不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/06/10
※2024/06/10 更新
マルウェア感染させると考えられるURLを検知（2024/06/10）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://homestandard[.]co[.]uk/tech/9a3efc[.]exe hxxp://jtpdev[.]co[.]uk/images/8fc809[.]exe hxxp://check-ftp[.]ru/forum/index[.]php |
Amadey |
| URL | hxxps://theloftibiza[.]com/wp-includes/Eofmqlm[.]vdf hxxp://67[.]207[.]166[.]175/M0306T/lsass[.]exe |
PureCrypter |
| URL | hxxps://dressyrsnack[.]se/reports[.]php hxxps://edu[.]ngoinhatienganh[.]com/reports[.]php hxxps://yorkbrooks[.]com/phantom-equity-plan-agreement/ hxxps://embracethewater[.]wondermeeting[.]se/reports[.]php hxxps://saasfeerentals[.]com/stamping-fee-for-sp-agreement/ hxxps://energotechnika[.]com[.]pl/reports[.]php hxxps://goodstos[.]com/airline-baggage-agreement/ hxxps://ependyseis[.]com[.]gr/reports[.]php hxxps://erhvervsundhed[.]dk/reports[.]php hxxp://selwoodconsultants[.]co[.]ke/2023/08/10/how-can-i-cancel-my-internet-contract-without-paying/ hxxp://yorkbrooks[.]com/phantom-equity-plan-agreement hxxps://firebirdimages[.]com/reports[.]php hxxps://hvamkulturogforsamlingshus[.]dk/reports[.]php hxxp://saasfeerentals[.]com/stamping-fee-for-sp-agreement hxxps://i-likeitalot[.]com/reports[.]php hxxps://ikenouedojo[.]com/reports[.]php hxxps://www[.]platypus-verlag[.]ch/wisconsin-tax-installment-agreement/ hxxps://intranat[.]vhfk[.]se/reports[.]php hxxp://exotours[.]in/read-agreement-of-being-gay-for-30-days hxxps://goodstos[.]com/agreement-side-effects/ hxxps://lilabrand[.]com/reports[.]php hxxps://georaldc[.]com/reports[.]php hxxps://dmboxing[.]com/reports[.]php hxxp://platypus-verlag[.]ch/wisconsin-tax-installment-agreement hxxps://ecoledebatteriejonathandesrumeaux[.]fr/reports[.]php hxxps://enhornabatklubb[.]se/reports[.]php hxxps://geomatikkbedriftene[.]no/reports[.]php hxxps://hukukarastirmavakfi[.]com/reports[.]php hxxps://goodstos[.]com/service-level-agreement-laboratory/ hxxps://lamperdingen[.]ch/reports[.]php |
GootLoader |
| URL | hxxps://hediyesepetcidepoz[.]top/OCVUPWbr7dFIrXmf/ hxxps://cocuklukankarakoc[.]top/OCVUPWbr7dFIrXmf/ hxxps://evsizlikmerkezvaz[.]top/OCVUPWbr7dFIrXmf/ hxxps://sagliklidayanikliq[.]top/OCVUPWbr7dFIrXmf/ hxxps://huzursuzoyundunqa[.]xyz/OCVUPWbr7dFIrXmf/ hxxps://sevgiliaskcekilis[.]top/OCVUPWbr7dFIrXmf/ hxxps://hatirlaunutmauyan[.]top/OCVUPWbr7dFIrXmf/ hxxps://guzelresimlerqazan[.]top/OCVUPWbr7dFIrXmf/ hxxps://sogukkanlifirtina[.]top/OCVUPWbr7dFIrXmf/ hxxps://kelimelermekaniq[.]top/OCVUPWbr7dFIrXmf/ hxxps://cikaracolukcagiz[.]top/OCVUPWbr7dFIrXmf/ hxxps://kahvehanekeyfian[.]top/OCVUPWbr7dFIrXmf/ hxxps://baslayalimcalism[.]top/OCVUPWbr7dFIrXmf/ hxxps://kelebekortulerqoq[.]top/OCVUPWbr7dFIrXmf/ hxxps://sorunludavranisvu[.]top/OCVUPWbr7dFIrXmf/ hxxps://nehirkenariyozca[.]top/OCVUPWbr7dFIrXmf/ hxxps://mutlusunakyollar[.]top/OCVUPWbr7dFIrXmf/ hxxps://buyuluaynalarqizq[.]top/OCVUPWbr7dFIrXmf/ hxxps://hafizadondurucuq[.]top/OCVUPWbr7dFIrXmf/ hxxps://gizlimucizelervar[.]top/OCVUPWbr7dFIrXmf/ hxxps://inandiricibakisvu[.]top/OCVUPWbr7dFIrXmf/ hxxps://kelebekleroyunuq[.]top/OCVUPWbr7dFIrXmf/ hxxps://vazgecilmezlikvur[.]top/OCVUPWbr7dFIrXmf/ hxxps://hayattansikayetim[.]top/OCVUPWbr7dFIrXmf/ hxxps://nefeskesenfirtina[.]top/OCVUPWbr7dFIrXmf/ hxxps://keskecokdileyipto[.]top/OCVUPWbr7dFIrXmf/ hxxps://guzelliklervarqac[.]top/OCVUPWbr7dFIrXmf/ hxxps://isteklergelirgiz[.]top/OCVUPWbr7dFIrXmf/ hxxps://saskinalacagimiz[.]top/OCVUPWbr7dFIrXmf/ hxxps://sabirsizlaniyorum[.]top/OCVUPWbr7dFIrXmf/ hxxps://rahatlikbuyukuyar[.]top/OCVUPWbr7dFIrXmf/ hxxps://kalptenbagnazimi[.]top/OCVUPWbr7dFIrXmf/ hxxps://gucunuzetkilerqo[.]top/OCVUPWbr7dFIrXmf/ hxxps://pq2trelsquu44xbpritocamel[.]store/YTYxNjljZDI1YzFh/ hxxps://k6fvq8c11dqqjd446ck9camel[.]store/YTYxNjljZDI1YzFh/ hxxps://7l19jlu5trkqndh24li4camel[.]store/YTYxNjljZDI1YzFh/ hxxps://brfw0g97s9mwun8juhb0camel[.]store/YTYxNjljZDI1YzFh/ hxxps://re5bvyc4l6004tqmtzp4camel[.]store/YTYxNjljZDI1YzFh/ hxxps://6zimks6know8jihvtoa8camel[.]store/YTYxNjljZDI1YzFh/ hxxps://3w0mi18gkfrf6l8a8d09camel[.]store/YTYxNjljZDI1YzFh/ hxxps://83[.]97[.]73[.]39/YTYxNjljZDI1YzFh/ hxxps://97felu2ehv0r5iff3cslcamel[.]store/YTYxNjljZDI1YzFh/ hxxps://wlw7obu15d6ru3eqy3o8camel[.]store/YTYxNjljZDI1YzFh/ hxxps://hqj6lhsgcnuxfnlj5y95camel[.]store/YTYxNjljZDI1YzFh/ hxxps://inat-protv-box[.]net[.]tr/YTYxNjljZDI1YzFh/ hxxps://renklidunyalarinrenkleriolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://sevdaninsarkisigibigelsin[.]top/DykKyhj8rWCVWqhA/ hxxps://umutkutusuilehayatolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://mutlulukyolculuguguzelolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://sevgidansarkilarigelsin[.]xyz/DykKyhj8rWCVWqhA/ hxxps://huzurunadresigizemliolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://anilarinpeksimdihayatolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://guzelliklerinpekisiolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://masalsendromuduygusugelsin[.]top/DykKyhj8rWCVWqhA/ hxxps://ruyalarinyoluyolculukolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://sonsuzlukhikayesibaslasin[.]xyz/DykKyhj8rWCVWqhA/ hxxps://gizemlisularinsirriacilsin[.]top/DykKyhj8rWCVWqhA/ hxxps://yildizlararasindayolculukolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://mutluluklimanlarigibiyolculuk[.]top/DykKyhj8rWCVWqhA/ hxxps://umutkaynaklarihayatinolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://ruyalarindabulusmakolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://sevgiyoluolusturmakolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://hayatrenklidirnefesolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://mutlulukyolculugudanolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://sonsuzlukyolculugundanolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://huzurunkaynaginagidenolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://sevgiyuregimizdeyerolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://umutharitasiguzelolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://hayalperestdunyalarindanolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://guzelliklerinpesindeyizolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://anilariniziunutmayinolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://gizemlihayallerkurmakolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://umutgunesindeyizolsun[.]top/DykKyhj8rWCVWqhA/ hxxps://umutseslerimutlulukgelsin[.]top/DykKyhj8rWCVWqhA/ hxxps://huzurunsirrikeyifles[.]xyz/DykKyhj8rWCVWqhA/ hxxps://hayalperestdunyamagazinolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://sevgiyolculugugibioxyzgelsin[.]top/DykKyhj8rWCVWqhA/ hxxps://maceraperestdunyagezin[.]xyz/DykKyhj8rWCVWqhA/ hxxps://mutlulukkutusuhediyeolsun[.]xyz/DykKyhj8rWCVWqhA/ hxxps://renklikalemlerimagidolsun[.]top/DykKyhj8rWCVWqhA/ |
Coper |
| URL | hxxp://piontx[.]ga/siv/index[.]php hxxp://egonla[.]futbol/ya/index[.]php hxxp://aquavictus[.]hr/img/Panel/index[.]php hxxp://mike[.]rivalserver[.]com/~ygnwgnrp/gate[.]php hxxp://petitbox[.]top/petit/index[.]php hxxp://vitani[.]tk/disk/index[.]php hxxp://mahnatkin[.]site/andromache/index[.]php hxxp://siteverification[.]site/azo/gate[.]php hxxp://b-cointrade[.]com/sti/gate[.]php hxxp://baran[.]live/547d5c/index[.]php hxxp://bronze2[.]hk/1/index[.]php hxxp://185[.]195[.]236[.]168/1gw3/index[.]php hxxp://172[.]245[.]142[.]200/kc/panel/index[.]php hxxp://163[.]172[.]175[.]132/1A6B3831-A96D-4936-815A-6F7C904EF9C0/index[.]php hxxp://mcgua[.]com[.]ua/au/gate[.]php hxxp://jahblessus[.]gq/obinna/index[.]php hxxp://141[.]105[.]64[.]136/lekon/index[.]php hxxp://217[.]8[.]117[.]235/8A16F818-E5A3-49AE-BF99-250E1F00B04E/index[.]php hxxp://185[.]195[.]236[.]162/x/index[.]php hxxp://physdigitech[.]com/~zadmin/amark/xplora/index[.]php hxxp://t1t2[.]xyz/modez/3[.]2/index[.]php hxxp://51[.]15[.]199[.]75/8205729E-D49F-49C3-831F-B7F116560634/index[.]php hxxp://51[.]15[.]235[.]182/045BA308-0877-4F9A-935D-9F1A174F7D38/index[.]php hxxp://193[.]56[.]28[.]129/goml/Panel3/index[.]php hxxp://stastports[.]com/mag/index[.]php |
Azorult |
| URL | hxxps://economelogainyjusk[.]shop/api hxxp://alcojoldwograpciw[.]shop/api hxxps://preachbusstyoiwo[.]shop/api hxxps://poledoverglazedkilio[.]shop/api hxxps://handbreeadretwaiw[.]shop/api hxxps://wastwfulldashiwnjs[.]shop/api hxxps://corruptioncrackywosp[.]shop/api hxxps://surpriserangeloggypo[.]fun/api hxxps://rightchampionieo[.]shop/api hxxps://counterrailcrwu[.]shop/api hxxps://survivalpersisttww[.]shop/api hxxps://roleprofittypleasw[.]shop/api hxxps://churchemipircasowl[.]shop/api hxxps://portaircoveragejsuk[.]shop/api hxxps://tubewelfaredopw[.]shop/api hxxps://glossydecentjuskwos[.]shop/api hxxps://allowbloodythinkews[.]shop/api hxxps://stingmisplacedelivrrw[.]shop/api