]exe hxxp://77[.]91[.]68[.]21/lend/legendaryinstalls[.]exe hxxp://77[.]91[.]68[.]21/lend/cryptedgoldqwesasd[.]exe |
Lumma Stealer |
| URL | hxxp://146[.]0[.]41[.]68/index[.]php/s/SYf6yWjEfn5BJ4K/download/Setup[.]exe hxxp://15[.]204[.]49[.]148/files/456[.]exe |
zgRAT |
| URL | hxxp://service-fkkrrv8q-1307850644[.]gz[.]tencentapigw[.]com/api/x hxxps://service-fkkrrv8q-1307850644[.]gz[.]tencentapigw[.]com/api/x hxxp://146[.]190[.]120[.]217:2369/QfDb hxxps://124[.]222[.]213[.]61/dpixel hxxps://60[.]204[.]249[.]156/dpixel hxxp://47[.]120[.]37[.]45:8081/load hxxp://119[.]3[.]175[.]203/j[.]ad hxxps://45[.]121[.]48[.]43/updates hxxps://157[.]245[.]158[.]14:8443/api/3 hxxp://39[.]104[.]20[.]145/ptj hxxps://service-2c8ubzu7-1257331363[.]sh[.]tencentapigw[.]com/api/x hxxps://164[.]90[.]169[.]184/en_US/all[.]js hxxps://120[.]55[.]82[.]147/updates[.]rss hxxp://162[.]14[.]107[.]218/match hxxps://107[.]175[.]247[.]197:4443/pixel[.]gif hxxp://47[.]116[.]17[.]169:5001/cm hxxp://79[.]124[.]40[.]106:82/load hxxp://79[.]124[.]40[.]106:81/updates[.]rss hxxp://176[.]32[.]38[.]205:8000/miwen[.]txt hxxp://43[.]138[.]111[.]120:7788/dpixel hxxp://139[.]9[.]93[.]128/match hxxp://123[.]207[.]45[.]112/IE9CompatViewList[.]xml hxxps://139[.]180[.]144[.]171:9443/c/msdownload/update/others/2021/63388[.]cab hxxps://cs[.]h1ll0[.]cs[.]in:4433/IE9CompatViewList[.]xml |
Cobalt Strike |
| URL | hxxps://fortbebidas[.]com[.]br/wp-content/uploads/aios/freas[.]exe hxxps://fortbebidas[.]com[.]br/wp-content/uploads/aios/PolsRatrader[.]zip hxxps://fortbebidas[.]com[.]br/wp-content/uploads/2024/01/ReactionCr[.]zip hxxps://fortbebidas[.]com[.]br/wp-content/uploads/2024/01/mref[.]exe |
NetSupportManager RAT |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1193768713506263092/1194166683103936592/Import_Payment_january-09-2024-230295_167KB_REF-EUROBOND_REF-2373YYRT[.]vbs hxxp://23[.]94[.]239[.]93/sgs/Microsoftdecidedtoupgradeentirethingsfromthepreviousosformakeitstrongerthecnology[.]Doc hxxp://23[.]94[.]239[.]93/5112/IEbrowser[.]vbs |
Remcos |
| URL | hxxp://146[.]190[.]120[.]217:2369/UQTb | Metasploit |
| URL | hxxp://fantadialo[.]top/waxt/aby[.]txt hxxp://91[.]92[.]255[.]173/executable[.]vbs hxxp://91[.]92[.]255[.]173/visalbasicmicrosoftclearentirepicturefromthepcforinternationalsecuritychecking[.]Doc hxxps://api[.]telegram[.]org/bot5660477358:AAFxZOVYtAfgAQwlzXUk6gyzteO6kn9r4Ho/ hxxps://api[.]telegram[.]org/bot6890953843:AAESDeAPFWFuXjE5oUpLiVkGoZxJQbW2ZFE/ hxxp://acglobal[.]com[.]pe/gay/expliitttfile[.]exe |
Agent Tesla |
| URL | hxxp://habrafa[.]com/test2/get[.]php hxxp://habrafa[.]com/test1/get[.]php |
STOP |
| URL | hxxp://prime[.]topendpower[.]top/_errorpages/softbinzx[.]exe | Formbook |
| URL | hxxp://128[.]140[.]69[.]37/sqlite3[.]dll hxxp://95[.]217[.]241[.]217/sqlite3[.]dll hxxp://195[.]201[.]44[.]3/sqlite3[.]dll hxxp://95[.]216[.]178[.]60/sqlite3[.]dll hxxp://195[.]201[.]47[.]172/sqlite3[.]dll hxxp://116[.]203[.]167[.]169/sqlite3[.]dll hxxp://116[.]202[.]187[.]82/sqlite3[.]dll |
Vidar |
| URL | hxxp://45[.]95[.]169[.]102/b[.]bin | CloudEyE |
| URL | hxxp://185[.]172[.]128[.]53/InstallSetup8[.]exe | Stealc |
