不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/06/14
※2024/06/14 更新
マルウェア感染させると考えられるURLを検知（2024/06/14）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://aakidkw[.]ru/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cfb12c2ec97 hxxp://aakidkw[.]ru/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12eab517aa5c96bd86e5908f4e96148ab2865b77f80ebad9c10f7cb63037ed2ab423a43b4383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689fe19c2eb969838cf hxxp://dtudyvv[.]info/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c4ec97993b hxxp://dtudyvv[.]info/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12eab517aa5c96bd86e895834c845a8bbc896c58e713bc90c91f36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d983fce6d9516 hxxp://ckaoaox[.]net/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cfb13c3ec95 hxxp://bnbzijm[.]com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c4ed969832 hxxp://ceosfdz[.]net/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cfa13c2ec97 hxxp://ceosfdz[.]net/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12eab517aa5c96bd86ef9c8f48835a8bbc896c58e713bc90c91836b5281fc235a925ed3e03d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c8ed909839ce6d hxxp://ayipbru[.]ru/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c5ed979939 hxxp://ayipbru[.]ru/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12eab517aa5c96bd86e895834c845a8bbc896c58e713bc90c91f36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d983ecf6d9514 hxxp://ddtwinv[.]info/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cfa10c3eb91 hxxp://ddtwinv[.]info/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12eab517aa5c96bd86ec928644825a8bbc896c58e713bc90c91836b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c8ed909b38c96b hxxp://bobkdou[.]com/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cfb18c5eb97 hxxp://bhmxftq[.]com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c4e690993a hxxp://bhmxftq[.]com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12eab517aa5c96bd86e890834e96148ab2865b77f80ebad9c20f7cb63037ed2ab423a4314383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1e7979e32c86c97 hxxp://benwddw[.]com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cfa16c3ec90 hxxp://benwddw[.]com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12eab517aa5c96bd86e5908f4e96148ab2865b77f80ebad9c10f7cb63037ed2ab423a43b4383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689fe19c2ea929938c8 hxxp://aavebxf[.]ru/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cf813c3ec94 hxxp://aavebxf[.]ru/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12eab517aa5c96bd86e5908f4e96148ab2865b77f80ebad9c10f7cb63037ed2ab423a43b4383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689fe19c2e8979938cc hxxp://bfeiuwu[.]com/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cf710c0eb92 hxxp://bfeiuwu[.]com/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12eab517aa5c96bd86ec928644825a8bbc896c58e713bc90c91836b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c8ed9d9b3bc968 hxxp://aywlqbh[.]ru/search/?q=67e28dd86e09a721465dff1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978f771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c8ea979939 hxxp://aywlqbh[.]ru/search/?q=67e28dd86e09a721465dff1c7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4d885a8bbc896c58e713bc90c91136b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d9833c86d9514 hxxp://beobmhv[.]com/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cf611c6eb93 hxxp://beobmhv[.]com/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12eab517aa5c96bd86ec928644825a8bbc896c58e713bc90c91836b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c8ed9c9a3dc969 hxxp://bpqsicu[.]com/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cf616c5ec91 