不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/04/15
※2024/04/15 更新
マルウェア感染させると考えられるURLを検知（2024/04/15）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://onedrive[.]live[.]com/download?resid=F2DC8284E0A31E9E%21206&authkey=!AIDY0-GqpEkHZ6k hxxps://mhsonsco[.]com/ab/4[.]txt hxxps://mhsonsco[.]com/ab/5ab[.]txt hxxps://mhsonsco[.]com/ab/hls[.]txt hxxp://185[.]241[.]208[.]113/lol/capy[.]exe hxxp://185[.]241[.]208[.]113/lol/Rave[.]exe hxxp://185[.]241[.]208[.]113/lol/remek[.]exe hxxp://185[.]241[.]208[.]113/lol/elo[.]exe |
Remcos |
| URL | hxxps://makaraaras[.]shop/Y2JhNzZhZWRjMzlm/ hxxps://mabelkanadan[.]shop/Y2JhNzZhZWRjMzlm/ hxxps://karamdasn2[.]shop/Y2JhNzZhZWRjMzlm/ hxxps://karakalandan5[.]com/Y2JhNzZhZWRjMzlm/ hxxps://212[.]87[.]204[.]3/YzQyNjFlZjE1ODVm/ hxxps://germanisoppinionsi[.]com/YzQyNjFlZjE1ODVm/ hxxps://germanisoppinionsi[.]net/YzQyNjFlZjE1ODVm/ hxxps://germanisoppinionsi[.]xyz/YzQyNjFlZjE1ODVm/ hxxps://germanisoppinionzani[.]com/YzQyNjFlZjE1ODVm/ hxxps://germanisoppinionzani[.]net/YzQyNjFlZjE1ODVm/ hxxps://germanisoppinionzani[.]xyz/YzQyNjFlZjE1ODVm/ hxxps://tecbabbshop24578[.]shop/ZDQyN2NmOGEZOTIK/ hxxps://karamdsadvs2[.]shop/ZDQyN2NmOGEZOTIK/ hxxps://karakalandankasd5[.]com/ZDQyN2NmOGEZOTIK/ hxxps://tecklardankalan[.]shop/ZDQyN2NmOGEZOTIK/ hxxps://boloneser[.]top/YTNjMDBmOTViNTc3/ hxxps://mulaktix[.]top/YTNjMDBmOTViNTc3/ hxxps://munison[.]top/YTNjMDBmOTViNTc3/ hxxps://udefano[.]top/YTNjMDBmOTViNTc3/ |
Coper |
| URL | hxxp://45[.]13[.]227[.]109/tftp hxxp://45[.]13[.]227[.]109/sh hxxp://45[.]13[.]227[.]109/cron hxxp://45[.]13[.]227[.]109/sshd hxxp://45[.]13[.]227[.]109/ntpd hxxp://45[.]13[.]227[.]109/pftp hxxp://45[.]13[.]227[.]109/openssh hxxp://38[.]6[.]224[.]248/skid[.]mips hxxp://38[.]6[.]224[.]248/skid[.]mpsl hxxp://38[.]6[.]224[.]248/skid[.]arm7 hxxp://192[.]53[.]121[.]133/x86 hxxp://192[.]53[.]121[.]133/armv6l hxxp://192[.]53[.]121[.]133/armv5l hxxp://192[.]53[.]121[.]133/i686 hxxp://89[.]23[.]102[.]165/snype[.]mips hxxp://93[.]123[.]39[.]73/arm4 hxxp://93[.]123[.]39[.]73/arm5 hxxp://2[.]58[.]113[.]208/sauce[.]armv4 hxxp://2[.]58[.]113[.]208/sauce[.]i586 hxxp://2[.]58[.]113[.]208/sauce[.]Armv6l hxxp://2[.]58[.]113[.]208/sauce[.]i686 hxxp://2[.]58[.]113[.]208/sauce[.]x86 hxxp://2[.]58[.]113[.]208/sauce[.]armv5 hxxp://2[.]58[.]113[.]208/sauce[.]mips hxxp://2[.]58[.]113[.]208/sauce[.]sh4 hxxp://2[.]58[.]113[.]208/sauce[.]sparc hxxp://2[.]58[.]113[.]208/sauce[.]mipsel hxxp://2[.]58[.]113[.]208/sauce[.]m68k hxxp://2[.]58[.]113[.]208/sauce[.]ppc hxxp://93[.]123[.]39[.]73/ppc hxxp://93[.]123[.]39[.]73/mpsl hxxp://91[.]92[.]251[.]238/armv4l hxxp://176[.]123[.]1[.]215/armv7l hxxp://185[.]196[.]8[.]31/apache2 hxxp://185[.]196[.]8[.]31/tftp hxxp://176[.]123[.]1[.]215/armv4l hxxp://185[.]196[.]8[.]31/bash hxxp://185[.]196[.]8[.]31/ftp hxxp://91[.]92[.]251[.]238/x86_64 hxxp://185[.]196[.]8[.]31/watchdog hxxp://185[.]196[.]8[.]31/wget hxxp://192[.]53[.]123[.]224/i686 hxxp://192[.]53[.]123[.]224/sh4 hxxp://192[.]53[.]123[.]224/mipsel hxxp://192[.]53[.]123[.]224/x86 hxxp://192[.]53[.]123[.]224/armv6l hxxp://185[.]196[.]8[.]31/sh hxxp://185[.]196[.]8[.]31/cron hxxp://185[.]196[.]8[.]31/openssh hxxp://185[.]196[.]8[.]31/ntpd hxxp://185[.]196[.]8[.]31/sshd hxxp://185[.]196[.]8[.]31/pftp |
