不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2024/03/04
※2024/03/04 更新
マルウェア感染させると考えられるURLを検知（2024/03/04）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://147[.]45[.]197[.]82/1[.]exe hxxp://185[.]130[.]46[.]46/pollSql[.]php hxxp://176[.]124[.]192[.]196/Httpserver0Windows/WpPublicJs/Proton_VmPacket/Generator8wpBase/External_/_wpLow8/universalFlower/3/Line62/7PublicPacket/geoCpuUpdateDefaultAsyncpublicPrivateUploadsDownloads[.]php hxxp://007017cm[.]nyashsens[.]top/Tempdownloads[.]php hxxp://058493cm[.]nyashsens[.]top/imagecpusql[.]php hxxp://80[.]78[.]243[.]170/toPipe3Process/javascriptTemporaryTrackCdn/UniversalDb1process/UploadsLocalCpu/windows/ExternalVmProviderline/linux/10Sql/1Authvoiddb/updatetraffic/Pipe/generatorFlowersql/TrafficGameVideo/Tracklocal3http/authPublicUpdateWindows/GeoCpuDatalifejs/Geo/Poll_CpuVm/CpuProcessordefaultDblinuxgeneratorDownloadsTemporary[.]php hxxp://82[.]146[.]60[.]218/EternalimageVideopipetempDownloads[.]php |
DCRat |
| URL | hxxp://103[.]191[.]15[.]10/V5jh hxxps://pastebin[.]com/raw/HradewMM hxxp://118[.]89[.]124[.]242/dpixel hxxp://117[.]50[.]47[.]141:51894/admin/facvicon[.]jpg hxxp://45[.]148[.]120[.]115:2589/nv hxxps://47[.]92[.]171[.]109/push hxxp://1[.]94[.]110[.]130:808/__utm[.]gif hxxp://43[.]134[.]183[.]43:9999/metro91/admin/1/ppptp[.]jpg hxxp://162[.]14[.]107[.]218/g[.]pixel hxxp://118[.]89[.]124[.]242:1234/visit[.]js hxxp://147[.]78[.]47[.]183:81/en_US/all[.]js hxxps://185[.]91[.]127[.]221/j[.]ad hxxp://118[.]89[.]124[.]242:2121/g[.]pixel hxxps://139[.]199[.]180[.]136/match hxxps://103[.]150[.]10[.]45:8443/cx hxxp://qq[.]qqweixinzhuce[.]top:8080/include/template/isx[.]php hxxps://8[.]222[.]150[.]46:8443/updates hxxp://111[.]229[.]198[.]177/ptj hxxp://8[.]222[.]150[.]46/updates hxxp://120[.]27[.]131[.]3/cx hxxp://101[.]201[.]46[.]105:8888/g[.]pixel hxxps://www[.]micshcnds[.]top/cs hxxp://47[.]113[.]195[.]22/pixel hxxp://18[.]192[.]209[.]34/accelerate/v3[.]33/1F7JW12FQR2V hxxp://test[.]qqweixinzhuce[.]top:8880/wp08/wp-includes/dtcla[.]php hxxp://47[.]94[.]138[.]63:10001/Calculate/in/S94APDY8M hxxps://159[.]203[.]25[.]237/dingo hxxps://www[.]shelter-paws[.]com/visit[.]js hxxp://124[.]71[.]130[.]71/push hxxp://43[.]143[.]143[.]195:6666/load hxxps://129[.]211[.]211[.]145/pixel hxxp://101[.]43[.]191[.]108:9998/load hxxp://47[.]93[.]216[.]2:8055/visit[.]js hxxps://159[.]223[.]220[.]165/owa/ hxxp://107[.]174[.]241[.]206:7989/push hxxp://18[.]116[.]36[.]101/g[.]pixel hxxps://111[.]231[.]146[.]154/jquery-3[.]3[.]1[.]min[.]js hxxp://47[.]92[.]146[.]233:8888/jquery-3[.]3[.]1[.]min[.]js hxxp://185[.]11[.]61[.]168/j[.]ad hxxp://47[.]96[.]174[.]24:8060/image/ hxxps://185[.]11[.]61[.]168/activity hxxps://38[.]181[.]70[.]150/jquery-3[.]3[.]1[.]min[.]js hxxps://8[.]134[.]221[.]219/cx hxxp://107[.]174[.]241[.]206:9999/__utm[.]gif