不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2024/04/17
※2024/04/17 更新
マルウェア感染させると考えられるURLを検知（2024/04/17）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://91[.]92[.]243[.]252/bot[.]x86 hxxp://91[.]92[.]243[.]252/bot[.]m68k |
MooBot |
| URL | hxxp://103[.]14[.]155[.]180/JRwutlYVLMZnGxXxhWCGQwMq76[.]bin hxxp://103[.]14[.]155[.]180/TVrwrzfWGuqMhmO198[.]bin hxxp://103[.]14[.]155[.]180/BWcIlRKTlfvBlyBS167[.]bin hxxp://103[.]14[.]155[.]180/bEtaNzB191[.]bin hxxp://103[.]14[.]155[.]180/grcjsMS32[.]bin hxxp://103[.]14[.]155[.]180/KFhYG187[.]bin hxxp://103[.]14[.]155[.]180/bVQAB57[.]bin hxxp://103[.]14[.]155[.]180/HTLKCtI210[.]bin hxxp://103[.]14[.]155[.]180/lTgvvWnlz183[.]bin hxxp://103[.]14[.]155[.]180/yfQTqBeMZ77[.]bin hxxp://103[.]14[.]155[.]180/AJiUJeCwtysrVswj26[.]bin hxxp://94[.]156[.]79[.]64/ZtoOstiFBXtBvORCuTFplvl84[.]bin hxxp://94[.]156[.]79[.]64/strygetjs[.]thn hxxp://103[.]14[.]155[.]180/wTqiMCLOBBYLa46[.]bin hxxp://103[.]14[.]155[.]180/CkkRLCTUxW193[.]bin hxxp://103[.]14[.]155[.]180/aRyVuImgACp184[.]bin hxxp://103[.]14[.]155[.]180/rEDLvxUewsH193[.]bin hxxp://103[.]14[.]155[.]180/Thicmg208[.]bin |
CloudEyE |
| URL | hxxp://192[.]3[.]95[.]218/100/RVC[.]txt hxxps://paste[.]ee/d/DirUs hxxp://192[.]3[.]95[.]218/100/sampleimagepixel[.]jpeg hxxp://192[.]3[.]95[.]218/100/gmmp/wetrytosexwithhertrulyfromtheheartbecausesheisverybeautigfulgirlwholikesxwthmefromtheheart___toundersadhowmuchiwantherforexsheisvey[.]doc hxxp://192[.]3[.]95[.]135/xampp/wed/iwanttosxwithudeeolybecauseitrulylovesxwithoumygirlireallymissingu__nowiwantsxwithou[.]doc hxxp://192[.]3[.]95[.]218/5455/gmn/needfreshlovequotestotakeyouininterestedkisserloverwhohavesuchamemorytoloveherkisshertrulyfor__sheisbeautifulgirl[.]doc hxxp://45[.]133[.]174[.]22/2090/jhn/iamwithyoubecauseiloveyoualotwhichneverbeenforesxyoumysweetheartialwaysloveryoutrulybeaucse___ineverwanttokissyou[.]doc hxxp://45[.]133[.]174[.]22/2090/imagepixelsample[.]jpeg hxxp://45[.]133[.]174[.]22/2090/WED[.]txt hxxps://paste[.]ee/d/pvzU1 hxxps://paste[.]ee/d/0Q4c2 hxxp://107[.]173[.]4[.]5/950/mnk/wegendideaofloverstogetbackinthelinetounderstandhowmuchilikeyoumorethanallseeher____youmygirlialwayslove[.]doc hxxp://107[.]173[.]4[.]5/950/JULI[.]txt hxxp://107[.]173[.]4[.]5/950/imaginepixelsample[.]jpeg hxxp://192[.]3[.]95[.]218/5455/GMN[.]txt hxxp://192[.]3[.]95[.]218/5455/Examplofpixelimage[.]jpeg hxxp://lnkz[.]at/iOxIm hxxps://lnkz[.]at/iOxIm hxxp://192[.]3[.]95[.]135/M1504T/wininit[.]exe |