Bashlite |
| URL | hxxp://86[.]107[.]199[.]30:11011/jquery-3[.]3[.]1[.]min[.]js hxxp://121[.]196[.]200[.]127:7890/QQ[.]exe hxxps://47[.]109[.]58[.]205:8081/visit[.]js hxxps://8[.]220[.]200[.]34/jquery-3[.]3[.]1[.]min[.]js hxxps://62[.]234[.]27[.]204/download/20/ZO2XY7A4BOWU hxxps://154[.]12[.]85[.]5/cx hxxps://43[.]138[.]208[.]188/Fabricate/state/RH3KW9XU hxxps://172[.]234[.]250[.]226/g[.]pixel hxxps://118[.]194[.]233[.]185/ga[.]js hxxps://165[.]232[.]75[.]251/en_US/all[.]js hxxps://156[.]251[.]162[.]29/dpixel hxxps://43[.]142[.]183[.]159/vendorReact[.]dc6a29[.]chunk[.]js hxxp://101[.]35[.]19[.]133/IE9CompatViewList[.]xml hxxp://42[.]194[.]199[.]231:7443/cx hxxps://42[.]51[.]37[.]127:8089/dot[.]gif hxxps://165[.]232[.]123[.]138/ca |
Cobalt Strike |
| URL | hxxp://121[.]196[.]200[.]127:7890/temp[.]jpg | CHINACHOPPER |
| URL | hxxps://pasteio[.]com/raw/xvAmFG2ljHS3 hxxps://pasteio[.]com/raw/x1h52dJdta0O hxxps://pasteio[.]com/raw/xVAHkaX9AHh8 hxxps://pasteio[.]com/raw/xUb2eoyg4AKd hxxps://pasteio[.]com/raw/xPUsBwQzCKSJ hxxps://pasteio[.]com/raw/x6Xw7vcuD9zM hxxps://pasteio[.]com/raw/xOyXTgN3AcgH hxxps://pasteio[.]com/raw/xP1DT0wa77iX hxxps://pasteio[.]com/raw/xX5Vj2W5iyKb hxxps://pasteio[.]com/raw/xmkwFcSoKlvR hxxps://pasteio[.]com/raw/xmsbkx2F0oQn |
NjRAT |
| URL | hxxps://mhsonsco[.]com/ab/edun[.]txt hxxps://paste[.]ee/d/bBqSQ hxxps://mhsonsco[.]com/ab/du[.]txt hxxps://mhsonsco[.]com/ab/edu[.]txt hxxps://api[.]telegram[.]org/bot6754262528:AAENMOTFrAI1hW4DLgs7BB-GIHRczWoyCcU/ hxxps://mhsonsco[.]com/ab/cs[.]txt hxxp://104[.]168[.]32[.]18/xampp/hgh/hg/wecankissinglovershandwithentirethingstogetmebackinhandsheisverybeautiful__itrulyloveherboobstokiss[.]doc hxxp://104[.]168[.]32[.]18/IFEANYI[.]exe |
Agent Tesla |
| URL | hxxp://159[.]253[.]120[.]8/fIkIkpiZ/nissrv[.]exe | XMRig |
| URL | hxxps://studiahoramina[.]cam/treasure/macido12[.]txt hxxps://paste[.]ee/d/8zEgN |
Formbook |
| URL | hxxp://185[.]105[.]91[.]165/bot[.]x86_64 hxxp://185[.]105[.]91[.]165/bot[.]mips hxxp://185[.]105[.]91[.]165/bot[.]arm hxxp://185[.]105[.]91[.]165/bot[.]mpsl hxxp://185[.]105[.]91[.]165/bot[.]ppc hxxp://185[.]105[.]91[.]165/bot[.]arm6 hxxp://185[.]105[.]91[.]165/bot[.]arm7 hxxp://185[.]105[.]91[.]165/bot[.]arm5 hxxp://185[.]105[.]91[.]165/bot[.]spc hxxp://185[.]105[.]91[.]165/bot[.]sh4 hxxp://216[.]126[.]231[.]105/x86_64 hxxp://216[.]126[.]231[.]105/mips hxxp://216[.]126[.]231[.]105/arc hxxp://216[.]126[.]231[.]105/mipsel |
MooBot |
