不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2024/05/01
※2024/05/01 更新
マルウェア感染させると考えられるURLを検知（2024/05/01）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://23[.]95[.]60[.]77/mrngwescreentherootforentirepurposehappenedwthhappinessskeisverybeatuiful___heisverygoodnadbeautiufl[.]doc hxxps://paste[.]ee/d/EWe8W hxxp://23[.]95[.]60[.]77/morningxla[.]js hxxp://104[.]168[.]45[.]23/9090/jhn/iwanttokiswithlotoflovesheismygirlitrulylovedherfromtheheartmysweetbabymyheartiwantsheiswithme___girlbeautifysxyandmorethanthat[.]doc hxxp://104[.]168[.]45[.]23/9090/NEWST[.]txt hxxp://104[.]168[.]45[.]23/9090/imageveryclearfisherman[.]gif hxxps://paste[.]ee/d/xsPQV hxxp://23[.]95[.]60[.]77/baze64444[.]txt hxxps://api[.]telegram[.]org/bot7109324415:AAEtV_HPY0H5mFN38xCDvDx9wl-kKb9q3qg/ hxxps://api[.]telegram[.]org/bot6848173762:AAGkzL4gp0AnmZ6UfiPCUuUFvn7Vkjdjn1M/ hxxp://ralucamihaela[.]ro/PL[.]bin hxxps://api[.]telegram[.]org/bot7143195560:AAEToqSkXmLus1jbe-JBUX8QePqj0Vv86iI/ hxxps://api[.]telegram[.]org/bot7002188328:AAFA29xakyQCzaIDnszSTa7tpvWrXgbbr6w/ hxxps://api[.]telegram[.]org/bot7185592808:AAH40VecOIxIokAMjd2dL-3MoQxpbXJyxfE/ |
Agent Tesla |
| URL | hxxps://paste[.]ee/d/F74QB hxxp://107[.]175[.]242[.]96/90818/GTRR[.]txt hxxp://107[.]175[.]242[.]96/90818/scrr/multiplepeoplessayingheisverygoodpersonsoicanabletounderstandhowmuchgoodheisimeangoodgirl___sheisverybeautifulgirlformetogetit[.]doc hxxp://107[.]175[.]242[.]96/90818/examplepixelimages[.]gif hxxp://107[.]172[.]31[.]6/9009/DFG[.]txt hxxps://paste[.]ee/d/dxGcH hxxp://107[.]172[.]31[.]6/9009/imagepixelsample[.]gif hxxp://107[.]172[.]31[.]6/9009/hjm/softmindwithagoodheartpersonwinentireworldheartfromthepeopleswhoilovedbeautiful__girlsheknowhowltolovemegreatwayshe[.]doc hxxps://staygeraldine[.]nz/cs/HVAPRIL[.]txt hxxps://staygeraldine[.]nz/cs/reccc[.]txt hxxps://pastebin[.]com/raw/eEY9exCe hxxps://joccupationalscience[.]org/ap/xwapri[.]txt hxxps://pastebin[.]com/raw/nDU16UcU hxxp://84[.]252[.]122[.]48/yakfileloadsonedrivedocumentsuploadgoogleapclouddownloads/255_Jroqjrqxvse hxxp://84[.]252[.]122[.]48/wosoeoacoiouroeasazazaooeurooeoasas/255_Zhfwuyuhaur hxxps://paste[.]ee/d/BGCbt hxxp://107[.]175[.]242[.]96/90811/BTRKC/fishermansaidyouaremyloverbecauseitrulyloveyoufromtheheartmysweetheartmysweetkissyouaremybeautifulwomen___ialwaysrememberyoumorethananyone[.]doc hxxps://paste[.]ee/d/yRHcu hxxp://107[.]175[.]242[.]96/90811/BTKBC[.]txt hxxp://107[.]172[.]31[.]6/5010/HTC[.]txt hxxp://107[.]172[.]31[.]6/5010/frg/wedesingedfisherboattounderstanditsaworthfulthingstogetherbacksheisverybeatufiulgirlfrommyheartsheisgirl___womenslverkssinglipher[.]doc hxxp://107[.]172[.]31[.]6/5010/imagefishermankissinggirl[.]gif hxxp://107[.]175[.]242[.]96/90811/imageofthefishermankiss[.]gif hxxps://pasteio[.]com/raw/xvcTW52mDihb hxxps://pasteio[.]com/raw/x4h6Jb7KbaVX |
Remcos |
| URL | hxxps://onedrive[.]live[.]com/download?resid=59261C7E41B6478A%21212&authkey=!AGX6xU7A8tJFwjs hxxps://onedrive[.]live[.]com/download?resid=59261C7E41B6478A%21215&authkey=!AILxsvzlZboP3io |