hxxps://declineforntyuekw[.]shop/api hxxps://geneticsockkdwlsaw[.]shop/api hxxps://refundemobxyyeols[.]shop/api hxxps://rejectbettysmartws[.]shop/api hxxps://warmstrawcounwyhj[.]shop/api hxxps://pollutiofactwoijk[.]shop/api hxxps://comedyhorizonbedwus[.]shop/api hxxps://catlackjellyodwps[.]shop/api hxxps://conceptionextortyosw[.]shop/api hxxps://kitchenreviewbewrwsa[.]shop/api hxxps://jobbyshysinduksowp[.]shop/api hxxps://pilothardwarreodsi[.]shop/api hxxps://ensureclackexcatwi[.]shop/api hxxps://rocketmusclesksj[.]shop/api hxxps://fantasticabnormally[.]shop/api hxxps://adoptionalbumgesw[.]shop/api hxxps://quitdigitalplatforwi[.]shop/api hxxps://tropicalironexpressiw[.]shop/api hxxps://templecharteredowis[.]shop/api hxxps://routinecontoradwjsk[.]shop/api hxxp://museumtespaceorsp[.]shop/api hxxps://pumpkindribblewo[.]shop/api hxxps://recognizestainsw[.]shop/api hxxps://despairphtsograpgp[.]shop/api hxxps://valuablestraigwhi[.]shop/api hxxps://bettynoticecovej[.]shop/api hxxps://nimkishraddedrew[.]shop/api hxxps://libertyliebindywv[.]shop/api hxxps://arrangementyforumekw[.]shop/api hxxps://voicelighterrrepso[.]shop/api hxxps://souptapedentisttactiwe[.]shop/api hxxps://seasonaldemonstradojs[.]shop/api hxxps://uncertaintyrestsju[.]shop/api hxxps://fireplacecheckwi[.]shop/api hxxps://preocucupationssk[.]shop/api hxxps://footflexibleacts[.]shop/api hxxps://explocommisiowsa[.]shop/api hxxps://simplicitynegotiatiw[.]shop/api hxxps://grazeinnocenttyyek[.]shop/api hxxps://varianntyfeecterd[.]shop/api hxxps://palacetilecomplew[.]shop/api hxxps://distributopsuoprs[.]shop/api hxxps://negotitatiojdsuktoos[.]shop/api hxxps://descriptionappleoj[.]shop/api hxxps://evokeoutlooklits[.]shop/api hxxps://ticketgradiencomfj[.]shop/api hxxps://textureshallodsjk[.]shop/api hxxps://bowelunitrydoorsko[.]shop/api hxxps://paininsrertymarshwke[.]shop/api hxxps://demonstratedesighw[.]shop/api hxxps://joblkessprosgeow[.]shop/api hxxps://listenmoutioncow[.]shop/api hxxps://stronggemateraislw[.]shop/api hxxps://muggylasergaijynwjk[.]shop/api hxxp://elconnova[.]com/images/pic6[.]exe hxxps://vivaciousdqugilew[.]shop/api hxxps://roadsterrhetoricaw[.]shop/api hxxp://elconnova[.]com/images/pic5[.]exe hxxp://elconnova[.]com/images/pic4[.]exe hxxp://elconnova[.]com/images/pic9[.]exe hxxps://notoriousdcellkw[.]shop/api hxxps://liabiliytshareodlkv[.]shop/api hxxps://conferencefreckewl[.]shop/api hxxps://flourhishdiscovrw[.]shop/api hxxps://landdumpycolorwskfw[.]shop/api hxxps://ohfantasyproclaiwlo[.]shop/api hxxps://parallelmercywksoffw[.]shop/api hxxps://barebrilliancedkoso[.]shop/api |
Lumma Stealer |