hxxp://borteyu[.]com/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cf616c2ec97 hxxp://borteyu[.]com/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12eab517aa5c96bd86ef9c8f48835a8bbc896c58e713bc90c91836b5281fc235a925ed3e03d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c8ed9c9d39ce6d hxxp://erwocpv[.]ua/search/?q=67e28dd86e09a721465dff1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978f771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c9e897993a hxxp://erwocpv[.]ua/search/?q=67e28dd86e09a721465dff1c7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4d885a8bbc896c58e713bc90c91136b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d9832ca6d9517 hxxp://ccjqqrm[.]net/search/?q=67e28dd86f54a728120ffa1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cf617c6ec97 hxxp://bdllgev[.]com/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dff10c7eb97 hxxp://boltsoe[.]com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff712c0ee929e3a hxxp://dlycueq[.]info/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dff14c9ec94 hxxp://bufblhn[.]com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dff18c8eb90 hxxp://bufblhn[.]com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12eab517aa5c96bd86e5908f4e96148ab2865b77f80ebad9c10f7cb63037ed2ab423a43b4383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689fe19c3ef9c923fc8 hxxp://buvddib[.]com/search/?q=67e28dd86509f67a4206fe1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa45e8889b5e4fa9281ae978f171ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dff17c8ec91 hxxp://buvddib[.]com/search/?q=67e28dd86509f67a4206fe1b7c27d78406abdd88be4b12eab517aa5c96bd86ee958f4a805a8bbc896c58e713bc90c91036b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c8ec959c33ce6b hxxp://ejzosbh[.]ua/search/?q=67e28dd83e0bfb2e455aa5187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f171ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff712c0e99d993a hxxp://ejzosbh[.]ua/search/?q=67e28dd83e0bfb2e455aa5187c27d78406abdd88be4b12eab517aa5c96bd86ec94814f845a8bbc896c58e713bc90c91f36b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d993bcb679517 hxxp://buoupuo[.]com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dfe14c8ec94 hxxp://bbxuduj[.]com/search/?q=67e28dd86e09a721465dff1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978f771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff712c1ea9d993a hxxp://cepkxjy[.]net/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dfe14c5ec91 hxxp://cepkxjy[.]net/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12eab517aa5c96bd86ee92844d845a8bbc896c58e713bc90c91b36b5281fc235a925ed3e55d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c8ec949f3ece6b |
Socks5 Systemz |
| URL | hxxps://140[.]238[.]27[.]183:2053/push hxxps://bsrc[.]baidusec[.]top:8443/lu[.]js hxxps://as[.]baidusec[.]top:8443/lu[.]js hxxps://b2b[.]baidusec[.]top:8443/lu[.]js hxxps://tag[.]baidusec[.]top:8443/lu[.]js hxxps://www[.]baidusec[.]top:8443/lu[.]js hxxps://baidusec[.]top:8443/lu[.]js hxxp://104[.]194[.]153[.]54:3555/jquery-3[.]3[.]1[.]min[.]js hxxp://web[.]windowsupdate[.]shop:2086/jquery-3[.]3[.]1[.]min[.]js hxxp://47[.]120[.]60[.]201/j[.]ad hxxp://47[.]242[.]22[.]64:8080/load hxxp://60[.]204[.]171[.]143/ptj hxxps://111[.]230[.]207[.]222/analytics/v1_upload hxxps://139[.]199[.]216[.]201/hp/api/v1/carousel hxxps://134[.]175[.]235[.]98/feedapi/v1/newsserver/api/getpassword hxxps://117[.]72[.]45[.]41/load hxxp://120[.]53[.]250[.]9:9999/CWoNaJLBo/VTNeWw11212/ hxxps://43[.]138[.]20[.]240:10443/updates hxxps://liolio[.]cn:8443/__utm[.]gif hxxp://101[.]43[.]12[.]111:9999/j[.]ad hxxp://134[.]122[.]75[.]115/j[.]ad hxxp://172[.]81[.]211[.]162:12343/g[.]pixel hxxp://113[.]250[.]188[.]15:8454/fwlink hxxp://134[.]122[.]75[.]115:23/IE9CompatViewList[.]xml hxxps://118[.]107[.]4[.]157:7443/updates[.]rss hxxps://172[.]81[.]211[.]162:12344/visit[.]js