不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/07/11
※2024/07/11 更新
マルウェア感染させると考えられるURLを検知（2024/07/11）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://samsunglimited[.]top/evie4/five/fre[.]php hxxp://198[.]46[.]178[.]161/90290/igcc[.]exe hxxp://198[.]46[.]178[.]161/xampp/hg/mk[.]mk[.]mk[.]mkmkmk[.]doc |
LokiBot |
| URL | hxxp://103[.]237[.]86[.]247/Svibelglasset[.]aca hxxp://103[.]237[.]86[.]247/jlnOPKdRwLDeKWZRG240[.]bin hxxp://103[.]237[.]86[.]247/gaveafgifts[.]hhk hxxp://103[.]237[.]86[.]247/kUdUMXcLsgN143[.]bin hxxp://zakk[.]co[.]za/RHwjAbsqASAkh181[.]bin hxxps://zakk[.]co[.]za/RHwjAbsqASAkh181[.]bin hxxps://white[.]carsmartag[.]com/fCgeQK229[.]bin hxxps://zakk[.]co[.]za/HkdzhFw244[.]bin hxxp://zakk[.]co[.]za/HkdzhFw244[.]bin |
CloudEyE |
| URL | hxxps://207[.]32[.]219[.]48/GOLD[.]exe hxxps://207[.]32[.]219[.]48/xt[.]png hxxps://207[.]32[.]218[.]10/xt[.]png hxxp://45[.]76[.]89[.]106/Built[.]exe hxxp://89[.]213[.]177[.]81/XClient[.]exe |
AsyncRAT |
| URL | hxxps://evolverangesolutions[.]com/wp-includes/images/x3h6[.]php hxxps://eternosrelojeria[.]com/cdn-vs/original[.]js hxxps://eternosrelojeria[.]com/cdn-vs/cache[.]php hxxp://eternosrelojeria[.]com/cdn-vs/33per[.]php hxxps://ilkj[.]patent[.]international-med[.]com/editContent hxxps://sherwoodhomeshow[.]com/cdn-vs/original[.]js hxxp://sherwoodhomeshow[.]com/cdn-vs/33per[.]php hxxps://sherwoodhomeshow[.]com/cdn-vs/cache[.]php |
FAKEUPDATES |
| URL | hxxps://bittercoldzzdwu[.]shop/api hxxp://43[.]153[.]49[.]49:8888/down/1qWbf4Bsej2u[.]exe hxxps://begghurldids[.]shop/api hxxps://respectabledpcs[.]shop/api hxxps://two-root[.]com/02074[.]bs64 hxxps://replica-souls[.]com/try/229[.]exe |
Lumma Stealer |
| URL | hxxp://109[.]248[.]151[.]231/ebii[.]txt hxxps://zakk[.]co[.]za/phUNYtQxSmYZxbcIZ182[.]bin hxxp://zakk[.]co[.]za/phUNYtQxSmYZxbcIZ182[.]bin |
Agent Tesla |
| URL | hxxp://51[.]77[.]140[.]74/Namz[.]exe hxxp://185[.]208[.]158[.]220/Setup[.]exe |
Coinminer |
| URL | hxxp://139[.]99[.]220[.]222/66266/ERVB[.]txt hxxp://139[.]99[.]220[.]222/99199/igcc[.]exe hxxp://139[.]99[.]220[.]222/99199/ub/ghj[.]ghj[.]ghj[.]ghj[.]doc hxxp://139[.]99[.]220[.]222/66266/gh/gh[.]gh[.]gh[.]ghghghgh[.]doc hxxp://139[.]99[.]220[.]222/66266/ucancrosstheflowerbeautiytogetin[.]gIF |
Remcos |
| URL | hxxps://npaperjoy[.]com/new/a[.]exe | Nanocore RAT |
| URL | hxxp://51[.]79[.]141[.]54/bolonetwork[.]arm hxxp://51[.]79[.]141[.]54/bolonetwork[.]arm5 hxxp://92[.]249[.]48[.]30/condi[.]arm7 hxxp://92[.]249[.]48[.]30/condi[.]mpsl hxxp://92[.]249[.]48[.]30/condi[.]arm5 hxxp://92[.]249[.]48[.]30/condi[.]x86_64 hxxp://92[.]249[.]48[.]30/condi[.]x86 hxxp://92[.]249[.]48[.]30/condi[.]mips |
