不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/01/22
※2024/01/22 更新
マルウェア感染させると考えられるURLを検知（2024/01/22）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://107[.]175[.]243[.]133/1521/conhost[.]exe hxxp://91[.]92[.]250[.]136/harmless/inc/2c6d40d7cc1ad3[.]php hxxps://api[.]telegram[.]org/bot6967409571:AAEKPTFrpT2oKct9fDAF6SN2r4di7xyeep4/ hxxps://api[.]telegram[.]org/bot6740417848:AAG5U7WvWwupGTM8CQIMwDQuy1jwkD8O49I/ |
Agent Tesla |
| URL | hxxp://192[.]252[.]183[.]116:8089/u/123/100123/202401/sshd hxxp://192[.]252[.]183[.]116:8089/u/123/100123/202401/d9a10f4568b649acae7bc2fe51fb5a98[.]sh hxxp://192[.]252[.]183[.]116:8089/u/123/100123/202401/31a5f4ceae1e45e1a3cd30f5d7604d89[.]json hxxp://185[.]196[.]10[.]146/Ylcqwdizkq[.]exe hxxp://185[.]196[.]10[.]146/Aixnslkoum[.]exe |
Coinminer |
| URL | hxxp://185[.]196[.]10[.]146/Sjupttbqke[.]exe hxxp://185[.]172[.]128[.]19/buildcosta[.]exe hxxp://51[.]15[.]226[.]0/NewFolder/index[.]php hxxp://185[.]196[.]10[.]34/b8sdjsdkS/index[.]php hxxp://185[.]196[.]10[.]146/Zzbifmr[.]exe |
Amadey |
| URL | hxxps://85[.]209[.]176[.]146/c/msdownload/update/others/2020/10/29136388_ hxxps://45[.]128[.]96[.]186/c/msdownload/update/others/2020/10/29136388_ hxxps://cloud[.]huawel[.]top:8443/jquery-3[.]3[.]1[.]min[.]js hxxp://federalstudentaid-usdepartmentofeducation[.]tandemcyberops[.]co/cm hxxp://175[.]178[.]161[.]139:6667/match hxxps://www[.]xss[.]mba:10328/__utm[.]gif hxxps://8[.]130[.]133[.]123/ptj hxxp://85[.]209[.]176[.]146:8088/c/msdownload/update/others/2020/10/29136388_ hxxp://47[.]236[.]28[.]58:81/ca hxxp://85[.]209[.]176[.]146:8082/c/msdownload/update/others/2020/10/29136388_ hxxps://15[.]207[.]223[.]7/updates[.]rss hxxps://www[.]xiongge[.]space:8443/ga[.]js hxxp://82[.]157[.]64[.]227:8081/ca hxxp://172[.]67[.]130[.]131:8080/cm hxxp://82[.]157[.]64[.]227:81/IE9CompatViewList[.]xml hxxp://120[.]26[.]196[.]41:2222/match hxxp://121[.]40[.]175[.]169/visit[.]js hxxp://45[.]128[.]96[.]186:8082/c/msdownload/update/others/2020/10/29136388_ hxxps://129[.]226[.]83[.]129/aaaaaaaaa hxxps://85[.]209[.]176[.]146:8443/c/msdownload/update/others/2020/10/29136388_ hxxp://82[.]157[.]64[.]227/cx hxxps://3[.]10[.]251[.]35/jquery-3[.]3[.]1[.]min[.]js hxxp://45[.]128[.]96[.]186:8088/c/msdownload/update/others/2020/10/29136388_ hxxp://federalstudentaid-usdepartmentofeducation[.]tandemcyberops[.]co/ga[.]js hxxps://198[.]251[.]88[.]196/updates[.]rss hxxps://1[.]116[.]74[.]174/__utm[.]gif hxxp://20[.]2[.]223[.]43/dpixel hxxps://101[.]46[.]48[.]24/ca hxxp://101[.]46[.]48[.]24/push hxxp://182[.]43[.]71[.]62:8888/cm hxxp://8[.]130[.]48[.]46/ga[.]js hxxp://162[.]14[.]109[.]90:8080/push hxxp://111[.]230[.]42[.]149:8010/updates[.]rss hxxp://121[.]4[.]67[.]78:443/v1Nh hxxps://91[.]92[.]249[.]112/j[.]ad hxxps://cloudflairly[.]com/devise/v7[.]13/DBE4YDCY84F hxxps://45[.]128[.]96[.]186:8443/c/msdownload/update/others/2020/10/29136388_ hxxps://74[.]48[.]162[.]145/jquery-3[.]3[.]1[.]min[.]js hxxps://92[.]118[.]36[.]235/preload hxxps://216[.]83[.]51[.]175/jquery-3[.]3[.]1[.]min[.]js hxxps://185[.]196[.]9[.]231/ga[.]js hxxp://116[.]198[.]46[.]64:6666/en_US/all[.]js hxxps://15[.]207[.]223[.]7/match hxxp://43[.]138[.]179[.]199:808/cm hxxps://43[.]138[.]179[.]199:1811/ga[.]js hxxps://43[.]153[.]222[.]28/ptj hxxp://47[.]109[.]102[.]98/g[.]pixel hxxps://198[.]251[.]88[.]196/en_US/all[.]js hxxps://43[.]138[.]179[.]199/pixel