hxxps://101[.]34[.]83[.]35/jquery-3[.]3[.]1[.]min[.]js hxxps://realzoogroup[.]com/api/accounts/v1/basic-accounts/pinned hxxp://86[.]106[.]20[.]179:3389/ab[.]html hxxps://129[.]211[.]211[.]145/j[.]ad hxxp://120[.]26[.]196[.]41:2222/__utm[.]gif hxxps://43[.]134[.]23[.]107:8443/wp-admin hxxps://107[.]148[.]1[.]128/fwlink hxxps://103[.]150[.]10[.]45:8443/ca hxxp://111[.]231[.]140[.]197:3333/push hxxps://47[.]92[.]99[.]156/ga[.]js |
Cobalt Strike |
| URL | hxxps://pastebin[.]com/raw/5kib1sHn | Metasploit |
| URL | hxxps://transfer[.]sh/get/q3Ri8r0Lfc/xapaktep_design_crypted_LAB[.]exe hxxps://princeaccessiblepo[.]shop/api hxxps://transfer[.]sh/get/UbbsCiHlCm/xapaktep_design_crypted_LAB[.]exe hxxps://executivebrakeji[.]shop/api |
Lumma Stealer |
| URL | hxxps://aljannatquranteach[.]com/cdn-vs/cache[.]php hxxps://aljannatquranteach[.]com/help/zewmrgqnw[.]php hxxps://aljannatquranteach[.]com/data[.]php hxxps://joq[.]collection[.]aixpirts[.]com/editContent hxxps://pszd[.]collection[.]aixpirts[.]com/editContent hxxps://svi[.]collection[.]aixpirts[.]com/editContent hxxps://aely[.]collection[.]aixpirts[.]com/editContent hxxps://ytjc[.]collection[.]aixpirts[.]com/editContent hxxps://swtgm[.]collection[.]aixpirts[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://185[.]172[.]128[.]19/d21cbe21e38b385a41a68c5e6dd32f4c[.]exe | Glupteba |
| URL | hxxps://91[.]92[.]247[.]100/q[.]jpg hxxps://94[.]156[.]69[.]220/wii[.]jpg hxxps://94[.]156[.]69[.]220/pie[.]jpg hxxps://94[.]156[.]69[.]220/koi[.]jpg hxxps://94[.]156[.]69[.]220/pan[.]jpg hxxps://91[.]92[.]255[.]19/q[.]jpg hxxp://91[.]92[.]253[.]239:888/pie[.]jpg hxxp://91[.]92[.]253[.]239:888/koi[.]jpg hxxp://91[.]92[.]253[.]239:888/pan[.]jpg hxxp://91[.]92[.]253[.]239:888/wii[.]jpg |
AsyncRAT |
| URL | hxxps://universalmovies[.]top/errorpage/catzx[.]scr | Nanocore RAT |
| URL | hxxps://bloomfield[.]ca/img/fedxwo[.]txt hxxps://pastebin[.]com/raw/czpuu8Qb hxxps://107[.]175[.]3[.]10//Users/Astral_Tech_20240210165430476[.]exe hxxps://107[.]175[.]3[.]10//Users/Biquyet_kiem_20240211233245067[.]exe hxxps://107[.]175[.]3[.]10//Users/Biquyet_kiem_20240211233242411[.]exe hxxps://107[.]175[.]3[.]10//Users/VB%20Shellcode%20inject_20240225222048575[.]exe |
XWorm |
| URL | hxxp://185[.]36[.]81[.]46/bot[.]mips?ddos hxxp://185[.]36[.]81[.]46/bot[.]mips hxxp://185[.]36[.]81[.]46/bot[.]x86?ddos hxxp://185[.]36[.]81[.]46/bot[.]arm7 hxxp://185[.]36[.]81[.]46/bot[.]arm5 hxxp://185[.]36[.]81[.]46/bot[.]arm6 hxxp://185[.]36[.]81[.]46/bot[.]mpsl hxxp://185[.]36[.]81[.]46/bot[.]m68k hxxp://185[.]36[.]81[.]46/bot[.]sh4 hxxp://185[.]36[.]81[.]46/bot[.]arm5?ddos hxxp://185[.]36[.]81[.]46/bot[.]x86_64 hxxp://185[.]36[.]81[.]46/bot[.]arm hxxp://185[.]36[.]81[.]46/bot[.]x86 hxxp://185[.]36[.]81[.]46/bot[.]ppc hxxp://185[.]36[.]81[.]46/bot[.]sh4?ddos hxxp://194[.]48[.]250[.]11/vlxx[.]mips hxxp://botnet[.]loadbalance[.]click/bot[.]x86_64 hxxp://194[.]48[.]250[.]11/vlxx[.]arm5 hxxp://194[.]48[.]250[.]11/vlxx[.]arm hxxp://194[.]48[.]250[.]11/vlxx[.]arm6 hxxp://194[.]48[.]250[.]11/vlxx[.]arm7 hxxp://194[.]48[.]250[.]11/vlxx[.]sh4 hxxp://194[.]48[.]250[.]11/vlxx[.]mpsl hxxp://194[.]48[.]250[.]11/vlxx[.]x86 |