| URL | hxxps://infineitsolutions[.]com/cdn-vs/cache[.]php hxxps://infineitsolutions[.]com/help/zewmrgqnw[.]php hxxps://gitkonus[.]com/data[.]php hxxps://yksiz[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://pfxd[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://lce[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://iuay[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://qdlcq[.]honors[.]howamerica[.]com/editContent hxxps://gaf[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://oqb[.]loans[.]fishingreelinvestments[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://bolibachan[.]com/g[.]txt hxxps://bolibachan[.]com/g[.]txt |
Rhadamanthys |
| URL | hxxps://pasteio[.]com/raw/xApyUPoAYp9c hxxps://pasteio[.]com/raw/xVDnoXtgbTMW hxxps://pasteio[.]com/raw/x2JRJW01JCjq hxxps://duckz[.]online/education/shield/businessletter[.]exe |
AsyncRAT |
| URL | hxxps://pasteio[.]com/raw/xjwP3UYA8ujq hxxp://77[.]221[.]158[.]35/imagejshttpgeoCpuGameBigloadSqlwp[.]php hxxp://89[.]23[.]98[.]225/providerlongpollServermultidbwp[.]php hxxp://109[.]107[.]182[.]28/2BetterPacket/proton/7voiddbCpu2/Longpoll5/5testJsMulti/Packet/pollPrivate[.]php hxxp://79[.]174[.]94[.]153/RequestCpu/GeneratorGame/Datalife02/processorServer/Proton/9/Centraltemp/PythontrafficVideo/4sqlServer/DbCentral7/6PrivatePython/1dle1/WpDle1track/62Wordpress/datalife/Externalexternalvoiddb/Video53base/UploadsDatalife1Pipe/Requestlongpollflower/php_RequestApiprotectWindowsAsyncdatalife[.]php hxxp://330745cm[.]nyashkoon[.]top/_pollPacketmultitesttrackDletemporary[.]php hxxp://967183cm[.]nyashkoon[.]top/_Local[.]php |
DCRat |
| URL | hxxp://24[.]199[.]107[.]111/index[.]php/927339792 hxxp://24[.]199[.]107[.]111/index[.]php/2028 hxxp://24[.]199[.]107[.]111/index[.]php/720637 |
LokiBot |
| URL | hxxp://bop[.]fishoaks[.]net/data/pdf/june[.]exe hxxp://bpeyidu[.]com/search/?q=67e28dd8655bfa7a130da94c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f371ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6586f819c5ec90 hxxp://bpeyidu[.]com/search/?q=67e28dd8655bfa7a130da94c7c27d78406abdd88be4b12eab517aa5c96bd86ee918244895a8bbc896c58e713bc90c91d36b5281fc235a925ed3e50d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c2e792923ece6a hxxp://dldixra[.]info/search/?q=67e28dd8655aa729110daa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd19c7e7909e3c hxxp://csfnyeb[.]net/search/?q=67e28dd83958f721120bac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4fe8889b5e4fa9281ae978f471ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6586f718c2ee92 hxxp://csbmszx[.]net/search/?q=67e28dd86a5cf47e155fff1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd19c8e694933d hxxp://ebwomct[.]ua/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6586f613c1e694 hxxp://ebwomct[.]ua/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86ec9c854e865a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c2e79c983ac46e