| URL | hxxp://192[.]210[.]150[.]27/6060/igcc[.]exe hxxp://192[.]210[.]150[.]27/xampp/gbv/lionsaregreatonjungletounderstandhowmuchpowerfulitswillbegreatattitudeoflionsgetbacktomewithgreatsupport___lionsarelawyskingof[.]doc hxxp://www[.]synergyinnovationsgroup[.]com/UHJkwosKE155[.]bin hxxp://192[.]210[.]150[.]29/6050/IGCC[.]exe hxxp://192[.]210[.]150[.]29/xampp/igcc/lionsarekingofjunglewhoblindeditseyeonforesttounderstandhowotheranimaltobehavethiningalotbecauseofjunglerules__ionsarelwayskingof[.]doc hxxp://www[.]synergyinnovationsgroup[.]com/ZDJVYktugq246[.]bin hxxp://198[.]23[.]201[.]89/warm/dion[.]hta hxxp://198[.]23[.]201[.]89/warm/DELIVERED%200606[.]exe hxxp://198[.]23[.]201[.]89/warm/Delivery%2006[.]exe hxxp://198[.]23[.]201[.]89/warm/proposal%20report[.]exe hxxp://198[.]23[.]201[.]89/warm/Auto%20R[.]exe hxxp://198[.]23[.]201[.]89/warm/Delivery%2007[.]exe hxxp://armanayegh[.]com/wee/wow123[.]hta hxxp://198[.]23[.]201[.]89/warm/VAT%20certificate[.]exe hxxp://198[.]23[.]201[.]89/warm/Satin06[.]exe hxxp://198[.]23[.]201[.]89/warm/wow123[.]hta |
Formbook |
| URL | hxxp://41[.]216[.]182[.]178/armv4l hxxp://41[.]216[.]182[.]178/armv5l hxxp://84[.]54[.]51[.]49/boat[.]ppc hxxp://84[.]54[.]51[.]49/boat[.]arm4 |
Bashlite |
| URL | hxxp://45[.]95[.]169[.]201/skid[.]arm | MooBot |
| URL | hxxp://117[.]204[.]196[.]132:53240/Mozi[.]m hxxp://117[.]204[.]193[.]125:35092/Mozi[.]m hxxp://117[.]204[.]192[.]241:60291/Mozi[.]m |
Mozi |
| URL | hxxp://103[.]253[.]43[.]175/_/scs/mail-static/_/js/ hxxp://1[.]92[.]96[.]35:8081/cm hxxps://193[.]53[.]126[.]234/g[.]pixel hxxp://107[.]172[.]32[.]178/pixel[.]gif hxxp://35[.]74[.]6[.]169/pixel hxxps://35[.]74[.]6[.]169/updates[.]rss hxxp://8[.]137[.]182[.]218:81/ptj hxxps://118[.]107[.]4[.]157:7443/g[.]pixel hxxp://20[.]83[.]148[.]22:5000/list/hx28/config[.]php hxxp://192[.]144[.]219[.]118/j[.]ad hxxps://103[.]150[.]10[.]45:8443/ptj hxxp://23[.]95[.]65[.]198:2222/updates[.]rss hxxps://47[.]92[.]24[.]58/pixel[.]gif hxxps://116[.]204[.]73[.]173/api/xxx hxxps://atlanticshoresresort[.]com/alert/v6[.]04/WWUF3E1D hxxps://8[.]210[.]9[.]201/push hxxp://206[.]233[.]133[.]151:8989/j[.]ad hxxps://xxydncg[.]xyz/faq hxxps://94[.]142[.]138[.]6/ca hxxps://81[.]69[.]242[.]80/ca hxxps://47[.]92[.]24[.]58:8001/pixel hxxps://185[.]186[.]146[.]25/ca hxxps://101[.]226[.]26[.]147/jquery-3[.]3[.]1[.]min[.]js hxxps://27[.]37[.]200[.]237/jquery-3[.]3[.]1[.]min[.]js hxxps://61[.]170[.]81[.]233/jquery-3[.]3[.]1[.]min[.]js hxxps://118[.]182[.]226[.]161/jquery-3[.]3[.]1[.]min[.]js hxxps://120[.]195[.]185[.]112/jquery-3[.]3[.]1[.]min[.]js hxxps://180[.]213[.]179[.]141/jquery-3[.]3[.]1[.]min[.]js hxxps://61[.]170[.]80[.]230/jquery-3[.]3[.]1[.]min[.]js hxxp://124[.]71[.]153[.]115/pixel hxxps://124[.]71[.]153[.]149/assets/css/font-awesome[.]css hxxp://4[.]191[.]74[.]1/dpixel hxxps://47[.]239[.]1[.]232/jquery-3[.]3[.]1[.]min[.]js hxxp://106[.]52[.]130[.]164:8080/updates hxxp://112[.]124[.]5[.]135:1234/IE9CompatViewList[.]xml hxxp://89[.]116[.]48[.]173:9999/pixel[.]gif hxxp://111[.]231[.]51[.]250:9090/activity hxxp://39[.]104[.]230[.]184:6668/ga[.]js hxxp://101[.]35[.]42[.]157/load hxxp://23[.]95[.]65[.]198:2222/activity hxxps://23[.]95[.]65[.]198/push hxxp://213[.]109[.]202[.]188/load