Bashlite |
| URL | hxxps://selamcanoonaber[.]site/ZDljMGYyZTQ3YWRi/ hxxps://hava540derece[.]com/ZDljMGYyZTQ3YWRi/ hxxps://cehennemdirloo34[.]com/ZDljMGYyZTQ3YWRi/ hxxps://sicaktanbayilcam52[.]com/ZDljMGYyZTQ3YWRi/ hxxps://otururkenterliyorum42[.]com/ZDljMGYyZTQ3YWRi/ hxxps://sicakdanbeynimyandii2[.]com/ZDljMGYyZTQ3YWRi/ |
Coper |
| URL | hxxps://bades[.]co[.]tz/tmp/2[.]exe hxxps://foodbook[.]live/tmp/1[.]exe |
SmokeLoader |
| URL | hxxp://57[.]180[.]253[.]244/gg[.]dll | MimiKatz |
| URL | hxxp://89[.]213[.]177[.]81/test[.]exe hxxps://tmars[.]net/PtkxpRhUuGWvwVbwNcCtG164[.]bin hxxp://89[.]213[.]177[.]81/sevchost[.]exe |
Formbook |
| URL | hxxp://185[.]172[.]128[.]116/builds[.]exe | Vidar |
| URL | hxxps://dfwreds[.]com/data[.]php hxxp://dfwreds[.]com/data[.]php |
NetSupportManager RAT |
| URL | hxxp://89[.]213[.]177[.]81/nj[.]exe | NjRAT |
| URL | hxxp://hendai[.]top/ProvidervideoJspollmultifloweruniversalDle[.]php | DCRat |
| URL | hxxp://econorthbrasil[.]com[.]br/media/hRYRIsBi15[.]bin hxxp://hqt3[.]shop/KL341/index[.]php |
Azorult |
| URL | hxxps://fellzobr[.]com/am/random[.]exe hxxp://89[.]23[.]103[.]42/hb9IvshS02/index[.]php |
Amadey |
| URL | hxxp://185[.]216[.]214[.]217/cdn-directory/see[.]exe | RedLine Stealer |
| URL | hxxp://45[.]152[.]114[.]233/129edec4272dc2c8[.]php | Stealc |
| URL | hxxps://mbsngradnja[.]com/213_Dkjylgodxcg hxxp://mbsngradnja[.]com/213_Dkjylgodxcg |
DBatLoader |
| URL | hxxps://luciaricciardi[.]com/wp-content/uploads/2018/12/epitheliogeneticTFr[.]exe hxxps://www[.]luciaricciardi[.]com/wp-content/uploads/2018/12/epitheliogeneticTFr[.]exe hxxps://schermarieti[.]it/wp-content/uploads/2019/09/batsterQZzYf[.]exe hxxps://schermarieti[.]it/wp-content/uploads/2019/09/bitteredXD3[.]php hxxps://schermarieti[.]it/wp-content/uploads/2019/09/eriocomiXQ[.]ps1 hxxps://schermarieti[.]it/wp-content/uploads/2019/09/incarcerative7iEA[.]php hxxps://schermarieti[.]it/wp-content/uploads/2019/09/zietrisikiteFtK[.]ps1 hxxps://lechiavetteusb[.]it/imgs/usb/logo/arteriomalacia4hc[.]php hxxps://lechiavetteusb[.]it/imgs/usb/logo/wizeninglYZn[.]ps1 hxxps://lechiavetteusb[.]it/imgs/usb/logo/andantezWA[.]php hxxps://www[.]dsestimation[.]com/wp-content/uploads/2015/10/noncontrabandsVB1[.]ps1 hxxps://lechiavetteusb[.]it/imgs/usb/logo/khesariQUXH[.]ps1 hxxps://lechiavetteusb[.]it/imgs/usb/logo/spiralitykSzkj[.]exe |
Koi Loader |
