不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様6社 -
2024/05/31
※2024/05/31 更新
マルウェア感染させると考えられるURLを検知（2024/05/31）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://1[.]14[.]247[.]162:8888/reverse_http[.]msi hxxp://1[.]14[.]247[.]162:8888/reverse_tcp_uuid[.]msi hxxp://1[.]14[.]247[.]162:8888/reverse_tcp[.]msi |
Meterpreter |
| URL | hxxp://39[.]99[.]131[.]244/coreminer-linux-x86_64[.]tar[.]gz hxxp://39[.]99[.]131[.]244/powershell/start-powershellfordopaddcrontab[.]psl hxxp://39[.]99[.]131[.]244/powershell/start-powershellfordop[.]txt hxxp://39[.]99[.]131[.]244/powershell/start-powershellxlies[.]txt hxxp://b[.]9-9-8[.]com/brysj/d//ar[.]sh hxxp://77[.]221[.]151[.]47//install[.]exe |
Coinminer |
| URL | hxxp://1[.]14[.]247[.]162:40001/GV_avNynVjlUxVXEMRJYfgkwNqbaOT2v9_VUCcSK8cpcf6987xqrQGI_TpQZAAxoszBBTm6HevhBHokGXDoLBz0GjVb8TaoWwpliHEh8_9uQGHUmi hxxp://1[.]14[.]247[.]162:8888/reverse_winhttp[.]msi hxxp://1[.]14[.]247[.]162:8888/reverse_tcp_uuid[.]hta hxxp://1[.]14[.]247[.]162:8888/reverse_tcp[.]hta hxxp://1[.]14[.]247[.]162:8888/bind_tcp_uuid[.]msi hxxp://1[.]14[.]247[.]162:8888/bind_tcp[.]msi hxxp://1[.]14[.]247[.]162:8888/reverse_http[.]hta hxxp://1[.]14[.]247[.]162:8888/bind_tcp_uuid[.]hta hxxp://1[.]14[.]247[.]162:8888/reverse_winhttp[.]ps1 hxxp://1[.]14[.]247[.]162:8888/reverse_tcp_uuid[.]ps1 hxxp://1[.]14[.]247[.]162:8888/reverse_http[.]ps1 hxxp://1[.]14[.]247[.]162:8888/bind_tcp[.]hta hxxp://1[.]14[.]247[.]162:8888/bind_tcp_uuid[.]ps1 hxxp://1[.]14[.]247[.]162:8888/bind_tcp[.]ps1 hxxp://1[.]14[.]247[.]162:8888/reverse_winhttp[.]hta hxxp://vlasta-s[.]ru/logista[.]hta hxxps://vlasta-s[.]ru/logista[.]hta |
Metasploit |
| URL | hxxp://maso[.]ge/wp-admin/Egotist[.]snp hxxp://dnvk1[.]info/wp-admin/dAHMfv126[.]bin hxxp://198[.]23[.]187[.]148/wbncZgWn214[.]bin hxxp://198[.]23[.]187[.]148/HpNDueHuDObdq59[.]bin hxxp://167[.]160[.]166[.]69/DIYTGl226[.]bin hxxp://109[.]248[.]151[.]11/fjNAW42[.]bin hxxp://109[.]248[.]151[.]11/ZoHGxPMHCmxJoJswV238[.]bin hxxp://109[.]248[.]151[.]11/OInwdV11[.]bin hxxp://109[.]248[.]151[.]11/OhLuVGW152[.]bin hxxp://109[.]248[.]151[.]11/SzTBjCXYfjW155[.]bin hxxp://109[.]248[.]151[.]11/PVgJF190[.]bin hxxp://109[.]248[.]151[.]11/fYLiJRLFpwMqdEh230[.]bin hxxp://109[.]248[.]151[.]11/CgfNZOwhSvfKOiySNi156[.]bin hxxp://109[.]248[.]151[.]11/LZJRCXHEEshk185[.]bin hxxp://109[.]248[.]151[.]11/eIvtOOFpDW16[.]bin