hxxps://64[.]7[.]199[.]88:10443/dot[.]gif hxxps://cs[.]xfdaili[.]com/g[.]pixel hxxp://154[.]198[.]245[.]62/visit[.]js hxxps://iheartredteams[.]com/fwlink hxxps://23[.]95[.]65[.]198/g[.]pixel hxxps://134[.]122[.]75[.]115:444/push hxxp://110[.]41[.]14[.]58:8000/chat[.]exe hxxp://148[.]135[.]35[.]177:3389/Ladon401[.]rar hxxp://120[.]48[.]123[.]240:88/shellcode/main[.]exe hxxps://124[.]71[.]102[.]140/load hxxp://49[.]232[.]249[.]109:81/cx hxxp://58[.]137[.]140[.]238/g[.]pixel hxxp://54[.]169[.]254[.]221/j[.]ad hxxps://47[.]92[.]162[.]69/mall_100_100[.]html hxxps://sanhaozhifu[.]top:8443/jquery-3[.]3[.]1[.]min[.]js hxxp://185[.]22[.]152[.]167:8868/cx hxxp://118[.]89[.]200[.]169/activity hxxp://97[.]64[.]18[.]185:3333/ca hxxp://146[.]70[.]149[.]42:9999/j[.]ad hxxp://20[.]244[.]96[.]7/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://58[.]53[.]128[.]67:82/fwlink hxxps://candycappa[.]store/remove hxxps://34[.]92[.]25[.]154:8443/match hxxp://110[.]42[.]249[.]222:6666/jquery-3[.]3[.]1[.]min[.]js hxxp://116[.]62[.]232[.]222:8999/jquery-3[.]3[.]1[.]min[.]js hxxp://1[.]12[.]45[.]242:7002/introduction/edr hxxp://31[.]128[.]39[.]137:81/IE9CompatViewList[.]xml hxxp://47[.]92[.]162[.]69/mall_100_100[.]html hxxp://154[.]44[.]28[.]49:8080/en_US/all[.]js hxxp://128[.]1[.]40[.]125:50000/ca hxxps://154[.]44[.]28[.]49/match hxxps://sanhaozhifu[.]top/jquery-3[.]3[.]1[.]min[.]js hxxp://216[.]245[.]184[.]159:8080/alert/v6[.]04/WWUF3E1D hxxps://149[.]88[.]93[.]193/lv |
Cobalt Strike |
| URL | hxxp://77[.]91[.]77[.]122/4x[.]exe | RisePro |
| URL | hxxps://206[.]71[.]149[.]46/PAS0UQNfI0ZEC8kVhkn8CmhKHPAi3U/FusionClientDownloader[.]exe hxxp://206[.]71[.]149[.]46/PAS0UQNfI0ZEC8kVhkn8CmhKHPAi3U/FusionClientDownloader[.]exe |
Broomstick |
| URL | hxxps://ebaoffice[.]com[.]br/imagens/bo/inspecionando[.]php hxxp://109[.]110[.]184[.]31/exercito/inspecionando[.]php |
Ousaban |
| URL | hxxps://pasteio[.]com/raw/xqhPYNWM8hN6 | NjRAT |
| URL | hxxps://awial[.]patent[.]international-med[.]com/editContent hxxps://hylwy[.]result[.]garrettcountygranfondo[.]org/editContent hxxps://igi[.]patent[.]international-med[.]com/editContent hxxps://lllnx[.]patent[.]international-med[.]com/editContent hxxps://hycy[.]patent[.]international-med[.]com/editContent hxxps://lpgr[.]patent[.]international-med[.]com/editContent hxxps://qsjex[.]patent[.]international-med[.]com/editContent hxxps://uujuk[.]patent[.]international-med[.]com/editContent hxxps://dxlq[.]score[.]symposiumhaiti[.]com/gotoCheckout hxxps://coffeecrumbs[.]com/cdn-vs/original[.]js hxxps://coffeecrumbs[.]com/cdn-vs/cache[.]php hxxps://coffeecrumbs[.]com/cdn-vs/22per[.]php hxxp://psk777[.]casa/help[.]php hxxps://wbnr[.]patent[.]international-med[.]com/editContent hxxps://qxrt[.]distributors[.]commdistinc[.]com/editContent hxxps://zlv[.]patent[.]international-med[.]com/editContent hxxps://jub[.]patent[.]international-med[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://buaooql[.]com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6086ff13c5ec94 