hxxps://116[.]204[.]118[.]96/recite/v9[.]52/6FCQ3UVD9 hxxps://8[.]134[.]160[.]65/jquery-3[.]3[.]1[.]min[.]js hxxps://106[.]15[.]62[.]124:7777/activity hxxp://67[.]207[.]166[.]175/xampp/gts/BrowserUpdate[.]hta hxxp://79[.]124[.]40[.]106:82/activity hxxp://111[.]67[.]195[.]152:3333/cm hxxp://8[.]222[.]230[.]186/cx hxxps://156[.]251[.]162[.]29/g[.]pixel hxxp://103[.]143[.]248[.]179/push hxxp://134[.]122[.]75[.]115/match hxxps://59[.]80[.]47[.]124/feedapi/v1/newsserver/api/getusername hxxps://61[.]170[.]44[.]194/hp/api/v1/carousel hxxps://111[.]6[.]56[.]138/feedapi/v1/newsserver/api/getusername hxxps://111[.]51[.]156[.]247/feedapi/v1/newsserver/api/getpassword hxxps://183[.]232[.]189[.]148/feedapi/v1/newsserver/api/getusername hxxp://106[.]75[.]155[.]80/IE9CompatViewList[.]xml hxxps://43[.]134[.]59[.]76/cx hxxps://5[.]181[.]202[.]127/visit[.]js hxxps://103[.]97[.]59[.]121/claim/servlets-examples/I2I52XQKQQZF hxxp://qax1[.]top/jquery-3[.]3[.]1[.]min[.]js |
Cobalt Strike |
| URL | hxxps://dskkgcvkflk[.]com/Safe%E8%A1%A8%E6%A0%BCejw665[.]exe hxxp://221[.]158[.]86[.]16:7744/svchvst[.]exe |
Ghost RAT |
| URL | hxxps://owij[.]team[.]jessicabarrett[.]com/editContent hxxps://newmarketofficecleaning[.]com/cdn-vs/original[.]js hxxps://newmarketofficecleaning[.]com/cdn-vs/cache[.]php hxxps://newmarketofficecleaning[.]com/cdn-vs/22per[.]php hxxp://santapubcrawlchattanooga[.]com/cdn-vs/22per[.]php hxxp://r6pedihosi[.]website/data[.]php hxxps://santapubcrawlchattanooga[.]com/cdn-vs/cache[.]php hxxps://santapubcrawlchattanooga[.]com/cdn-vs/original[.]js hxxps://hkc[.]team[.]jessicabarrett[.]com/editContent hxxps://unmmx[.]patent[.]international-med[.]com/editContent |
FAKEUPDATES |
| URL | hxxps://dukeenergyltd[.]top/bin2[.]doc hxxps://dukeenergyltd[.]top/bin1[.]doc hxxps://covid19help[.]top/sharo[.]doc hxxps://covid19help[.]top/sharo[.]scr |
Formbook |
| URL | hxxp://77[.]91[.]77[.]81/lend/onecommander[.]exe hxxps://falseaudiencekd[.]shop/api hxxps://marathonbeedksow[.]shop/api hxxps://feighminoritsjda[.]shop/api hxxps://pleasurenarrowsdla[.]shop/api hxxps://raiseboltskdlwpow[.]shop/api hxxps://justifycanddidatewd[.]shop/api hxxps://strwawrunnygjwu[.]shop/api hxxps://richardflorespoew[.]shop/api hxxp://77[.]91[.]77[.]81/lend/luma22222[.]exe hxxp://77[.]91[.]77[.]81/lend/lummac2[.]exe hxxp://77[.]91[.]77[.]81/lend/motruhjgmawes[.]exe hxxp://77[.]91[.]77[.]81/lend/zardsystemschange[.]exe |
Lumma Stealer |
| URL | hxxp://93[.]123[.]85[.]120/fenomenalu[.]sparc hxxp://93[.]123[.]85[.]120/fenomenalu[.]x86 |
Bashlite |
| URL | hxxp://5[.]42[.]104[.]243/tempProton/2BasePrivate/Datalifeserverlow/0lowDlesecure/4generatorDownloadsServer/4geohttp/mariadb/Wordpress/eternalVmTojavascriptProcessprotectFlower[.]php | DCRat |
| URL | hxxp://46[.]183[.]222[.]15/hfjyJOEput74[.]bin hxxp://46[.]183[.]222[.]15/Snothvalpenes[.]fla hxxp://46[.]183[.]222[.]15/gbnjlLFjyzbaW234[.]bin hxxp://46[.]183[.]222[.]15/Syngamous[.]asi hxxp://46[.]183[.]222[.]15/Gentianose[.]psp hxxp://46[.]183[.]222[.]15/REcQEKYBjPhKOetcSGM53[.]bin hxxp://www[.]lasji[.]net/dcvaevlikGh98[.]bin hxxp://109[.]248[.]151[.]196/XCrtCUiDlq29[.]bin |
CloudEyE |
| URL | hxxp://77[.]91[.]77[.]81/lend/realtekaft[.]exe | SystemBC |
| URL | hxxps://biripildiridurdursunlaan[.]com/OTMwMzA1YjQ0NDMy hxxps://sonykulaklik61[.]com/OTMwMzA1YjQ0NDMy hxxps://evdesuyok51x[.]com/OTMwMzA1YjQ0NDMy hxxps://dizaynmalikane61[.]com/OTMwMzA1YjQ0NDMy hxxps://aritmasuyux2[.]com/OTMwMzA1YjQ0NDMy hxxps://bumberceket56[.]com/OTMwMzA1YjQ0NDMy hxxps://sedakavanozkapagix1[.]com/OTMwMzA1YjQ0NDMy hxxps://mariooyunoynuyorx[.]com/OTMwMzA1YjQ0NDMy hxxps://haberlersvar01[.]com/OTMwMzA1YjQ0NDMy/ hxxps://biripildiridur32[.]com/OTMwMzA1YjQ0NDMy |
Coper |
| URL | hxxps://23[.]26[.]76[.]239/dre[.]jpg hxxps://23[.]26[.]76[.]239/vikis[.]txt |
AsyncRAT |
| URL | hxxp://218[.]29[.]30[.]54:50076/Mozi[.]m | Mozi |
