不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/06/07
※2024/06/07 更新
マルウェア感染させると考えられるURLを検知（2024/06/07）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://43[.]156[.]247[.]227/RuntimeBroker[.]exe | Coinminer |
| URL | hxxps://24f1989[.]com/cdn-vs/original[.]js hxxps://24f1989[.]com/cdn-vs/cache[.]php hxxps://24f1989[.]com/cdn-vs/2per[.]php hxxps://tpb[.]patent[.]international-med[.]com/editContent hxxps://mgjf[.]patent[.]international-med[.]com/editContent hxxps://mzq[.]patent[.]international-med[.]com/editContent |
FAKEUPDATES |
| URL | hxxps://les-dessous-de-karen[.]com/reports[.]php hxxps://levaho[.]fr/reports[.]php hxxps://libet-kielce[.]pl/reports[.]php hxxps://licorice[.]uz/reports[.]php hxxps://denisburns[.]com/reports[.]php hxxps://dmboxing[.]co/reports[.]php |
GootLoader |
| URL | hxxp://174[.]140[.]171[.]178/ponychin/gate[.]php hxxp://198[.]74[.]51[.]164/forum/viewtopic[.]php hxxp://216[.]119[.]142[.]158/forum/viewtopic[.]php hxxp://accsandalye[.]com/mbb/foolishtrump/paneltwotwo/gate[.]php hxxp://rhombus-rolen[.]com/trip/gate[.]php hxxp://5[.]39[.]15[.]199/pony/gate[.]php hxxp://213[.]155[.]112[.]84:8080/ponyd/gate[.]php hxxp://biledroben[.]ru/gate[.]php hxxp://usviktory[.]de/panel/gate[.]php hxxp://200[.]72[.]183[.]54:81/ponychin/gate[.]php hxxp://shiftcontrol[.]biz/exuss14rwww[.]php hxxp://syracuseporsche[.]com/default[.]php hxxp://accexx[.]space/mayor/gate[.]php hxxp://216[.]52[.]143[.]36/pony/gate[.]php hxxp://www[.]stritaschools[.]com/abukh/cpanels/panel/gate[.]php hxxp://flexyin[.]info:1654/ero[.]php hxxp://174[.]140[.]163[.]141/pony/gate[.]php hxxp://banizeusz[.]com/wish/Panel/gate[.]php hxxp://184[.]154[.]70[.]68/pony/gate[.]php hxxp://69[.]194[.]196[.]39/ponychin/gate[.]php hxxp://hivamusic[.]ir/db/p/gate[.]php hxxp://209[.]236[.]67[.]163/8bd7d5194/wergwrg3gwer hxxp://spna[.]ca:8080/pony/gate[.]php hxxp://kpresident[.]com/pony/gate[.]php hxxp://tcoolonline[.]mobi/wp-includes/css/Panel/gate[.]php hxxp://engrseltevs[.]com/buky/gate[.]php hxxp://handtmann-de[.]com/xm/coreserver/gate[.]php hxxp://semtly[.]com/default[.]php hxxp://sofharrefen[.]ru/gate[.]php hxxp://salesxpert[.]info/pony/gate[.]php hxxp://64[.]85[.]169[.]189:8080/forum/viewtopic[.]php hxxp://webgozar[.]win/office/gate[.]php hxxp://sp-co[.]cf/panel/gate[.]php hxxp://faradaxa[.]com/ghhg/mypage/gate[.]php hxxp://95[.]154[.]250[.]191:8080/pony/gate[.]php hxxp://192[.]241[.]130[.]124/panel/gate[.]php hxxp://whitesnowpussy[.]org/forum/viewtopic[.]php hxxp://topprofessionalphotographer[.]com/default[.]php hxxp://50[.]56[.]223[.]113:8080/pony/gate[.]php hxxp://overider[.]ml/dome/mega/gate[.]php hxxp://dapurslkm[.]co[.]id/mw/p/gate[.]php hxxp://74[.]91[.]112[.]81/forum/viewtopic[.]php hxxp://mci-consultant[.]id/oo/panelnew/gate[.]php hxxp://fouseevenghedt[.]ru/gate[.]php hxxp://seganag[.]com/kz/Panel/gate[.]php hxxp://sweed-viki[.]ru/sweed/gate[.]php