Remcos |
| URL | hxxp://94[.]103[.]83[.]221/orla/nutrex[.]zip | Ousaban |
| URL | hxxp://193[.]222[.]96[.]41:7287/xxx[.]bat hxxp://193[.]222[.]96[.]41:7287/[.]hta hxxp://194[.]48[.]251[.]169:7287/gogis[.]bat hxxp://194[.]48[.]251[.]169:7287/[.]hta hxxp://194[.]48[.]251[.]169:7287/2[.]hta hxxp://194[.]48[.]251[.]169:7287/3[.]hta |
Venom RAT |
| URL | hxxp://37[.]44[.]238[.]78/FBI[.]x86 hxxp://45[.]128[.]232[.]245/var hxxp://45[.]128[.]232[.]245/nano hxxp://185[.]196[.]8[.]143/sparc hxxp://37[.]44[.]238[.]78/FBI[.]arm hxxp://37[.]44[.]238[.]78/FBI[.]arm5 hxxp://89[.]190[.]156[.]227/a-r[.]m-7[.]SNOOPY hxxp://89[.]190[.]156[.]227/s-h[.]4-[.]SNOOPY hxxp://89[.]190[.]156[.]227/m-i[.]p-s[.]SNOOPY hxxp://93[.]123[.]85[.]170/Kermithy122156huk[.]i686 hxxp://93[.]123[.]85[.]170/Kermithy1221gzf74j[.]spc hxxp://93[.]123[.]85[.]170/Kermithy122187g4jzh[.]mips hxxp://93[.]123[.]85[.]170/Kermithy12215j6kil[.]arm4 hxxp://93[.]123[.]85[.]170/Kermithy1221541uhlki[.]arm4t hxxp://93[.]123[.]85[.]170/Kermithy122154gzhj[.]sh4 hxxp://93[.]123[.]85[.]170/Kermithy12214g8jfzt[.]x86 hxxp://93[.]123[.]85[.]170/Kermithy1221ghz49j8[.]mpsl hxxp://93[.]123[.]85[.]170/Kermithy1221g4zhhgkj[.]m68 hxxp://93[.]123[.]85[.]170/Kermithy122145vhgj[.]ppc hxxp://5[.]181[.]190[.]250/cbr[.]x86 hxxp://5[.]181[.]190[.]250/cbr[.]mpsl hxxp://93[.]123[.]85[.]170/Kermithy1221hu54k[.]arm5 hxxp://93[.]123[.]85[.]170/Kermithy1221u54kh[.]arm6 hxxp://93[.]123[.]85[.]170/Kermithy1221gzj487[.]arm7 hxxp://216[.]219[.]94[.]124/arm7 hxxp://74[.]50[.]84[.]163/arm7 |
Bashlite |
| URL | hxxps://github[.]com/SnusikOd/fac/raw/main/pgifswa[.]exe | Lumma Stealer |
| URL | hxxp://185[.]172[.]128[.]59/ISetup7[.]exe | Stealc |
| URL | hxxps://covid19help[.]top/xobizx[.]scr hxxps://mhsonsco[.]com/wp-admin/eccci[.]txt hxxps://api[.]telegram[.]org/bot6359985836:AAEpvgyD3CBEihuwlXNMLbKTgPfew2N22lc/ hxxps://onedrive[.]live[.]com/download?resid=BD9480D014FE52E5%21728&authkey=!ALxUAatMNPQtjNQ hxxps://paste[.]ee/d/GoJkX hxxps://api[.]telegram[.]org/bot6301531460:AAFcZcgRIhvIWXgEIpEmxy4QiTQLLTaSXD8/ hxxps://dukeenergyltd[.]top/m4V7uvgzXDHblwp[.]scr hxxps://api[.]telegram[.]org/bot7147210487:AAHKvVx3DCVxuSkFtordZnoJ0amnmAhHqJ8/ hxxps://discord[.]com/api/webhooks/1227209886782328933/lf2FJykqNaO8-7mFVKnvSLY61VW8wLCP8wff1tbXhDTXQtiSfiF1rnTRNJ0B15pF_Nje hxxps://api[.]telegram[.]org/bot6802803611:AAGpkOXh1yiUdrFGbg2d_rgtxPR9P8L5C4g/ |