Warzone RAT |
| URL | hxxp://park-your-track[.]com/nnZsA79[.]bin hxxp://94[.]156[.]79[.]233/fkKcX162[.]bin hxxp://209[.]90[.]233[.]2/zfkEkZP175[.]bin hxxp://209[.]90[.]233[.]2/gsYrgKgGl239[.]bin hxxp://193[.]239[.]86[.]183/CndxUYYSCGouQBVTC207[.]bin hxxp://209[.]90[.]234[.]47/OIGiKpMVqfMXzWuUkA221[.]bin hxxp://ralucamihaela[.]ro/EX[.]bin hxxp://ralucamihaela[.]ro/GR1[.]bin hxxp://ralucamihaela[.]ro/GR[.]bin hxxp://193[.]239[.]86[.]183/uqQmlFTCausVPGkZZ168[.]bin |
CloudEyE |
| URL | hxxps://mathsclass[.]vn/wp-content/plugins/share-private-fls/shared/?check=true hxxps://parthait[.]com/wp-content/plugins/share-private-fls/shared hxxps://lle[.]uz/wp-content/plugins/share-private-fls/shared hxxps://manuurulwaahid[.]sch[.]id/wp-content/plugins/share-private-fls/shared hxxps://lew-hoad[.]com/wp-content/plugins/share-private-fls/shared hxxps://myquickandeasy[.]com/wp-content/plugins/share-private-fls/shared hxxps://panakalresidence[.]com/wp-content/plugins/share-private-fls/shared hxxps://narutoanimes[.]com/wp-content/plugins/share-private-fls/shared hxxps://new[.]botellaflaske[.]com/wp-content/plugins/share-private-fls/shared hxxps://mbdashcam[.]com/wp-content/plugins/share-private-fls/shared hxxps://lurningbuff[.]com/wp-content/plugins/share-private-fls/shared hxxps://mixstore[.]com[.]mx/wp-content/plugins/share-private-fls/shared hxxps://mahmoud-radwan[.]com/wp-content/plugins/share-private-fls/shared hxxps://nyklawyer[.]com/wp-content/plugins/share-private-fls/shared hxxps://mozkraty[.]org/wp-content/plugins/share-private-fls/shared hxxps://nobledeals[.]co[.]ke/wp-content/plugins/share-private-fls/shared hxxps://meletesergon[.]gr/wp-content/plugins/share-private-fls/shared hxxps://nickicecream[.]gr/wp-content/plugins/share-private-fls/shared hxxps://patriziamarazzi[.]com/wp-content/plugins/share-private-fls/shared hxxps://mydesinger[.]com/wp-content/plugins/share-private-fls/shared hxxps://mundo-felpa[.]es/wp-content/plugins/share-private-fls/shared hxxps://lawclerksfordiversity[.]com/wp-content/plugins/share-private-fls/shared hxxps://mining[.]jaguarmall[.]in/code/core/database/press/wp-content/plugins/share-private-fls/shared hxxps://jms[.]edu[.]np/wp-content/plugins/share-private-fls/shared hxxps://ponyevent[.]vn/wp-content/plugins/share-private-fls/shared hxxps://jasarenovasibangunrumahmalang[.]com/wp-content/plugins/share-private-fls/shared hxxps://grupobudeguer[.]com/wp-content/plugins/share-private-fls/shared hxxps://joshiwater[.]com/wp-content/plugins/share-private-fls/shared hxxps://ladakhescapades[.]com/wp-content/plugins/share-private-fls/shared hxxps://gifdemo[.]com/mertmetdemo/wp-content/plugins/share-private-fls/shared hxxps://gifdemo[.]com/gps_sunum/wp-content/plugins/share-private-fls/shared hxxps://hawaiismartshopper[.]com/wp-content/plugins/share-private-fls/shared hxxps://ebs-company[.]xyz/wp-content/plugins/share-private-fls/shared hxxps://karamelitses[.]gr/wp-content/plugins/share-private-fls/shared