hxxp://acgfinancial[.]gq/chuksgoogle/gate[.]php hxxp://genic-enterprises[.]website/www/gate[.]php hxxp://ctasyus[.]info:1654/ero[.]php hxxp://inmrvogurin[.]ru/SY/test/gate[.]php hxxp://184[.]82[.]133[.]187/insane/head[.]php hxxp://www[.]faradaxa[.]com/ghhg/mypage/gate[.]php hxxp://174[.]140[.]171[.]147/pony/gate[.]php hxxp://209[.]222[.]110[.]181/eze/panelnew/gate[.]php hxxp://21[.]harnessingsystems[.]com/forum/viewtopic[.]php hxxp://21[.]multiplexvehiclesystems[.]com/forum/viewtopic[.]php hxxp://clubdemadrespompiglos[.]com/k/panelnew/gate[.]php hxxp://sandstrucks[.]com/fend/bolt/gate[.]php hxxp://www[.]janabaalicheck[.]com/web-content/log/log/file/gate[.]php hxxp://grnthost[.]icu/dee/gate[.]php hxxp://212[.]58[.]15[.]3:8080/ponyd/gate[.]php hxxp://zelia[.]net:8080/pony/gate[.]php hxxp://xdrppped[.]com[.]ng/xc/panel/gate[.]php hxxp://hawkresultbox[.]net/nedum/gate[.]php hxxp://grupoalfra[.]cl/images/img/png/Panelx/gate[.]php hxxp://sp-co[.]cf/awumen/panel/gate[.]php hxxp://212[.]58[.]15[.]2:8080/forum/viewtopic[.]php hxxp://mocnid[.]com/panel/gate[.]php hxxp://heshedhowpa[.]ru/gate[.]php hxxp://213[.]155[.]112[.]92:8080/ponyd/gate[.]php hxxp://gamestoredownload[.]download/setupslyp/setupslyp/gate[.]php hxxp://successoryzones[.]biz/apple/Server/gate[.]php hxxp://guata[.]com[.]br/z/pony/panel/gate[.]php hxxp://empireacoustical[.]com/data/jnt/Panel/gate[.]php hxxp://kosii[.]org/bubu/gate[.]php hxxp://krungonline[.]com/wp-admin/css/Panel/gate[.]php hxxp://gamestoredownload[.]download/setupcrossp/setupcrossp/gate[.]php hxxp://leatherbulletin[.]com/bit/panel/gate[.]php hxxp://bullonthewall[.]com/forum/viewtopic[.]php hxxp://libertize[.]ru/temp/paul-20june-20july/gate[.]php hxxp://212[.]58[.]15[.]2:8080/ponyd/gate[.]php hxxp://www[.]tcoolonline[.]mobi/wp-includes/ID3/Panel/gate[.]php hxxp://monkey[.]5bello[.]com/Panel/gate[.]php hxxp://e3pos[.]com/default[.]php hxxp://microsoftoutlook[.]ga/lovenow/eng/gate[.]php hxxp://tolain[.]ru/tola/gate[.]php hxxp://mitsumidistrlbution[.]com/nonso/gate[.]php hxxp://ukaytrades[.]tk/server/gate[.]php hxxp://4maat[.]com/by/back/gate[.]php hxxp://185[.]11[.]146[.]179/marlon/wossy[.]php hxxp://updateguru[.]xyz/fanta/Panel/gate[.]php hxxp://tekinkgroup[.]com/rector/gate[.]php hxxp://dlhrecording[.]com/default[.]php hxxp://tertpertoru[.]ru/gate[.]php hxxp://mammerzo[.]com/wp/wp-content/uploads/tony/panel/gate[.]php hxxp://iwillmakeitbigtime[.]cf/pony2/gate[.]php hxxp://ns8iafosjnfuihkcnidkl[.]org/pony/nef9ihsvidvghdikn[.]php hxxp://tradelinkengineering[.]com/default[.]php hxxp://45[.]58[.]116[.]102/~admin/maindomainkid009_net/ajuk/fire/gate[.]php hxxp://83[.]174[.]131[.]142:8080/pony/gate[.]php hxxp://zpanel123[.]com/1/gate[.]php hxxp://palitosdepan[.]com/333[.]cab hxxp://139[.]99[.]8[.]218/~blininfo/temp/gate[.]php hxxp://199[.]192[.]25[.]237/~catchusnot/panel/gate[.]php hxxp://bdhkmts[.]pw:4915/way/like[.]php