hxxp://109[.]248[.]151[.]11/wxlrQsDtNIuRNOfSBlHUMX155[.]bin hxxp://109[.]248[.]151[.]11/xERBUpKhGMTsUriH205[.]bin hxxp://109[.]248[.]151[.]11/JpFKbjEmsIctDqqYJz155[.]bin hxxp://107[.]175[.]101[.]143/XiCUdRTdgarTvsf110[.]bin hxxp://107[.]175[.]101[.]143/KiwdzeTnG215[.]bin hxxp://109[.]248[.]151[.]11/KYkUnSnWTaWDfjjViY237[.]bin hxxp://109[.]248[.]151[.]11/lbhdQ29[.]bin hxxp://109[.]248[.]151[.]11/gITzRybIMKLHSwDirkQg30[.]bin hxxp://194[.]59[.]30[.]6/Bankeaanderne[.]rar hxxp://194[.]59[.]30[.]6/oqoqS152[.]bin hxxp://194[.]59[.]30[.]6/UWYVFXQWh32[.]bin hxxp://194[.]59[.]30[.]6/Uncomic[.]mdp hxxp://107[.]175[.]101[.]143/fUPMLlAO192[.]bin hxxp://107[.]175[.]101[.]143/ktgXzsdTJbxMqIewPU41[.]bin |
CloudEyE |
| URL | hxxps://api[.]telegram[.]org/bot6983988452:AAHfkSQJAzT73HSEFciD_6zDVzu05-RCEVw/ hxxps://api[.]telegram[.]org/bot7404371890:AAFoGVIE8AdYuQdoODgOQpLSfk_M8Q930uI/ hxxps://api[.]telegram[.]org/bot5704903332:AAGQ75Wg6lHVUpPODprifDQYP0_98wUeols/ |
Agent Tesla |
| URL | hxxps://septicfl[.]com/h/get[.]php hxxps://tmz[.]sticky[.]oystergardening[.]name/editContent hxxp://poivyzeaa[.]top/1[.]php hxxps://afa[.]sticky[.]oystergardening[.]name/editContent hxxps://xdje[.]sticky[.]oystergardening[.]name/editContent |
FAKEUPDATES |
| URL | hxxps://kimtams[.]dk/reports[.]php hxxps://lifeunworthyoflife[.]com/reports[.]php hxxps://davidjhindlemann[.]com/reports[.]php |
GootLoader |
| URL | hxxp://185[.]196[.]10[.]236/bins/sora[.]x86_64 hxxp://185[.]196[.]10[.]236/bins/sora[.]i686 |
Bashlite |
| URL | hxxps://47[.]254[.]149[.]115/__utm[.]gif hxxp://1[.]94[.]43[.]16:9999/dpixel hxxps://8[.]222[.]156[.]244/jquery-3[.]3[.]1[.]min[.]jsp hxxp://129[.]226[.]201[.]214:8009/updates[.]rss hxxps://54[.]180[.]3[.]125/Del/students/L9UT5V9E hxxp://8[.]130[.]134[.]5:6000/fwlink hxxps://103[.]40[.]161[.]161/cm hxxp://47[.]115[.]203[.]204:8080/activity hxxp://47[.]121[.]133[.]136:6666/load hxxps://47[.]116[.]33[.]203/load hxxp://123[.]60[.]90[.]39:9999/dot[.]gif hxxps://112[.]124[.]65[.]163:8089/j[.]ad hxxp://123[.]60[.]90[.]39:8888/visit[.]js hxxp://121[.]40[.]19[.]66:8080/match hxxp://114[.]115[.]210[.]125:8880/cx hxxp://124[.]220[.]6[.]158/activity hxxps://121[.]40[.]127[.]134:4443/dot[.]gif hxxp://27[.]25[.]151[.]38:50050/updates[.]rss hxxp://122[.]51[.]194[.]153:9999/jquery-3[.]3[.]2[.]N2cQ4mXdZ4nIo9XIhttp[.]min[.]js