hxxps://goasoftwarecompany[.]com/Doxa_Organic/wp-content/plugins/share-private-fls/shared hxxps://hadjer[.]boutique/wp-content/plugins/share-private-fls/shared hxxps://penjualanpommini[.]com/wp-content/plugins/share-private-fls/shared hxxps://espaciodiseno[.]es/wp-content/plugins/share-private-fls/shared hxxps://elitpuro1[.]com/wp-content/plugins/share-private-fls/shared hxxps://himeraveteriner[.]com/himera-v1/wp-content/plugins/share-private-fls/shared hxxps://kartsiotis[.]net/wp-content/plugins/share-private-fls/shared hxxps://hvg[.]si/wp-content/plugins/share-private-fls/shared hxxps://pavicomsa[.]com/wp-content/plugins/share-private-fls/shared hxxps://infojobone[.]com/wp-content/plugins/share-private-fls/shared hxxps://guidespharma[.]com/wp-content/plugins/share-private-fls/shared hxxps://jobsportal360[.]com/wp-content/plugins/share-private-fls/shared hxxps://gaming-gears[.]com/wp-content/plugins/share-private-fls/shared hxxps://ivtmarkets[.]com/wp-content/plugins/share-private-fls/shared hxxps://hakelectromechanical[.]com/wp-content/plugins/share-private-fls/shared hxxps://equranteacher[.]net/wp-content/plugins/share-private-fls/shared hxxps://hunarghar[.]org[.]pk/wp-content/plugins/share-private-fls/shared hxxps://friendswekeep[.]vecloffy[.]co[.]za/vecloffy/wp-content/plugins/share-private-fls/shared hxxps://wisdomlawacademy[.]com/wp-content/plugins/share-private-fls/shared hxxps://ruedastock[.]cl/wp-content/plugins/share-private-fls/shared hxxps://tomitakaengenharia[.]com[.]br/wp-content/plugins/share-private-fls/shared hxxps://slot[.]hoki66[.]com/wp-content/plugins/share-private-fls/shared hxxps://shredderindia[.]com/wp-content/plugins/share-private-fls/shared/?check=true hxxps://puntobar[.]cl/wp-content/plugins/share-private-fls/shared hxxps://wecancity[.]org/ahmed/wp-content/plugins/share-private-fls/shared hxxps://template[.]majestic-corporation[.]com/wp-content/plugins/share-private-fls/shared hxxps://testing[.]vidharm[.]com/wp-content/plugins/share-private-fls/shared hxxps://subwaymenu[.]uk/wp-content/plugins/share-private-fls/shared hxxps://turkishmarinesurvey[.]com/wp-content/plugins/share-private-fls/shared hxxps://toyssolution[.]cloud/wp-content/plugins/share-private-fls/shared hxxps://smartoptiontrade[.]online/account/wp-content/plugins/share-private-fls/shared hxxps://toptradingoption[.]com/account/wp-content/plugins/share-private-fls/shared hxxps://ptcmbp[.]com/wp-content/plugins/share-private-fls/shared hxxps://tirtaningnusantara[.]com/wp-content/plugins/share-private-fls/shared hxxps://templarstore[.]com/wp-content/plugins/share-private-fls/shared hxxps://vincecomfort[.]com/social/wp-content/plugins/share-private-fls/shared hxxps://themetafounders[.]com/web/chris-csp/wp-content/plugins/share-private-fls/shared hxxps://take3llcphotobooth[.]com/TakeNew/wp-content/plugins/share-private-fls/shared hxxps://tour[.]culturetoursja[.]com/wp-content/plugins/share-private-fls/shared