hxxp://5[.]135[.]8[.]71/5101fcf84/vsdfb45wret hxxp://209[.]236[.]67[.]163/8bd7d5194/rebhg542 hxxp://ponyls[.]in/js/pony/mac[.]php hxxp://productmetro[.]club/pn1/gate[.]php hxxp://whizzpackage[.]com/dp/adm/adm1/gate[.]php hxxp://christojati[.]com/panel/gate[.]php hxxp://199[.]71[.]212[.]114/forum/viewtopic[.]php hxxp://www[.]funfreecasinogames[.]com/file/panel/gate[.]php hxxp://clinique-sainte-marie[.]top/images/css/site-logo/gate[.]php hxxp://5[.]135[.]8[.]71/5101fcf84/43ggewvefbwerg hxxp://szevargrows[.]com/new/Panel/gate[.]php hxxp://minddosentshe[.]com/tiny/lele/gate[.]php hxxp://fipony[.]in/js/pony/mac[.]php hxxp://209[.]236[.]67[.]163/8bd7d5194/werghw45gwe hxxp://rohironrof[.]ru/gate[.]php hxxp://bdujyr[.]pw:4915/way/like[.]php hxxp://64[.]85[.]169[.]190:8080/forum/viewtopic[.]php hxxp://untablesix[.]ru/buch-A2/gate[.]php hxxp://detailingpro[.]co[.]in/wp-admin/network/anyipanelnew/gate[.]php hxxp://209[.]236[.]67[.]163/8bd7d5194/brgn424t235 hxxp://209[.]236[.]67[.]163/8bd7d5194/wert34g45ht hxxp://spokengezraee[.]idv[.]am/temp/panel/gate[.]php hxxp://kenthalls[.]com/valopsy/gate[.]php hxxp://62[.]112[.]130[.]165:8080/pony/gate[.]php hxxp://ethostraining[.]es/333[.]cab hxxp://119[.]110[.]72[.]195:8080/pony/gate[.]php hxxp://topratesforextoyou[.]biz/cms/old2/gate[.]php hxxp://198[.]74[.]59[.]66/forum/viewtopic[.]php hxxp://donsnookie[.]club/panel/gate[.]php hxxp://gregorian[.]club/ifamandiebyaccident/gate[.]php hxxp://theonlygoodman[.]com/fif/gate[.]php hxxp://balsamar[.]org/water/panelnew/gate[.]php hxxp://www[.]van-der-leest[.]nl/333[.]cab hxxp://108[.]178[.]59[.]19/pony/gate[.]php hxxp://easybrands[.]ml/lorenz/gate[.]php hxxp://simdisposable[.]info/wordpress/wp-includes/images/media/office/microsoft/gate[.]php hxxp://185[.]11[.]146[.]179/marlon/gate[.]php hxxp://mdi-pk[.]com/css/gate[.]php hxxp://cryodiffusion[.]cf/panel/gate[.]php hxxp://anixtier[.]com/beef/sult/gate[.]php |
Pony |
| URL | hxxp://www[.]saveinfoval[.]com/index[.]php/ | Socelars |
| URL | hxxp://84[.]38[.]134[.]113/pwfrCkA61[.]bin hxxp://84[.]38[.]134[.]113/CJvxAdI177[.]bin hxxp://84[.]38[.]134[.]113/BZNrFLRHsMl112[.]bin hxxp://84[.]38[.]134[.]113/JmcwrlGqbm60[.]bin hxxp://84[.]38[.]134[.]113/nYImWrFDRmquGmt77[.]bin hxxp://84[.]38[.]134[.]113/EDECNq234[.]bin hxxp://84[.]38[.]134[.]113/TnyZxJhwUjmCD189[.]bin hxxp://84[.]38[.]134[.]113/AzTuJzzQU55[.]bin hxxp://84[.]38[.]134[.]113/jRYMDIQzJrUgvDkBEirHXj134[.]bin hxxp://84[.]38[.]134[.]113/EZgmtRofeZfY240[.]bin hxxp://aixpres[.]com/hIcLmnW126[.]bin hxxp://skyebatteries[.]com/lWeYEHNMloEwW1[.]bin hxxp://194[.]59[.]30[.]6/PsXCbAibwYaf225[.]bin hxxp://194[.]59[.]30[.]6/Vrtplanters0[.]ocx hxxp://karoonpc[.]com/Slade107[.]psm |
CloudEyE |