hxxps://122[.]51[.]194[.]153:8443/jquery-3[.]3[.]2[.]N2cQ4mXdZ4nIo9XIhttp[.]min[.]js hxxp://115[.]159[.]50[.]50:8089/image/ hxxp://109[.]196[.]166[.]188:4482/g[.]pixel hxxp://107[.]148[.]37[.]77/dpixel hxxp://124[.]221[.]113[.]199/updates[.]rss hxxps://8[.]220[.]192[.]59/dot[.]gif hxxp://192[.]3[.]16[.]18/activity hxxp://free[.]iwaf[.]cn:9988/ga[.]js hxxp://129[.]211[.]26[.]3:8888/pixel[.]gif hxxp://42[.]51[.]38[.]108:7777/api/x hxxp://45[.]152[.]86[.]11/visit[.]js hxxp://39[.]100[.]85[.]244:18080/images/a5772f8e168a49ef41d4e840014adfe6[.]png hxxp://39[.]100[.]85[.]244:18080/images/95bc09b336c401553d58614d00c8b568[.]png hxxp://39[.]100[.]85[.]244:18080/images/28168716209243cache[.]png[.]bak hxxp://39[.]100[.]85[.]244:18080/images/28168716209243cache[.]png hxxp://103[.]146[.]158[.]113/jquery-3[.]3[.]1[.]min[.]js hxxp://1c-viewer[.]info/handler hxxps://www[.]supportsmicrosoft[.]xyz/api/3 hxxp://43[.]136[.]43[.]49/pixel[.]gif |
Cobalt Strike |
| URL | hxxp://147[.]45[.]47[.]70/lend/228[.]exe hxxp://147[.]45[.]47[.]70/lend/swizzzz[.]exe hxxp://147[.]45[.]47[.]155/lend/swizzzz[.]exe hxxp://147[.]45[.]47[.]155/lend/228[.]exe hxxps://bitbucket[.]org/qwizzi/tt522222/downloads/GroceryExtensive[.]exe |
Stealc |
| URL | hxxp://147[.]45[.]47[.]70/lend/IerLRtXpEcMnUjz[.]exe hxxp://147[.]45[.]47[.]155/lend/IerLRtXpEcMnUjz[.]exe |
AsyncRAT |
| URL | hxxp://147[.]45[.]47[.]70/lend/fileosn[.]exe hxxp://147[.]45[.]47[.]155/lend/fileosn[.]exe |
RedLine Stealer |
| URL | hxxp://147[.]45[.]47[.]70/lend/lumma1234[.]exe hxxp://147[.]45[.]47[.]155/lend/lumma1234[.]exe hxxp://147[.]45[.]47[.]155/lend/gold[.]exe hxxp://147[.]45[.]47[.]70/lend/gold[.]exe hxxp://77[.]91[.]77[.]33/current[.]exe hxxps://fragmentyperspowp[.]shop/api |
Lumma Stealer |
| URL | hxxp://185[.]172[.]128[.]19/Newoff[.]exe hxxp://147[.]45[.]47[.]155/soka/random[.]exe hxxp://147[.]45[.]47[.]155/mine/amers[.]exe hxxp://147[.]45[.]47[.]70/mine/amers[.]exe hxxp://147[.]45[.]47[.]70/soka/random[.]exe |
Amadey |
| URL | hxxp://miles-and-more-kreditkartes[.]com/hui/loader hxxp://jobs-servers[.]com/dl[.]php?pub=mixten/ hxxp://doggie-services[.]com/oorigg/inte[.]exe hxxp://doggie-services[.]com/dl[.]php?pub=mixfive/ hxxp://doggie-services[.]com/dl[.]php?pub=mixeight hxxp://jobs-servers[.]com/dl[.]php?pub=mixfive/ hxxp://miles-and-more-kreditkartes[.]com/dl[.]php?pub=mixeight hxxp://miles-and-more-kreditkartes[.]com/dl[.]php?pub=mixfive/ hxxp://jobs-servers[.]com/oorigg/inte[.]exe hxxp://doggie-services[.]com/dl[.]php?pub=mixten/ hxxp://doggie-services[.]com/download[.]php?pub=univ/ hxxp://miles-and-more-kreditkartes[.]com/download[.]php?pub=univ/ hxxp://jobs-servers[.]com/download[.]php?pub=univ/ hxxp://miles-and-more-kreditkartes[.]com/oorigg/inte[.]exe hxxp://jobs-servers[.]com/hui/loader hxxp://miles-and-more-kreditkartes[.]com/dl[.]php?pub=mixten/ hxxp://doggie-services[.]com/hui/loader hxxp://jobs-servers[.]com/dl[.]php?pub=mixeight hxxp://doggie-services[.]com/oorigg/mixinte[.]exe hxxp://jobs-servers[.]com/oorigg/mixinte[.]exe hxxp://miles-and-more-kreditkartes[.]com/oorigg/mixinte[.]exe |
GCleaner |
| URL | hxxps://covid19help[.]top/GOtm[.]exe | DBatLoader |
| URL | hxxps://groundbreakingsstyle[.]com/wp-content/nanofolder/img-files/nacati[.]res hxxps://groundbreakingsstyle[.]com/wp-content/nanofolder/img-files/a95c346e-bd42-406b-a6a4-ed808e98bf67[.]res hxxps://wall5tghf6fdg[.]api[.]opensourcesaas[.]org/ZOdcfNuo/myxwr5cli[.]bat hxxps://wall5tghf6fdg[.]api[.]opensourcesaas[.]org/FcPJXgYD/mine[.]png |
XWorm |
| URL | hxxp://45[.]129[.]96[.]86/file/host_so[.]exe | LockBit |
| URL | hxxp://172[.]245[.]123[.]8/7766/FRSD[.]txt hxxp://172[.]245[.]123[.]8/7766/egf/entryofkingboraisreallygreatandeverythinggreattounderstandkingkobraisthekingofsnakeanditshaingthebeautiuflwaytoundertand___kingofkobrakingof[.]doc hxxp://172[.]245[.]123[.]8/7766/kingisthecobrakingkobraneed[.]bmp |
Remcos |
| URL | hxxps://universalmovies[.]top/nelbin[.]scr hxxp://mbsngradnja[.]com/YLc7afPlL4RjCeK[.]exe |
Formbook |
| URL | hxxp://147[.]45[.]47[.]155/lend/file300un[.]exe hxxp://147[.]45[.]47[.]70/lend/file300un[.]exe |
PrivateLoader |
| URL | hxxps://p4wq3e5r6t[.]xyz/8OtaBr/ hxxps://gotthebestoffer[.]site/bvxny6R6 hxxps://bestcdnforfree[.]site/bvxny6R6 hxxps://bestcdnforfree[.]site/8OtaBr/ hxxps://s9l0w7n3y5[.]xyz/bvxny6R6 hxxps://s9l0w7n3y5[.]xyz/8OtaBr/ |
ClearFake |
| URL | hxxp://192[.]3[.]83[.]115/ESF[.]exe | OriginLogger |
| URL | hxxp://185[.]200[.]221[.]15:8080/PAYABLE_USER[.]exe hxxp://185[.]200[.]221[.]15:8080/BEWILDERED_PERFORMANCE[.]exe hxxp://185[.]200[.]221[.]15:8080/BLONDE_BURN-OUT[.]exe |
Sliver |
| URL | hxxp://sempersim[.]su/d10/fre[.]php | LokiBot |
| URL | hxxp://77[.]221[.]151[.]42/demon[.]x64[.]bin | Havoc |
| URL | hxxps://1july[.]com/rMKNqt3S | Raccoon |