MooBot |
| URL | hxxp://109[.]107[.]161[.]51/helper[.]exe hxxp://109[.]107[.]161[.]51/Zeta[.]exe hxxp://185[.]216[.]70[.]138/apache[.]sh hxxp://185[.]216[.]70[.]138/download/redtail[.]i686 hxxp://185[.]216[.]70[.]138/download/setup[.]sh hxxp://185[.]216[.]70[.]138/download/redtail[.]arm7 hxxp://185[.]216[.]70[.]138/download/redtail[.]x86_64 hxxp://185[.]216[.]70[.]138/download/redtail[.]arm8 hxxp://94[.]156[.]64[.]143/windows/xmrigMiner[.]exe |
Coinminer |
| URL | hxxps://hotelashrafee[.]com/rem[.]txt hxxp://leadingbyte[.]com/e6a85777-d353-412d-acaf-b017744de8b8c[.]txt |
NetSupportManager RAT |
| URL | hxxp://193[.]233[.]132[.]167/lend/jokerpos[.]exe | Mars Stealer |
| URL | hxxp://192[.]151[.]244[.]144:5552/MS[.]exe | Ghost RAT |
| URL | hxxps://usdtzshlavkovalasgo[.]com/MGQ4MDE1ZDk3Nzc1/ hxxps://185[.]198[.]69[.]119/MzdiNzU5NjJkZTNm/ |
Coper |
| URL | hxxp://218[.]38[.]52[.]227:8000/EjtczQ/RuntimeBroker[.]exe | Formbook |
| URL | hxxp://193[.]233[.]132[.]167/lend/goldprime123[.]exe hxxp://193[.]233[.]132[.]167/lend/FATTHER[.]exe hxxp://193[.]233[.]132[.]167/lend/goldpromedffdg[.]exe hxxps://hackwave[.]pro/installerV2[.]zip |
RedLine Stealer |
| URL | hxxps://paste[.]ee/d/CwDon hxxps://paste[.]ee/d/lyKlN/0 hxxps://paste[.]ee/d/pmQUg |
Remcos |
| URL | hxxps://107[.]175[.]3[.]10//Users/Rapid_Stream_20240205232121274[.]exe hxxps://107[.]175[.]3[.]10//Users/Rapid_Stream_20240205081624485[.]exe hxxps://107[.]175[.]3[.]10//Users/Secure_Cloud_20240206000715989[.]exe hxxps://107[.]175[.]3[.]10/Users/Apex_Vortex_20240229085748832[.]exe hxxps://107[.]175[.]3[.]10//Users/signed_20240224212318452[.]exe hxxps://107[.]175[.]3[.]10//Users/Apex_Vortex_20240229085748832[.]exe hxxps://107[.]175[.]3[.]10//Users/Miracle_Genius_20240227012331614[.]exe hxxps://107[.]175[.]3[.]10//Users/Stellar_Tech_20240224235252691[.]exe hxxps://107[.]175[.]3[.]10//Users/Eclipse_Dash_20240217190115479[.]exe hxxps://107[.]175[.]3[.]10//Users/Prestige_Edge_20240226102422124[.]exe hxxps://107[.]175[.]3[.]10//Users/Quantum_Cyber_20240227083454463[.]exe hxxps://107[.]175[.]3[.]10//Users/Tech_Link_20240225081533803[.]exe hxxps://107[.]175[.]3[.]10//Users/Quasar_Share_20240226101148498[.]exe hxxps://107[.]175[.]3[.]10//Users/Windows_Security_20240209014016942[.]exe hxxps://107[.]175[.]3[.]10//Users/Quantum_Sync_20240217185658013[.]exe hxxps://107[.]175[.]3[.]10//Users/Enigma_Matrix_20240224232228946[.]exe hxxps://107[.]175[.]3[.]10//Users/Serene_Sync_20240225000617639[.]exe