不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2024/01/23
※2024/01/23 更新
マルウェア感染させると考えられるURLを検知（2024/01/23）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://93[.]123[.]85[.]149/rebirth[.]spc hxxp://hive[.]swarmnetwork[.]online/telnetd hxxp://hive[.]swarmnetwork[.]online/ps hxxp://hive[.]swarmnetwork[.]online/curl |
Bashlite |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1137901613231636481/1198818345928110151/DHL_SHIPMENT_05185877793[.]vbs hxxp://122[.]176[.]133[.]66:8080/rem1[.]zip hxxps://pasteio[.]com/raw/xw4xlFgtdEF7 |
Remcos |
| URL | hxxp://45[.]200[.]51[.]127/mm[.]txt | Ghost RAT |
| URL | hxxps://104[.]243[.]32[.]185/qv[.]jpg hxxps://185[.]81[.]157[.]160/x[.]jpg hxxps://104[.]243[.]32[.]185/f%20old[.]jpg hxxps://104[.]243[.]32[.]185/f[.]jpg hxxps://104[.]243[.]32[.]185/f%20old2[.]jpg hxxps://104[.]243[.]32[.]185/g[.]jpg hxxps://185[.]81[.]157[.]150/mvp[.]jpg hxxps://185[.]81[.]157[.]244/9X[.]jpg hxxps://185[.]81[.]157[.]152/fin[.]jpg hxxps://185[.]81[.]157[.]244/91[.]jpg hxxps://185[.]81[.]157[.]24/cle[.]jpg hxxps://185[.]81[.]157[.]24/n[.]jpg hxxps://185[.]81[.]157[.]24/tt[.]jpg hxxps://185[.]81[.]157[.]244/coderxo[.]jpg hxxps://185[.]81[.]157[.]244/mjd[.]jpg hxxps://185[.]81[.]157[.]244/r[.]jpg hxxps://185[.]81[.]157[.]150/d[.]jpg hxxps://github[.]com/RiseMe-origami/g/raw/main/first[.]exe |
AsyncRAT |
| URL | hxxp://meiko[.]my/jZgmMv253[.]bin hxxp://www[.]eastconsults[.]com/logos/255_Fmqkiufrbum |
CloudEyE |
| URL | hxxp://192[.]3[.]176[.]145/prs/microsoftdesignednewthechnologytoupgradeentireprocessinsingleclicktounderstandhowimportantitsisverynicefeaturesforthem[.]doC hxxp://192[.]3[.]176[.]145/2355/conhost[.]exe hxxp://107[.]175[.]243[.]133/3804/conhost[.]exe hxxp://107[.]175[.]243[.]133/hmc/microsoftunderstandthepowerofnewthecnologytolearnhowtoprotecttheprivacyofofficefiletolearnsomething[.]doC |
Formbook |
| URL | hxxp://5[.]42[.]64[.]33/timeSync[.]exe hxxp://185[.]172[.]128[.]19/288c47bbc1871b439df19ff4df68f0766[.]exe |
Stealc |
| URL | hxxp://185[.]196[.]10[.]146/Oscrcelw[.]exe hxxps://www[.]fleefight[.]it/temp/flesh[.]exe hxxps://www[.]fleefight[.]it/temp/store[.]exe hxxp://109[.]107[.]182[.]3/lego/store[.]exe |
zgRAT |
| URL | hxxp://rtdsheet[.]com/search/gtm[.]start/gtm[.]js/page/%5Bthrive_page_number%5D/page/gtm[.]js/page/%252/gtm/page/%5Bthrive_page_number%5D/page/%5Bthrive_page_number%5D/feed/rss2 | Ngioweb |
| URL | hxxps://cs[.]h1ll0[.]cs[.]in:4433/activity hxxp://111[.]229[.]163[.]225/dot[.]gif hxxp://8[.]219[.]229[.]99/dot[.]gif hxxp://114[.]115[.]210[.]125:8880/fwlink hxxps://123[.]56[.]217[.]32/en_US/all[.]js hxxps://45[.]152[.]67[.]162:8443/j[.]ad hxxps://xgcs[.]ceshi897[.]cn:8443/cm hxxps://139[.]9[.]134[.]28/load hxxps://43[.]136[.]71[.]208:8443/api/methon/scan hxxp://110[.]42[.]248[.]7:87/match hxxps://194[.]32[.]149[.]227/dpixel hxxp://dig[.]fuli-oa[.]cn/en_US/all[.]js hxxp://162[.]14[.]77[.]157/security[.]jsp hxxps://121[.]89[.]212[.]43/zC hxxp://113[.]250[.]188[.]15:8454/ca hxxps://1[.]116[.]74[.]174/en_US/all[.]js hxxp://172[.]67[.]158[.]218:8080/zC hxxp://104[.]21[.]41[.]14:8080/zC hxxp://api[.]su57[.]fun:8080/zC hxxp://124[.]222[.]149[.]52:4444/g[.]pixel hxxp://47[.]108[.]175[.]149:7777/ca hxxps://88[.]214[.]27[.]53:4443/ca hxxp://156[.]253[.]12[.]10:8082/search/ hxxps://163[.]5[.]169[.]23/dot[.]gif hxxp://124[.]222[.]149[.]52/push |
Cobalt Strike |
| URL | hxxps://api[.]telegram[.]org/bot6225333215:AAFu6RyUqp4Klj6s7zuEWrA78AFP6bYaof8/ hxxp://107[.]175[.]243[.]133/hmc/hm/microsoftexploreentireprocesstohappenedfromtheofficetoupgradenewtechnologytoestabilishedthings[.]doC hxxp://107[.]175[.]243[.]133/3805/conhost[.]exe |
Agent Tesla |
| URL | hxxps://pastbin[.]net/download/21012024-3 | Revenge RAT |
| URL | hxxps://www[.]fleefight[.]it/temp/leg221[.]exe hxxps://www[.]fleefight[.]it/temp/322321[.]exe hxxps://www[.]fleefight[.]it/temp/legnew[.]exe hxxps://www[.]fleefight[.]it/temp/rdx1122[.]exe hxxps://www[.]fleefight[.]it/temp/gold1234[.]exe hxxps://www[.]fleefight[.]it/temp/pixelcloudnew2[.]exe hxxps://www[.]fleefight[.]it/temp/2024[.]exe hxxps://www[.]fleefight[.]it/temp/crypteddaisy[.]exe hxxps://eldarune[.]store/crypted[.]exe hxxp://109[.]107[.]182[.]3/lego/rdx1122[.]exe hxxp://109[.]107[.]182[.]3/lego/leg221[.]exe |
RedLine Stealer |
| URL | hxxp://647249cm[.]nyashtech[.]top/PythonsecurepacketAuthgameservertempTemporary[.]php | DCRat |
| URL | hxxps://www[.]fleefight[.]it/temp/Miner-XMR1[.]exe | Coinminer |
| URL | hxxps://www[.]janecourtney[.]ca/get[.]php hxxps://www[.]joinmycourse[.]com/get[.]php |
GootLoader |
| URL | hxxps://cqya[.]places[.]creeksidehuntingpreserve[.]com/editContent hxxps://izu[.]places[.]creeksidehuntingpreserve[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://lbxl[.]shop/LB341/index[.]php | Azorult |
| URL | hxxps://movierulzps[.]com/vL7MSJB7FpJI7Y5TPz0/kkNf/S3/SgRyr hxxps://moviesjacketss[.]com/V80lm/hDo1ZiCLHBqVX2pSm/3/jKxP4kx |
CryptBot |