hxxp://bfbwcrm[.]com/search/?q=67e28dd86e0bf32a420fa9187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd19c9ed94933b hxxp://bfbwcrm[.]com/search/?q=67e28dd86e0bf32a420fa9187c27d78406abdd88be4b12eab517aa5c96bd86ec9d874a815a8bbc896c58e713bc90c91836b5281fc235a925ed3e03d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee979232cf6e9f16 hxxp://ejhivud[.]ua/search/?q=67e28dd8655bfa7a130da94c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f371ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6586f614c8ea92 hxxp://bwefsus[.]com/search/?q=67e28dd86e0bf32a420fa9187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd19c9ea9d9e33 hxxp://bwefsus[.]com/search/?q=67e28dd86e0bf32a420fa9187c27d78406abdd88be4b12eab517aa5c96bd86ec9d874a815a8bbc896c58e713bc90c91836b5281fc235a925ed3e03d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee979232c867921e hxxp://csqvmbe[.]net/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6586f618c4ea94 hxxp://bbmepuy[.]com/search/?q=67e28dd8655aa729110daa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd19c9e6919c39 hxxp://ebtmofd[.]ua/search/?q=67e28dd8680cf4794658a44a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978f571ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6587ff16c0ee92 hxxp://cskkeyu[.]net/search/?q=67e28dd86c09f220490efa1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd18c0e8959a32 |
Socks5 Systemz |
| URL | hxxps://winarkamaps[.]com/live/ hxxps://stratimasesstr[.]com/live/ |
Unidentified 111 (Latrodectus) |
| URL | hxxps://greetclassifytalk[.]shop/api hxxps://entitlementappwo[.]shop/api hxxps://economicscreateojsu[.]shop/api hxxps://pushjellysingeywus[.]shop/api hxxps://absentconvicsjawun[.]shop/api hxxps://suitcaseacanehalk[.]shop/api hxxps://bordersoarmanusjuw[.]shop/api hxxps://mealplayerpreceodsju[.]shop/api hxxps://wifeplasterbakewis[.]shop/api hxxps://palmeventeryjusk[.]shop/api hxxps://telldruggcommitetter[.]shop/api hxxps://orbitpettystudio[.]fun/api hxxps://warningindicationsjw[.]shop/api hxxps://concessionofsellerwo[.]shop/api hxxps://strainriskpropos[.]store/api hxxps://neddlepyramidfunnyjok[.]fun/api hxxps://birdvigorousedetertyw[.]shop/api hxxps://newspaperpotatoju[.]shop/api hxxps://sailsystemeyeusjw[.]shop/api hxxps://rugbysummerosodnwu[.]shop/api hxxps://jewelbasinfrankywoi[.]shop/api hxxps://convictionpartyeokwi[.]shop/api hxxps://competitionpooleow[.]shop/api hxxps://landgateindirectdangre[.]shop/api hxxps://roundpolechildryowjv[.]shop/api hxxps://democraticseekysiwo[.]shop/api hxxps://tearfulbashfulow[.]shop/api hxxps://computerfuneralljwu[.]shop/api hxxps://divosrcemusemutati[.]shop/api hxxps://practicalcoherentt[.]shop/api hxxps://pumpedcalmdeadpannkow[.]shop/api hxxps://meadowannivejrsary[.]shop/api hxxps://awardlandscareposiw[.]shop/api hxxps://chokepopilarvirusew[.]shop/api hxxps://disgustedsorryeedi[.]shop/api hxxps://punchtelephoneverdi[.]store/api hxxps://preciousenviouskakei[.]shop/api hxxps://flowers4everything[.]shop/current[.]exe hxxps://changetheworldwithflowers[.]shop/current[.]exe hxxp://91[.]92[.]255[.]156:8000/crypted[.]exe hxxp://193[.]233[.]132[.]167/lend/superstart[.]exe |