hxxps://107[.]175[.]3[.]10//Users/Nebula_Force_20240228153536440[.]exe hxxps://107[.]175[.]3[.]10//Users/SecurityHealt_20240222070916028[.]exe hxxps://107[.]175[.]3[.]10//Users/Alpha_Base_20240209210907868[.]exe hxxps://107[.]175[.]3[.]10//Users/Quasar_Share_20240223071004370[.]exe hxxps://107[.]175[.]3[.]10//Users/Digital_Edge_20240227114542088[.]exe hxxps://107[.]175[.]3[.]10//Users/WindowsSecurityHealt_20240213173401169[.]exe hxxps://107[.]175[.]3[.]10//Users/Cosmic_Pulse_20240226152541358[.]exe hxxps://107[.]175[.]3[.]10//Users/Delta_Tech_20240226150941653[.]exe hxxps://107[.]175[.]3[.]10//Users/Gamma_Byte_20240225090812380[.]exe hxxps://107[.]175[.]3[.]10//Users/signed_20240225210636028[.]exe hxxps://107[.]175[.]3[.]10//Users/Ultimate_ScanS_20240228035536567[.]exe hxxps://107[.]175[.]3[.]10//Users/signed_20240225221559905[.]exe hxxps://107[.]175[.]3[.]10//Users/Ultimate_ScanS_20240228035533816[.]exe hxxps://107[.]175[.]3[.]10//Users/Signed_20240223014935247[.]exe hxxps://107[.]175[.]3[.]10//Users/Digital_Edge_20240227111857983[.]exe hxxps://107[.]175[.]3[.]10//Users/signed_20240228040932259[.]exe hxxps://107[.]175[.]3[.]10//Users/Gamma_Byte_20240225090825600[.]exe hxxps://107[.]175[.]3[.]10//Users/Digital_Edge_20240227110836147[.]exe hxxps://107[.]175[.]3[.]10//Users/Miracle_Genius_20240226110322680[.]exe hxxps://107[.]175[.]3[.]10//Users/dddddddddddddd_20240225045200562[.]exe hxxps://107[.]175[.]3[.]10//Users/Digital_Edge_20240227111912830[.]exe hxxps://107[.]175[.]3[.]10//Users/signed_20240224174311896[.]exe hxxps://107[.]175[.]3[.]10//Users/Vertex_Craze_20240225061753481[.]exe hxxps://107[.]175[.]3[.]10//Users/Quasar_Share_20240223064931001[.]exe hxxps://107[.]175[.]3[.]10//Users/Apex_Sphere_20240224215148756[.]exe hxxps://107[.]175[.]3[.]10//Users/Pinnacle_Ware_20240229164336371[.]exe hxxps://107[.]175[.]3[.]10//Users/Apex_Box_20240225063840506[.]exe hxxps://107[.]175[.]3[.]10//Users/Ultimate_SchanS_20240228040637871[.]exe hxxps://107[.]175[.]3[.]10//Users/Synergistic_Spot_20240227084920908[.]exe hxxps://107[.]175[.]3[.]10//Users/signed_20240224210355899[.]exe hxxps://107[.]175[.]3[.]10//Users/Apex_Box_20240225063757017[.]exe hxxps://107[.]175[.]3[.]10//Users/Delta_Vista_20240227071332438[.]exe hxxps://107[.]175[.]3[.]10//Users/test_20240223192734046[.]exe hxxps://107[.]175[.]3[.]10//Users/Delta_Bit_20240227212520673[.]exe hxxps://107[.]175[.]3[.]10//Users/signed_20240224225218496[.]exe hxxps://107[.]175[.]3[.]10//Users/Collaborative_Sync_20240226075009769[.]exe hxxps://107[.]175[.]3[.]10//Users/vsvStellar_Tech_20240224225106852[.]exe hxxps://107[.]175[.]3[.]10/Users/test_20240223192734046[.]exe hxxps://107[.]175[.]3[.]10/Users/Gamma_Byte_20240225090812380[.]exe hxxps://107[.]175[.]3[.]10/users/Quantum_Sync_20240217185658013[.]exe hxxps://107[.]175[.]3[.]10/Users/Pinnacle_Ware_20240229164336371[.]exe |