hxxp://150[.]158[.]181[.]243:8011/IE9CompatViewList[.]xml hxxp://163[.]5[.]169[.]2/c/msdownload/update/others/2016/12/51350824_ hxxp://176[.]32[.]38[.]205/dot[.]gif hxxps://47[.]106[.]230[.]109/www/handle/doc hxxps://124[.]221[.]198[.]68/cm hxxp://175[.]178[.]14[.]59:10081/ga[.]js hxxp://175[.]178[.]161[.]139:6667/updates[.]rss hxxps://91[.]92[.]249[.]112/__utm[.]gif hxxp://150[.]158[.]181[.]243:8011/www/handle/doc hxxps://198[.]251[.]88[.]196/push hxxps://47[.]104[.]179[.]218/visit[.]js hxxps://8[.]219[.]229[.]99/visit[.]js hxxp://124[.]222[.]82[.]248:6666/pixel |
Cobalt Strike |
| URL | hxxp://45[.]87[.]153[.]135/5d4f090c730016b1[.]php hxxp://45[.]87[.]153[.]135/e0421e618c8d5814/nss3[.]dll hxxp://45[.]87[.]153[.]135/e0421e618c8d5814/vcruntime140[.]dll hxxp://45[.]87[.]153[.]135/e0421e618c8d5814/msvcp140[.]dll hxxp://45[.]87[.]153[.]135/e0421e618c8d5814/softokn3[.]dll hxxp://45[.]87[.]153[.]135/e0421e618c8d5814/mozglue[.]dll hxxp://45[.]87[.]153[.]135/e0421e618c8d5814/sqlite3[.]dll hxxp://45[.]87[.]153[.]135/e0421e618c8d5814/freebl3[.]dll |
Stealc |
| URL | hxxps://45[.]15[.]156[.]13/index[.]php/s/KmdpWiMsMLy7wQK/download/TrueCrypt_lXNcTC[.]exe hxxps://snnclermontprojects[.]com/Office[.]exe hxxps://45[.]15[.]156[.]13/index[.]php/s/67bowFysanbi5pZ/download/Installer[.]exe hxxp://185[.]161[.]248[.]185/BART[.]jpg hxxp://185[.]161[.]248[.]185/error[.]jpg hxxps://45[.]15[.]156[.]13/index[.]php/s/eoLSkLSeoLsqDbY/download/crypted[.]exe hxxp://213[.]248[.]43[.]105/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms hxxp://213[.]248[.]43[.]103/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms hxxp://213[.]248[.]43[.]105/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms hxxp://185[.]103[.]101[.]163/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms hxxp://213[.]248[.]43[.]103/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms hxxp://185[.]103[.]101[.]163/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms |
RedLine Stealer |
| URL | hxxp://nsslawcollege[.]org/look/gate[.]php hxxp://www[.]ventriocorp[.]com/image/panel/gate[.]php |
Pony |
| URL | hxxp://45[.]32[.]153[.]79/ImageVideoline_RequestGeoAuthDbtrafficTest[.]php hxxp://852287cm[.]nyashland[.]top/nyashsupport[.]php hxxp://80[.]66[.]89[.]148/Phppacket/low/GeneratordatalifePython/8flower/8/protect/Betterlinelow/phpcdn/3/PythonPacket/baseExternal2video/Downloads4/Testprivate/Mariadb/trafficImageCentraltemporary/8/JavascriptHttp80/Javascriptprovidermulti/AsyncjavascriptTestPython/tocpuapiservergeneratorDownloads[.]php hxxp://94[.]156[.]65[.]94/cpuExternalPhp/9Update7Private/579/SecureLongpollmultiWpUploads[.]php hxxp://46[.]29[.]237[.]220/Traffic/apiJavascriptPrivatewindows/ApiToDb/asyncDb/Secure3/central/low/Processor/Longpoll/TrafficSql/PrivateVoiddbGenerator/UpdateLine/JavascriptSecuredatalife/LinuxDb2/BetterPacket/eternalimageVideopacketLinux[.]php hxxp://192565cm[.]nyashtech[.]top/ExternaleternalPhpupdatetestTemporary[.]php hxxp://3[.]79[.]245[.]165/async/Longpollsecure/7Async5/WpCpuLocalCpu/7geoprovider/5Universal/CdntempDbjs/2RequestSecureProtect/Central/Cdnmulti/Generatorbetter2Universal/6FlowerApitrack/Default/20/7api/updategenerator3geo/Private/imageVmPhpJs_SqlBaselocalCentralTemporary[.]php hxxps://github[.]com/Penanosd/Water/releases/download/code/dvchost[.]exe hxxp://185[.]221[.]198[.]108/PhpSqlauth/trackDatalife/datalifeCdn/VideoTemp6/processorauth8/Better3/3/2Auth3/low/Testwp4_/ProtonapiwordpressPoll/Proton/JavascriptRequestProtectUniversalPublicCentraluploads[.]php hxxp://691908cm[.]nyashtech[.]top/PhpprocessorlinuxwindowsFlowerTempTemporary[.]php |