hxxps://summerlanddogtraining[.]com/wp-content/plugins/share-private-fls/shared hxxps://themusclemob[.]themetafounders[.]com/wp-content/plugins/share-private-fls/shared hxxps://vilape[.]online/wp-content/plugins/share-private-fls/shared hxxps://vnfreetourguides[.]com/wp-content/plugins/share-private-fls/shared hxxps://sociallysnap[.]com/wp-content/plugins/share-private-fls/shared hxxps://thecocopacific[.]com/wp-content/plugins/share-private-fls/shared hxxps://portstanleycalipso[.]com/wp-content/plugins/share-private-fls/shared hxxps://vcfiling[.]pk/wp-content/plugins/share-private-fls/shared hxxps://sanvikevents[.]com/wp-content/plugins/share-private-fls/shared hxxps://vhs[.]decospaacloud[.]in/wp-content/plugins/share-private-fls/shared hxxps://svango[.]com/wp-content/plugins/share-private-fls/shared hxxps://vridhifashions[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]tajimateknikservis[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]crickrocket[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]bodegabudeguer[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]vccg[.]com[.]au/wp-content/plugins/share-private-fls/shared hxxps://zatracon[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]fit4life[.]es/wp-content/plugins/share-private-fls/shared hxxps://wlfw[.]themetafounders[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]qi-code[.]com/wp-content/plugins/share-private-fls/shared hxxps://zeemark[.]in/wp-content/plugins/share-private-fls/shared hxxps://www[.]wonderwritings[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]meilinhotels[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]eurotravel[.]com[.]gr/wp-content/plugins/share-private-fls/shared hxxps://www[.]hawaiiislandmidweek[.]com/wp-content/plugins/share-private-fls/shared hxxps://youpickcarepackages[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]kathatours[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]ferentino[.]org/wp-content/plugins/share-private-fls/shared hxxps://www[.]valex-dz[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]loja[.]consolata[.]pt/news/wp-content/plugins/share-private-fls/shared hxxps://www[.]topinoxsenegal[.]com/wp-content/plugins/share-private-fls/shared hxxps://www[.]darkknight-media[.]com/tasawer/wp-content/plugins/share-private-fls/shared hxxps://www[.]tatuhirdavat[.]com/wp-content/plugins/share-private-fls/shared hxxps://790wolseleymanagement[.]com/wp-content/plugins/share-private-fls/shared hxxps://blog[.]multitamamedia[.]com/wp-content/plugins/share-private-fls/shared hxxps://alsiga[.]com/wp-content/plugins/share-private-fls/shared hxxps://zk1construction[.]com/wp-content/plugins/share-private-fls/shared hxxps://doulosarts[.]com[.]br/wp-content/plugins/share-private-fls/shared hxxp://onemascot[.]com/wp-content/plugins/share-private-fls/shared hxxps://camerabaoha[.]com/wp-content/plugins/share-private-fls/shared/?check=true hxxps://donatechantroimoi[.]com/wp-content/plugins/share-private-fls/shared/?check=true