| URL | hxxps://universalmovies[.]top/obiz[.]scr hxxps://universalmovies[.]top/obizx[.]doc hxxps://api[.]telegram[.]org/bot7065054355:AAGvKozyIFTruitkksV45RlLGqriLqyMLhs/ hxxps://api[.]telegram[.]org/bot7168430181:AAE4XS0ePQeF2h4qrehtp2YVoyJ1LF1-SoQ/ hxxp://45[.]138[.]183[.]65/upload/1311 hxxps://paste[.]ee/d/ci98s hxxp://107[.]173[.]143[.]28/90404/igcc[.]exe hxxp://107[.]173[.]143[.]28/8080/IGCC[.]exe hxxp://185[.]222[.]58[.]78/80707/toplionsarelivingafricaimages[.]bmp hxxp://107[.]173[.]143[.]28/xampp/jjn/jj/interestedanglesayingsheismostbeautifulwomeneverseenwindersessionlionsawaysgettingsuchandinsterestedthnigeverytimetoget___forstvibeeverywh[.]doc hxxp://107[.]173[.]143[.]28/xampp/hbn/lionsarekingandudfdidthekingofjungleentireworldandforestalwaysneedthekingoflionsjungleandheisthepowerfulmangerat__lionkingofjungletrulygreat[.]doc hxxps://api[.]telegram[.]org/bot7033725008:AAG3SScxEtYlanQbXYSgLBKSlzryVk6c0I0/ hxxps://api[.]telegram[.]org/bot7359374737:AAG-rOISO45emTAbe0uNq-VCZDJy_nNcEtc/ hxxps://api[.]telegram[.]org/bot6398508790:AAFROO4FvHYek5_hchyogAsV7yTvxfINRRg/ |
Agent Tesla |
| URL | hxxps://artefxanimaciones[.]com/temp/Update[.]exe hxxp://getcloudsolutions[.]dev/PmCw4fD/index[.]php hxxps://jtpdev[.]co[.]uk/images/8fc809[.]exe hxxp://185[.]172[.]128[.]19/NewR[.]exe |
Amadey |
| URL | hxxp://5[.]42[.]65[.]116/vidar0506[.]exe | Vidar |
| URL | hxxps://universalmovies[.]top/john[.]doc hxxps://onedrive[.]live[.]com/download?resid=A4646BA1085ABB03%21117&authkey=!AEercQGUE0fevEg hxxps://universalmovies[.]top/john[.]scr |
Formbook |
| URL | hxxps://prntsc[.]pro/build/setup-lightshot[.]exe hxxp://irfanrashid[.]com/wp-content/server3/AppGate2103v01[.]exe |
PrivateLoader |
| URL | hxxps://47[.]99[.]194[.]96/__utm[.]gif hxxp://103[.]116[.]245[.]79:808/__utm[.]gif hxxp://43[.]136[.]218[.]157:5555/g[.]pixel hxxps://118[.]89[.]125[.]171/fwlink hxxp://172[.]81[.]211[.]162:12343/dpixel hxxp://62[.]234[.]19[.]7:6666/fwlink hxxp://31[.]128[.]39[.]137/dot[.]gif hxxp://8[.]222[.]250[.]105/cm hxxps://31[.]128[.]39[.]137/visit[.]js hxxp://134[.]175[.]107[.]219:8888/pixel hxxp://106[.]75[.]75[.]24:8889/ptj hxxps://121[.]40[.]127[.]134:8443/load hxxp://qq[.]jjxy[.]link/cm hxxp://117[.]72[.]35[.]30:2222/c/msdownload/update/others/2024/05/9Dv7AyHg1Ag2KwO30_ hxxp://1[.]92[.]96[.]35:8080/dot[.]gif hxxp://120[.]46[.]208[.]63/__utm[.]gif hxxp://43[.]136[.]218[.]157:8888/pixel[.]gif hxxps://damousese[.]xyz:8443/api/v1/getdata hxxps://iheartredteams[.]com/match hxxps://47[.]99[.]194[.]96/dot[.]gif hxxp://111[.]92[.]243[.]236/claim/servlets-examples/I2I52XQKQQZF hxxp://193[.]187[.]174[.]93:1389/sys[.]exe hxxp://193[.]187[.]174[.]93:1389/abc hxxps://www[.]163microsoft[.]com/_/scs/mail-static/_/js/ hxxp://165[.]154[.]33[.]10:3332/_/scs/mail-static/_/js/ hxxps://bimnall[.]com/btn_bg[.]html hxxps://158[.]247[.]222[.]223/cx |
Cobalt Strike |
| URL | hxxps://willingyhollowsk[.]shop/api hxxp://77[.]91[.]77[.]81/lend/kfiwarhg[.]exe |
Lumma Stealer |
| URL | hxxp://216[.]238[.]78[.]129/Client-built[.]exe hxxp://193[.]187[.]174[.]93:1389/Client-built[.]exe hxxp://20[.]197[.]248[.]195/Client-built[.]exe |