Lumma Stealer |
| URL | hxxp://wikkt[.]com/forum/index[.]php | SmokeLoader |
| URL | hxxp://46[.]183[.]223[.]46:4343/is-ready | WSHRAT |
| URL | hxxp://45[.]15[.]156[.]229/api/firepro[.]php hxxp://85[.]192[.]56[.]26/api/firepro[.]php hxxp://5[.]42[.]66[.]10/api/firecom[.]php hxxp://85[.]192[.]56[.]26/api/firecom[.]php hxxp://5[.]42[.]66[.]10/api/flash[.]php hxxp://85[.]192[.]56[.]26/api/flash[.]php hxxp://5[.]42[.]66[.]10/api/firepro[.]php hxxp://193[.]233[.]132[.]175/server/ww15/AppGate2103v15[.]exe |
PrivateLoader |
| URL | hxxps://wonderforest[.]com/xmlrpc[.]php hxxps://nationalviews[.]com/xmlrpc[.]php hxxps://crochetkim[.]com/xmlrpc[.]php hxxps://www[.]app-gehts[.]de/xmlrpc[.]php hxxps://coolskyfood[.]com/xmlrpc[.]php hxxps://salamfest[.]com/xmlrpc[.]php hxxps://voxpublica[.]no/xmlrpc[.]php hxxps://ambtenarensalaris[.]nl/xmlrpc[.]php hxxps://besocy[.]com/xmlrpc[.]php hxxps://rkbaienfurt[.]de/xmlrpc[.]php hxxps://amerac[.]org/xmlrpc[.]php hxxps://www[.]casagaribaldi[.]it/xmlrpc[.]php hxxps://thepointsking[.]com/xmlrpc[.]php hxxps://www[.]arton-bv[.]nl/xmlrpc[.]php hxxps://textis[.]ru/xmlrpc[.]php hxxps://sigortamsaglik[.]com/xmlrpc[.]php hxxps://cosplayboobies[.]com/xmlrpc[.]php hxxps://arkamaya-grhatama[.]com/xmlrpc[.]php hxxps://pdfkutub[.]net/xmlrpc[.]php hxxps://naghsheshahr[.]com/xmlrpc[.]php hxxps://theceostory[.]in/xmlrpc[.]php hxxps://thll[.]org[.]tw/xmlrpc[.]php hxxps://sparo1[.]se/xmlrpc[.]php hxxps://www[.]estedavivere[.]it/xmlrpc[.]php hxxps://freshysites[.]com/xmlrpc[.]php hxxps://www[.]delcas[.]com[.]br/xmlrpc[.]php hxxps://wahlshausen[.]net/xmlrpc[.]php hxxps://ticketneedlellc[.]com/xmlrpc[.]php hxxps://www[.]dawinmeckel[.]de/xmlrpc[.]php hxxps://etisalangy[.]com/xmlrpc[.]php hxxps://vicbros[.]com/xmlrpc[.]php hxxps://cbseguides[.]com/xmlrpc[.]php hxxps://slimmerverdienen[.]nl/xmlrpc[.]php hxxps://eaalim[.]com/xmlrpc[.]php hxxps://heshamsaad[.]com/xmlrpc[.]php hxxps://giantif[.]com/xmlrpc[.]php hxxps://web-e-reputation[.]com/xmlrpc[.]php hxxps://javtape[.]net/xmlrpc[.]php hxxps://arabfish[.]net/xmlrpc[.]php hxxps://digibaru[.]com/xmlrpc[.]php hxxps://sindipetropb[.]com[.]br/xmlrpc[.]php hxxps://swiatyerby[.]pl/xmlrpc[.]php hxxps://dailysonardesh[.]com/xmlrpc[.]php hxxps://www[.]bokenasetsadra[.]se/xmlrpc[.]php hxxps://lakedistrictbikes[.]com/xmlrpc[.]php hxxps://servicesksa[.]com/xmlrpc[.]php hxxps://www[.]balkanyemekleri[.]com/xmlrpc[.]php hxxps://openaps[.]org/xmlrpc[.]php hxxps://bookmeacookie[.]pl/xmlrpc[.]php hxxps://m-melody[.]jp/xmlrpc[.]php hxxps://measuremarketing[.]com/xmlrpc[.]php hxxps://ctoasaservice[.]org/xmlrpc[.]php hxxps://www[.]cmorgan[.]com/blog/xmlrpc[.]php hxxps://gemak[.]mk/xmlrpc[.]php hxxps://themetorrent[.]org/xmlrpc[.]php hxxps://wct-witcom[.]nl/xmlrpc[.]php |