Agent Tesla |
| URL | hxxp://twizt[.]net/newpinf[.]exe | Phorpiex |
| URL | hxxps://api[.]telegram[.]org/bot7070490418:AAFJ-COsGzz3b8scJZVCXnt58-J1srUH5DQ/sendMessage?chat_id=5590273095 hxxp://dsaq[.]shop/sSAniuSX/ofile4162024[.]exe hxxp://dsaq[.]shop/knUXGvBL/file4152024[.]exe |
DarkCloud |
| URL | hxxp://blue[.]o7lab[.]me/svchost[.]exe hxxp://185[.]196[.]10[.]233/tyttuyty[.]exe |
zgRAT |
| URL | hxxps://173[.]44[.]141[.]234/jquery-3[.]3[.]1[.]min[.]js hxxps://service-lj3klqg6-1308639534[.]gz[.]tencentapigw[.]com[.]cn/api/getit hxxps://microsoft-net[.]com/ki hxxps://zgjatj[.]com/cm hxxp://118[.]194[.]233[.]185/match hxxps://45[.]55[.]199[.]36/ptj hxxps://167[.]71[.]242[.]213/match hxxps://165[.]227[.]108[.]186/cm hxxps://service-e1idmqlj-1259321672[.]bj[.]tencentapigw[.]com[.]cn/api/x hxxps://77[.]91[.]122[.]210/Demonstrate/v3[.]76/T35I67NJAKO hxxps://154[.]8[.]187[.]123/jp hxxps://192[.]144[.]195[.]26/jp hxxps://154[.]8[.]187[.]177/RELEASE |
Cobalt Strike |
| URL | hxxp://45[.]88[.]90[.]68:5000/%2477xmrig[.]exe | Coinminer |
| URL | hxxp://45[.]128[.]96[.]204:222/slasl[.]txt hxxp://45[.]128[.]96[.]204:222/bar[.]jpg hxxp://87[.]120[.]84[.]91:222/g[.]jpg hxxp://87[.]120[.]84[.]91:222/cH5[.]txt hxxps://pasteio[.]com/raw/xutnF2gKGTTy hxxp://93[.]123[.]39[.]68/ex[.]exe |
AsyncRAT |
| URL | hxxp://sdshsjakdjsaljdkasda[.]ru/images/logo2[.]jpg | Cutwail |
| URL | hxxps://gitkonus[.]com/data[.]php?7086 hxxps://gitkonus[.]com/data[.]php?8082 hxxps://gitkonus[.]com/data[.]php?5568 hxxps://jhansgansowen[.]com/help/per[.]php |
NetSupportManager RAT |
| URL | hxxp://107[.]175[.]69[.]54/wsa/txt/otp/web_page/admin/indexphp[.]txt hxxps://paste[.]ee/d/dNKmp |
XWorm |
| URL | hxxp://24[.]199[.]107[.]111/index[.]php/0672554332862 hxxp://136[.]244[.]109[.]75/index[.]php/690877741063 hxxp://136[.]244[.]109[.]75/index[.]php/1748937 hxxp://136[.]244[.]109[.]75/index[.]php/08409289280180 |
LokiBot |
| URL | hxxps://pasteio[.]com/raw/x8bhH6zQch6v | NjRAT |
| URL | hxxps://nqld[.]register[.]arpsychotherapy[.]com/editContent hxxps://kingofdolomites[.]com/data[.]php hxxps://zdj[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://kij[.]register[.]arpsychotherapy[.]com/editContent |
FAKEUPDATES |
| URL | hxxps://pasteio[.]com/raw/xM6280MQQPyf | DCRat |