hxxps://christianbookindia[.]com/wp-content/plugins/share-private-fls/shared hxxps://dolasimuka[.]com/wp-content/plugins/share-private-fls/shared hxxps://djibg[.]eu/wp-content/plugins/share-private-fls/shared hxxps://bar[.]dosdevelopers[.]com/wp-content/plugins/share-private-fls/shared hxxps://abd[.]com[.]tr/wp-content/plugins/share-private-fls/shared hxxps://ariesjagnivas[.]com/wp-content/plugins/share-private-fls/shared hxxps://aryanlogisticpune[.]in/wp-content/plugins/share-private-fls/shared hxxps://cricrapid[.]com/wp-content/plugins/share-private-fls/shared hxxps://dhlawfirm[.]site/wp-content/plugins/share-private-fls/shared hxxps://compresoresdetornillo[.]com[.]pe/wp-content/plugins/share-private-fls/shared hxxps://digitalssystems[.]com/wp-content/plugins/share-private-fls/shared hxxp://www[.]loja[.]consolata[.]pt/news/wp-content/plugins/share-private-fls/shared hxxp://www[.]skytechtraders[.]com/wp-content/plugins/share-private-fls/shared hxxps://contractnerds[.]com/wp-content/plugins/share-private-fls/shared hxxps://cytotecsolutions[.]com/wp-content/plugins/share-private-fls/shared hxxps://aavishkaar-palampur[.]org/wp-content/plugins/share-private-fls/shared hxxp://especial[.]cargasproprias[.]org/wp-content/plugins/share-private-fls/shared hxxps://coronacreatives[.]com/wp-content/plugins/share-private-fls/shared hxxps://deadvogados[.]com/wp-content/plugins/share-private-fls/shared hxxps://didacweb[.]xyz/intuitionbycg/wp-content/plugins/share-private-fls/shared hxxps://dealerpertamini[.]com/wp-content/plugins/share-private-fls/shared hxxps://dickypommini[.]com/wp-content/plugins/share-private-fls/shared hxxps://99homes[.]co/wp-content/plugins/share-private-fls/shared hxxps://delight[.]mv/wp-content/plugins/share-private-fls/shared hxxps://dpmpommini[.]com/wp-content/plugins/share-private-fls/shared hxxps://brikule[.]cz/wp-content/plugins/share-private-fls/shared/?check=true hxxps://alealealpargatas[.]com/wp-content/plugins/share-private-fls/shared hxxp://vridhifashions[.]com/wp-content/plugins/share-private-fls/shared hxxps://abhitaak[.]com/wp-content/plugins/share-private-fls/shared hxxp://azucania[.]com[.]ar/wp-content/plugins/share-private-fls/shared hxxp://dsengineer[.]in/wp-content/plugins/share-private-fls/shared hxxp://161[.]97[.]170[.]81/ceptics/wp-content/plugins/share-private-fls/shared hxxp://besparta[.]com/markaworks/wp-content/plugins/share-private-fls/shared |
Unidentified 111 (Latrodectus) |
| URL | hxxp://dcpanel[.]squezz[.]com/svchostMon[.]exe hxxp://198[.]46[.]129[.]145/f hxxp://84[.]54[.]51[.]78/f |
Coinminer |
| URL | hxxp://public-ftp[.]com/img/logo5[.]jpg | Lumma Stealer |
| URL | hxxps://postutopia[.]net/wp-includes/images/smilies/Output[.]js | WSHRAT |
| URL | hxxps://universalmovies[.]top/findpeacebin[.]scr hxxps://universalmovies[.]top/teebin[.]scr hxxp://103[.]29[.]0[.]182/kung/bin[.]exe hxxps://absorbante-calitate[.]ro/calitateX/NLonIQWPMHAhOKeszHpRTm43[.]bin hxxp://87[.]121[.]105[.]163/tWVvmOpHE254[.]bin hxxp://www[.]arilyfarlico[.]ru/8cgp/ hxxp://103[.]29[.]0[.]182/xampp/wdf/wearegoingtobegoodwithmebecauseireallylovethisallpersonandinotwanttodonothingbecausesheisverybeautifulgirl___iunderstandsheisgoodo[.]doc hxxps://covid19help[.]top/op[.]scr |