neshta |
| URL | hxxps://www[.]simplifiednetworks[.]net/softphone-update[.]txt hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/dvImYbbIoGSHoYg249[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/iwAFwYf27[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/NfczMTPnDmrZEO204[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/IUvEAvQGQuv253[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/rXcYKrGmfNOHyiokPtk216[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/UjZmoXbhNodoVui35[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/zeYHuPRpWYjWouLk79[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/AFgKl101[.]bin hxxp://excelbuilding[.]co[.]uk/wp-includes/IXR/YUMmQoUZhVDFIpLwEM21[.]bin hxxp://103[.]77[.]242[.]251/IZskaY86[.]bin hxxp://103[.]77[.]242[.]251/gmBxkFYQwnfl44[.]bin hxxp://103[.]77[.]242[.]251/nscTQjlGd86[.]bin hxxp://103[.]77[.]242[.]251/DRLsqMLAIBkSAOvAXxFzCk235[.]bin hxxp://103[.]77[.]242[.]251/ekHCfPYuow210[.]bin hxxp://103[.]77[.]242[.]251/MBgRVW124[.]bin hxxp://103[.]77[.]242[.]251/EGpSGsJgLLb228[.]bin hxxp://103[.]77[.]242[.]251/XsQQnyxgVgYsiNhXoWoPi151[.]bin hxxp://103[.]77[.]242[.]251/oEwnAGk115[.]bin hxxp://91[.]92[.]245[.]211/XskZqjgfBg216[.]bin hxxp://91[.]92[.]245[.]211/zaNEeaES248[.]bin hxxp://103[.]183[.]115[.]241/ANxAJWdBkVNIql5[.]bin hxxp://103[.]183[.]115[.]241/gkexdeDRDPdOQczlzkQ18[.]bin hxxp://103[.]183[.]115[.]241/pelWqPafBpp63[.]bin hxxp://103[.]183[.]115[.]241/uQlTAnOV75[.]bin hxxp://66[.]63[.]162[.]155/WQBephCmxd6[.]bin hxxp://103[.]183[.]115[.]241/MTifYRAAGx67[.]bin hxxp://103[.]183[.]115[.]241/hcipHSdNWfgvPslSwM137[.]bin hxxp://103[.]183[.]115[.]241/fdGrbKOaWxwFJNelsAQio164[.]bin hxxp://103[.]183[.]115[.]241/ItXnKUNan175[.]bin hxxp://103[.]183[.]115[.]241/LSpIQvulY150[.]bin hxxp://103[.]183[.]115[.]241/OAGHSbdtLFdDPDQJEarMVZScz131[.]bin hxxp://103[.]183[.]115[.]241/BVdpxI73[.]bin |
CloudEyE |
| URL | hxxps://sharetext[.]me/download/7gnhw9iqiv hxxps://textbin[.]net/download/itm1dkgz7c |
NjRAT |
| URL | hxxp://192[.]3[.]95[.]216/myxlamCryptersAndTools[.]vbs hxxps://107[.]175[.]3[.]10//Users/Zenith_Hub_20240229201747443[.]exe hxxps://107[.]175[.]3[.]10/Users/Zenith_Hub_20240229201747443[.]exe |
Agent Tesla |
| URL | hxxp://193[.]233[.]132[.]167/lend/seratwo[.]exe | Venom RAT |
| URL | hxxp://125[.]46[.]203[.]213:39644/Mozi[.]m hxxp://112[.]252[.]202[.]220:45339/Mozi[.]m |
Mozi |
| URL | hxxp://185[.]172[.]128[.]187/syncUpd[.]exe hxxp://89[.]105[.]201[.]132/c44a765f550f6a2f[.]php |
Stealc |
| URL | hxxp://94[.]156[.]64[.]143/linux/xmrigMiner hxxp://94[.]156[.]64[.]143/linux/xmrigDaemon hxxp://94[.]156[.]64[.]143/mac/xmrigMiner hxxp://94[.]156[.]64[.]143/windows/xmrigDaemon[.]exe hxxp://94[.]156[.]64[.]143/mac/xmrigDaemon |
XMRig |