hxxp://buaooql[.]com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86ee9d834e875a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c7e795983ece6e hxxp://ezayyio[.]ua/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff819c0ed909e3a hxxp://bfudfdc[.]com/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6086fe14c4ec95 hxxp://buqyhbo[.]com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff819c1ea919933 hxxp://buqyhbo[.]com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12eab517aa5c96bd86eb9c864996148ab2865b77f80ebad9c40f7cb63037ed2ab423a4674383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1e89d9b3ec96c9e hxxp://erohvov[.]ua/search/?q=67e28dd83d5fa62d1358fa4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6086fc17c7eb95 hxxp://bunxepn[.]com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff819c3e9929933 hxxp://bunxepn[.]com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12eab517aa5c96bd86eb9c864996148ab2865b77f80ebad9c40f7cb63037ed2ab423a4674383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1e89d993dca6c9e hxxp://aqutbyl[.]ru/search/?q=67e28dd83f0bf1291606a9177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f171ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6086f810c8ec94 hxxp://aqutbyl[.]ru/search/?q=67e28dd83f0bf1291606a9177c27d78406abdd88be4b12eab517aa5c96bd86ef968649815a8bbc896c58e713bc90c91836b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c7e7929b33ce6e hxxp://ddnyera[.]info/search/?q=67e28dd86d5ff17c1407ad1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff819c7ee9d9832 hxxp://ddnyera[.]info/search/?q=67e28dd86d5ff17c1407ad1a7c27d78406abdd88be4b12eab517aa5c96bd86ec928749855a8bbc896c58e713bc90c91b36b5281fc235a925ed3e56d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee92923ccc67941f hxxp://ckfisyh[.]net/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6086f814c1ec97 hxxp://ckfisyh[.]net/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12eab517aa5c96bd86e892864b855a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c7e7929f3ace6d hxxp://bgqouoe[.]com/search/?q=67e28dd83854f77c460aad1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff819c7ea949939 hxxp://bgqouoe[.]com/search/?q=67e28dd83854f77c460aad1d7c27d78406abdd88be4b12eab517aa5c96bd86e8928e4b805a8bbc896c58e713bc90c91e36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee92923cc86e9514 hxxp://bogtcqs[.]com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6086f711c4e696 hxxp://bogtcqs[.]com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86ee9d834e875a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c7e79d9a3fc46c hxxp://boksuho[.]com/search/?q=67e28dd86d08f67e135aaa497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa18e8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff819c8ef919338 hxxp://boksuho[.]com/search/?q=67e28dd86d08f67e135aaa497c27d78406abdd88be4b12eab517aa5c96bd86e893844c845a8bbc896c58e713bc90c94d36b5281fc235a925ed3e03d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee929233cd6b9f15 |