Formbook |
| URL | hxxps://paste[.]ee/d/thAhY hxxps://pasteio[.]com/raw/xrPfnwOyJZqd |
XWorm |
| URL | hxxps://mopilost[.]top/dropak[.]bs64 | zgRAT |
| URL | hxxp://twizt[.]net/shitload[.]exe | Phorpiex |
| URL | hxxp://116[.]62[.]197[.]217:81/en_US/all[.]js hxxp://60[.]204[.]220[.]208/activity hxxp://47[.]108[.]153[.]69:7777/load hxxp://47[.]113[.]195[.]22/fwlink hxxps://43[.]130[.]60[.]49/cm hxxp://finance[.]kumbaraan[.]biz[.]id/dhl hxxps://128[.]199[.]178[.]134/g[.]pixel hxxp://124[.]220[.]28[.]253:8080/en_US/all[.]js hxxp://173[.]211[.]46[.]172/g[.]pixel hxxps://173[.]211[.]46[.]172/pixel hxxps://visualstudio[.]microsoft[.]com[.]volcgslb-mlt[.]com/mall_100_100[.]html hxxps://finance[.]kumbaraan[.]biz[.]id/dhl hxxps://breakingnews[.]kumbaraan[.]biz[.]id/ee hxxp://124[.]220[.]148[.]63:8888/api/x hxxp://45[.]116[.]79[.]9/en_US/all[.]js hxxp://124[.]220[.]148[.]63:8889/api/x hxxp://124[.]220[.]148[.]63:9000/api/x hxxp://192[.]144[.]233[.]13/jquery-3[.]3[.]1[.]min[.]js hxxp://114[.]132[.]120[.]166:7071/jquery-3[.]3[.]3[.]min[.]js hxxp://101[.]36[.]117[.]53/ga[.]js hxxps://fibersee[.]com/ch hxxp://178[.]208[.]87[.]34/I3LEss01 hxxp://107[.]175[.]158[.]78/j[.]ad hxxp://124[.]222[.]56[.]66/cm hxxp://124[.]220[.]148[.]63:9001/api/x hxxp://117[.]72[.]65[.]27/g[.]pixel hxxp://103[.]69[.]129[.]34/jquery-3[.]3[.]1[.]min[.]js hxxp://45[.]158[.]21[.]47:81/jquery-3[.]3[.]1[.]min[.]js hxxp://107[.]173[.]30[.]114:8989/match |
Cobalt Strike |
| URL | hxxps://jyjgoyydia[.]com/M2EyOTM2M2FlY2My/ | Coper |
| URL | hxxp://185[.]81[.]29[.]119/acrobatreaderpro[.]exe | Meterpreter |
| URL | hxxps://totalhorsehealth[.]com/wp-admin/images/images/im/im[.]png | AsyncRAT |
| URL | hxxps://shaffatta[.]com/d32e011d2eaa85a0/mozglue[.]dll hxxps://shaffatta[.]com/d32e011d2eaa85a0/softokn3[.]dll hxxps://shaffatta[.]com/d32e011d2eaa85a0/nss3[.]dll hxxps://shaffatta[.]com/d32e011d2eaa85a0/sqlite3[.]dll hxxps://shaffatta[.]com/d32e011d2eaa85a0/vcruntime140[.]dll hxxps://shaffatta[.]com/d32e011d2eaa85a0/freebl3[.]dll hxxps://shaffatta[.]com/d32e011d2eaa85a0/msvcp140[.]dll hxxps://shaffatta[.]com/fdca69ae739b4897[.]php |
Stealc |
| URL | hxxps://unokodkelas[.]cl/wp-content/themes/twentytwenty/pttfrp[.]php?id=1 hxxps://www[.]judicialconsulting[.]es/wp-content/themes/hello-elementor/t745ny[.]php?id=1 hxxps://rariate[.]com/ph/wp-content/themes/twentytwentythree/6rndt2[.]php?id=1 hxxps://polarishousingsystems[.]com/wp-content/themes/twentytwentyfour/qshgfl[.]php?id=1 hxxps://dorseydorse[.]com/wp-content/themes/twentytwenty/i4imyy[.]php?id=1 hxxps://barliam[.]com/ph/wp-content/themes/twentytwentythree/plxka3[.]php?id=1 |
WikiLoader |
| URL | hxxps://afjll[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://xbwh[.]demo[.]betterbuiltdogs[.]com/editContent |
FAKEUPDATES |