DCRat |
| URL | hxxp://82[.]147[.]84[.]194/9[.]exe hxxp://87[.]251[.]77[.]166/SetupPowerGREPDemo[.]exe |
Lumma Stealer |
| URL | hxxp://tan[.]kalnet[.]top/_errorpages/oplugmanzx[.]exe hxxp://198[.]12[.]81[.]138/3590/REV[.]txt hxxps://textbin[.]net/download/6zkypw85yx hxxps://pt[.]textbin[.]net/download/l7ht9ey8tp hxxps://pt[.]textbin[.]net/download/vzgm3tptve hxxps://pt[.]textbin[.]net/download/wohbuyvc6t hxxp://194[.]5[.]212[.]131/ucVmfTKgTE70[.]bin |
Remcos |
| URL | hxxp://193[.]233[.]132[.]117/sl2_29[.]exe | BazarBackdoor |
| URL | hxxp://172[.]245[.]208[.]28/5299/conhost[.]exe hxxp://172[.]245[.]208[.]28/5298/conhost[.]exe hxxp://103[.]68[.]85[.]20/New/bin[.]exe |
Formbook |
| URL | hxxp://172[.]96[.]14[.]47/UfMLbwHzxrOTiM217[.]bin hxxp://172[.]96[.]14[.]47/SRAEhHxaCNolZres161[.]bin hxxp://43[.]230[.]202[.]44/YsGJoVIJrUBV0[.]bin hxxps://constamp[.]net/764545679[.]zip hxxp://43[.]230[.]202[.]42/hJsFy176[.]bin |
CloudEyE |
| URL | hxxps://hqw[.]places[.]creeksidehuntingpreserve[.]com/editContent hxxps://nwxnr[.]places[.]creeksidehuntingpreserve[.]com/editContent hxxps://acuiplast[.]com/digital[.]js hxxps://kvt[.]places[.]creeksidehuntingpreserve[.]com/editContent hxxps://whmpu[.]places[.]creeksidehuntingpreserve[.]com/editContent hxxps://urpco[.]places[.]creeksidehuntingpreserve[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://sempersim[.]su/b20/fre[.]php hxxps://sempersim[.]su/b20/fre[.]php hxxps://sempersim[.]su/b18/fre[.]php hxxp://sempersim[.]su/b18/fre[.]php |
LokiBot |
| URL | hxxp://5[.]42[.]67[.]26/oorigg/inte[.]exe hxxp://5[.]42[.]67[.]26/batushka/univ[.]exe |
GCleaner |
| URL | hxxp://cafirepacks[.]com/pub/fon/index[.]php | Azorult |
| URL | hxxp://93[.]123[.]39[.]68/client[.]exe hxxp://93[.]123[.]39[.]68/build[.]exe |
Venom RAT |
| URL | hxxp://ji[.]alie3ksgff[.]com/ef/rty27[.]exe hxxp://154[.]92[.]15[.]189/ef/rty45[.]exe |
Fabookie |
| URL | hxxp://185[.]217[.]197[.]175/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://185[.]217[.]197[.]175/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://185[.]217[.]197[.]175/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://185[.]217[.]197[.]175/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://185[.]217[.]197[.]175/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://185[.]217[.]197[.]175/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://185[.]217[.]197[.]175/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://109[.]107[.]178[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://109[.]107[.]178[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://109[.]107[.]178[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://109[.]107[.]178[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://109[.]107[.]178[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://109[.]107[.]178[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://109[.]107[.]178[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://cczhk[.]com/cc/index[.]php | SmokeLoader |
| URL | hxxps://github[.]com/RiseMe-origami/g/raw/main/Eszop[.]exe | zgRAT |
| URL | hxxp://fygbib44[.]top/gate[.]php | CryptBot |