GootLoader |
| URL | hxxps://files[.]offshore[.]cat/heARGJhW[.]exe hxxp://193[.]233[.]132[.]167/lend/st200[.]exe |
Quasar RAT |
| URL | hxxp://guatemalacayerealestate[.]com/batushka/inte[.]exe | GCleaner |
| URL | hxxp://121[.]41[.]228[.]50:8080/s[.]exe | Ghost RAT |
| URL | hxxp://43[.]226[.]35[.]175/server[.]exe hxxp://43[.]226[.]35[.]175/svchoste[.]exe hxxp://43[.]226[.]35[.]175/explores[.]exe |
Nitol |
| URL | hxxp://193[.]222[.]96[.]163/[.]1 hxxp://193[.]222[.]96[.]163/download/redtail[.]x86_64 hxxp://92[.]60[.]39[.]76:9993/cron |
Coinminer |
| URL | hxxp://109[.]107[.]182[.]183/Ore-Cli-Miner[.]exe | Vidar |
| URL | hxxp://185[.]172[.]128[.]203/timeSync[.]exe hxxp://192[.]121[.]87[.]173/30257e4c371b49a4[.]php hxxp://192[.]121[.]87[.]173/a95bc524d4f5c43a/nss3[.]dll hxxp://89[.]105[.]201[.]33/23cafb7a4fcef13f/nss3[.]dll hxxp://192[.]121[.]87[.]173/a95bc524d4f5c43a/sqlite3[.]dll hxxp://192[.]121[.]87[.]173/a95bc524d4f5c43a/softokn3[.]dll hxxp://192[.]121[.]87[.]173/a95bc524d4f5c43a/freebl3[.]dll hxxp://192[.]121[.]87[.]173/a95bc524d4f5c43a/msvcp140[.]dll hxxp://192[.]121[.]87[.]173/a95bc524d4f5c43a/mozglue[.]dll hxxp://89[.]105[.]201[.]33/23cafb7a4fcef13f/msvcp140[.]dll hxxp://89[.]105[.]201[.]33/23cafb7a4fcef13f/softokn3[.]dll hxxp://89[.]105[.]201[.]33/23cafb7a4fcef13f/mozglue[.]dll hxxp://192[.]121[.]87[.]173/a95bc524d4f5c43a/vcruntime140[.]dll |
Stealc |
| URL | hxxp://117[.]220[.]148[.]179:33784/Mozi[.]m | Mozi |
| URL | hxxps://wtools[.]io/paste-code/bSv9 hxxps://wtools[.]io/paste-code/bSfD hxxps://wtools[.]io/paste-code/bSfl hxxps://wtools[.]io/paste-code/bSd0 hxxps://wtools[.]io/paste-code/bUw4 hxxps://wtools[.]io/paste-code/bKr5 hxxps://wtools[.]io/paste-code/bKsg hxxps://wtools[.]io/paste-code/bLQj hxxps://wtools[.]io/paste-code/bLQl hxxps://wtools[.]io/paste-code/bKr1 hxxps://wtools[.]io/paste-code/bSv4 hxxps://wtools[.]io/paste-code/bSRh hxxps://pasteio[.]com/raw/xBoD1uCJo8Dc hxxps://pasteio[.]com/raw/xffRCvQIkXWb hxxps://wtools[.]io/paste-code/bSwi hxxps://wtools[.]io/paste-code/bSFJ hxxps://pasteio[.]com/raw/xFtTUWcYyK0j hxxps://pasteio[.]com/raw/xh5lfzgFa0QQ hxxps://pasteio[.]com/raw/xggP3BzhZDQC hxxps://wtools[.]io/paste-code/bSkH hxxps://wtools[.]io/paste-code/bSfm hxxps://wtools[.]io/paste-code/bTXR hxxps://wtools[.]io/paste-code/bSvC hxxps://wtools[.]io/paste-code/bLNM hxxps://wtools[.]io/paste-code/bSew hxxps://wtools[.]io/paste-code/bTPL hxxps://wtools[.]io/paste-code/bSFH hxxps://wtools[.]io/paste-code/bSfG hxxps://wtools[.]io/paste-code/bShK hxxps://wtools[.]io/paste-code/bSlz hxxps://wtools[.]io/paste-code/bSv7 hxxps://textbin[.]net/raw/7oanineicw hxxps://wtools[.]io/paste-code/bU42 hxxps://wtools[.]io/paste-code/bU71 |
XWorm |
| URL | hxxp://43[.]138[.]72[.]60:4433/abVC | Metasploit |
| URL | hxxps://pastebin[.]com/raw/WK6RB9ih hxxps://pastebin[.]com/raw/nzbQP3Dd |
PoshC2 |