Quasar RAT |
| URL | hxxps://pasteio[.]com/raw/xqluwHbm76LG | DCRat |
| URL | hxxps://pasteio[.]com/raw/xHOtXWgmGVm7 | NjRAT |
| URL | hxxps://estankaralar[.]shop/MTEwMWE4ODFhNzhl/ hxxps://mahalleestankaralar[.]shop/MTEwMWE4ODFhNzhl/ hxxps://mahallekaradakal[.]shop/MTEwMWE4ODFhNzhl/ hxxps://karayakder2[.]shop/MTEwMWE4ODFhNzhl/ hxxps://laleneredeler[.]shop/MTEwMWE4ODFhNzhl/ hxxps://larnakdalar3[.]shop/MTEwMWE4ODFhNzhl/ hxxps://karekeldeds[.]shop/MTEwMWE4ODFhNzhl/ hxxps://hasretkalmanav[.]shop/MTEwMWE4ODFhNzhl/ hxxps://kamelyanat5[.]shop/MTEwMWE4ODFhNzhl/ hxxps://karedekalan[.]shop/MTEwMWE4ODFhNzhl/ hxxps://hasretkalmanavdas3[.]shop/MTEwMWE4ODFhNzhl hxxps://karekeldeds4[.]shop/MTEwMWE4ODFhNzhl/ |
Coper |
| URL | hxxps://paste[.]ee/d/F9RBG/0 hxxps://paste[.]ee/d/ZEks7/0 hxxps://paste[.]ee/d/3BXov/0 |
Revenge RAT |
| URL | hxxp://185[.]222[.]58[.]78/50607/UGOS[.]txt hxxp://185[.]222[.]58[.]78/50607/hgos/lionsaregreatandinterestedtoreelsthejungleforestunderthislionspowerwhichreallyfineforfemalelionswhohavegreatthings___lionsarekingofjunglealways[.]doc hxxp://185[.]222[.]58[.]78/50607/lionsarekingofjunglewhoisking[.]bmp hxxp://103[.]182[.]19[.]148/6060/VBG[.]txt hxxp://172[.]234[.]221[.]211/34009/LGC[.]txt hxxps://paste[.]ee/d/SrD1H hxxps://paste[.]ee/d/eZNju hxxp://103[.]182[.]19[.]148/6060/zee/lionsarekingofthejunglewhotrulywanttogetbackwithentirethingsgogreattotheforestwhichahdnlingentirethingstounderstand__lionsisthekingofjungle[.]doc hxxp://172[.]234[.]221[.]211/34009/mnb/liitletigersearchingforfoodwhichallowtogetitentirethingstobegetbackfromtheeartdesignedgreatthings__nulcearboytiger[.]doc hxxp://172[.]234[.]221[.]211/34009/lionsarebeautifulcomparewithothers[.]bmp hxxp://103[.]182[.]19[.]148/6060/pointingthejunglelionontheimagescool[.]bmp hxxp://96[.]126[.]101[.]128/50809/lionsarekingofjungleimageswondering[.]bmp hxxp://96[.]126[.]101[.]128/50809/uhb/lionsarekingandtheyalwayslikethejungleforestwholivedbeforeandentirethingsgoingtogreaterthaneveritswillrerturntoubeack___wehnulielionshateu[.]doc hxxps://pasteio[.]com/raw/xkgsSGbWIjcw hxxps://paste[.]ee/d/CjFLX |
Remcos |
| URL | hxxp://67[.]207[.]166[.]175/T0406W/lsass[.]exe hxxp://67[.]207[.]166[.]175/xampp/gbh/lionsarekingogthejunglewhorulestheentireforestandlionsgreattounderstandtheyaregreattoundersetandlionsarekindofthejungle__lionsarekingofjungle[.]doc |
PureCrypter |
| URL | hxxps://23[.]26[.]76[.]169/ze[.]jpg hxxps://23[.]26[.]76[.]169/ds1[.]txt hxxps://2[.]58[.]56[.]30//gxae[.]jpg hxxps://2[.]58[.]56[.]30//noka[.]txt hxxps://2[.]58[.]56[.]30//hids[.]txt hxxps://212[.]70[.]149[.]205/676333[.]txt hxxps://212[.]70[.]149[.]205/x[.]jpg hxxp://194[.]59[.]31[.]133/msmng2[.]exe hxxp://194[.]59[.]31[.]133/msfiler[.]exe |
AsyncRAT |
| URL | hxxp://77[.]91[.]77[.]81/lend/next[.]exe | XWorm |
| URL | hxxp://194[.]59[.]31[.]133/fd1[.]exe | Venom RAT |