Socks5 Systemz |
| URL | hxxp://185[.]172[.]128[.]93/sh hxxp://46[.]102[.]174[.]48/miner[.]exe hxxp://46[.]102[.]174[.]48/UAC[.]exe hxxp://185[.]172[.]128[.]11/update[.]exe hxxp://185[.]172[.]128[.]93/arm7 hxxp://185[.]172[.]128[.]93/x86_64 hxxp://185[.]172[.]128[.]11/putty[.]exe |
Coinminer |
| URL | hxxps://dcc[.]olcrv[.]com/login/tologin | More_eggs |
| URL | hxxps://pasteio[.]com/raw/xkbypgnZWk4P hxxps://megabytemantom[.]com/luck/work[.]exe |
Remcos |
| URL | hxxps://pasteio[.]com/raw/xUVkUvP9LFj3 hxxps://gbeotm[.]com/wp-content/upgrade/junexw[.]txt hxxps://viejolekecikarici[.]com/hvnmaynew[.]txt |
XWorm |
| URL | hxxp://149[.]102[.]147[.]106:550/q[.]jpg hxxps://212[.]70[.]149[.]205//c[.]jpg hxxps://212[.]70[.]149[.]205//63vN2[.]txt hxxp://91[.]92[.]240[.]136:222/xx[.]jpg hxxp://91[.]92[.]240[.]136:222/1111[.]rar hxxps://51[.]89[.]109[.]130/editor[.]jpg hxxps://51[.]89[.]109[.]130/hema[.]txt hxxps://109[.]199[.]101[.]109/1001[.]jpg hxxps://109[.]199[.]101[.]109/1001[.]txt |
AsyncRAT |
| URL | hxxp://194[.]59[.]31[.]187/Tilskrendes[.]toc hxxp://194[.]59[.]31[.]187/Hexagrammoid[.]mdp hxxp://194[.]59[.]31[.]187/cHleNhgsjvacp3[.]bin hxxp://194[.]59[.]31[.]187/QzntLMTGVCCBHmgfidHRwp21[.]bin hxxp://194[.]59[.]31[.]187/Stvnevarslernes[.]asd |
CloudEyE |
| URL | hxxp://221[.]158[.]86[.]16:4466/svchost[.]exe | Ghost RAT |
| URL | hxxp://120[.]48[.]123[.]240:88/shellcode/code[.]txt hxxp://148[.]135[.]35[.]177:3389/19288exe[.]rar |
Metasploit |
| URL | hxxp://47[.]120[.]46[.]210/exe/test[.]exe | Sliver |
| URL | hxxp://23[.]88[.]106[.]134/6a9f8e2503d99c04[.]php hxxp://23[.]88[.]106[.]134/566d6e1ec8db6394/sqlite3[.]dll hxxp://23[.]88[.]106[.]134/566d6e1ec8db6394/nss3[.]dll hxxp://23[.]88[.]106[.]134/566d6e1ec8db6394/vcruntime140[.]dll hxxp://23[.]88[.]106[.]134/566d6e1ec8db6394/freebl3[.]dll hxxp://23[.]88[.]106[.]134/566d6e1ec8db6394/mozglue[.]dll hxxp://23[.]88[.]106[.]134/566d6e1ec8db6394/softokn3[.]dll hxxp://23[.]88[.]106[.]134/566d6e1ec8db6394/msvcp140[.]dll hxxp://185[.]172[.]128[.]159/tiktok[.]exe hxxp://185[.]172[.]128[.]159//timeSync[.]exe |
Stealc |
| URL | hxxp://38[.]180[.]165[.]153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads[.]php hxxp://505732cm[.]n9shteam2[.]top/updatesqlDb[.]php hxxp://securitytransfer[.]top/EternalSecurebase[.]php |
DCRat |
| URL | hxxps://mediafire[.]zip/build[.]exe | Quasar RAT |
| URL | hxxp://110[.]41[.]14[.]58:8000/k[.]elf | ConnectBack |
| URL | hxxp://103[.]148[.]125[.]26//ready[.]apk | SpyNote |
| URL | hxxps://pantyl[.]com/loki[.]exe | LokiBot |
| URL | hxxp://5[.]42[.]64[.]56/installer/setup/soft | GCleaner |
| URL | hxxps://rsmbscm[.]wikilogistics[.]wiki/post[.]php | ClearFake |
| URL | hxxps://afanew[.]cl/Rqrad[.]dat | Agent Tesla |
