不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様32社 -
2024/07/16
※2024/07/16 更新
マルウェア感染させると考えられるURLを検知（2024/07/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://replacedoxcjzp[.]shop/api hxxps://declaredczxi[.]shop/api hxxps://contemplateodszsv[.]shop/api hxxps://conformfucdioz[.]shop/api hxxps://catchddkxozvp[.]shop/api hxxps://bindceasdiwozx[.]shop/api hxxps://arriveoxpzxo[.]shop/api hxxps://applyzxcksdia[.]shop/api hxxp://77[.]105[.]132[.]27/lumma1207[.]exe hxxps://requestyex[.]shop/api hxxp://176[.]123[.]2[.]229/empty/approacharchitectpro[.]zip hxxp://77[.]91[.]77[.]81/lend/file1111[.]exe hxxps://bigmouthudiop[.]shop/api |
Lumma Stealer |
| URL | hxxp://139[.]99[.]220[.]222/55066/crosscheckrosefloweronhairbeauty[.]gIF hxxp://139[.]99[.]220[.]222/55066/hm/hm[.]hm[.]hm[.]hmhmhm[.]doc hxxp://139[.]99[.]220[.]222/55066/RGBC[.]txt hxxp://216[.]245[.]184[.]74/webdav/AmplandSara[.]exe hxxp://216[.]245[.]184[.]74/webdav/Windows_Services_AS[.]exe hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/RmUp[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Rup[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Rz[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Rz[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/RmUp[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Rmz[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Rmz[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Rup[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/R[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/RCup3[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/RCup3[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/R[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/RCup[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Rm[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/RCup[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Rm[.]txt |
Remcos |
| URL | hxxp://102[.]33[.]37[.]205:44165/Mozi[.]m hxxp://120[.]61[.]80[.]102:34220/Mozi[.]m |
Mozi |
| URL | hxxp://172[.]93[.]222[.]175/GAxyNfOuG150[.]bin hxxp://194[.]59[.]30[.]114/IlTRvPdUHevxtXWSH239[.]bin hxxp://194[.]59[.]30[.]114/eyhrhLwIOkacEnOowony153[.]bin hxxp://194[.]59[.]30[.]114/cUmnYOTKQXAHNVvNjHz10[.]bin hxxp://194[.]59[.]30[.]114/vBFDTx192[.]bin hxxp://194[.]59[.]30[.]114/Blotlgger[.]mix hxxp://194[.]59[.]30[.]114/CTScnFj46[.]bin hxxp://194[.]59[.]30[.]114/Optllingen[.]mdp hxxp://194[.]59[.]30[.]114/QoNGqRlihlEHmyvHbhC131[.]bin hxxp://194[.]59[.]30[.]114/Wattest[.]pfb hxxp://194[.]59[.]30[.]114/ZfdbA73[.]bin hxxp://194[.]59[.]30[.]114/kys[.]snp hxxps://anchornorth[.]com/wOXyOuvBG230[.]bin hxxps://167[.]71[.]187[.]91/pjevm227[.]bin hxxps://boxystudio[.]com/pjevm227[.]bin |
CloudEyE |
| URL | hxxp://45[.]61[.]137[.]6/tmp/mscorsvc[.]dll hxxp://45[.]61[.]137[.]6/others/download/windows/Cami[.]bak[.]cbk hxxp://45[.]61[.]137[.]6/tmp/test_2[.]dll hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Q7[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Q7[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/T3[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/T3[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Q2[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Q2[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Q1[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Q1[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Qxx[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Qxx[.]txt hxxp://185[.]196[.]9[.]251/autotask/Q-backup[.]exe hxxp://185[.]196[.]9[.]251/autotask/Eppzjtedzmk[.]exe hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Qx[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Qx[.]txt hxxp://77[.]232[.]41[.]110/large/svchost[.]exe hxxp://18[.]231[.]251[.]59/7574745/tiopatinhas[.]rar |
Quasar RAT |
| URL | hxxp://45[.]139[.]198[.]242/Microsoft_Service[.]exe hxxps://103[.]252[.]88[.]90/Npl[.]js hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Async[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/DCR[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/PS1[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/PS1[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Async[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/DCR[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Dx[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Asx[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Dx[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/Asx[.]txt hxxp://185[.]196[.]9[.]251/TPB-2-Links/Ntprfgupx-2[.]exe hxxp://185[.]196[.]9[.]251/TPB-G/Ndhqvdmn-1[.]exe hxxp://185[.]196[.]9[.]251/FreeApps/Dzodhr-FREE-2[.]exe hxxp://185[.]196[.]9[.]251/1337/Wjgqesf-OLD-2[.]exe hxxp://185[.]196[.]9[.]251/limetor/Kgilth-LIME-2[.]exe hxxp://185[.]196[.]9[.]251/HEXO-SOFTWARE/Sazae-2[.]exe hxxp://185[.]196[.]9[.]251/TORRENT-SPAM/Kbdxdxwj-2[.]exe hxxp://185[.]196[.]9[.]251/newz2k/Ivnut-Z2K-2[.]exe hxxp://185[.]196[.]9[.]251/Z2KNEW/Ivnut-Z2K-2[.]exe hxxp://185[.]196[.]9[.]251/TG-Source/Trkyzwvg-TG-A[.]exe hxxp://185[.]196[.]9[.]251/TG-Source/TG-Source-2[.]exe hxxp://23[.]26[.]76[.]239:888/dre[.]jpg hxxp://23[.]26[.]76[.]239:888/vikis[.]txt hxxp://38[.]22[.]104[.]227:666/tnttawy[.]jpg hxxp://38[.]22[.]104[.]227:666/nlb[.]txt hxxp://38[.]22[.]104[.]227:666/dmi[.]txt |
AsyncRAT |
| URL | hxxp://185[.]165[.]171[.]49/HealthPhone[.]apk | Metasploit |
| URL | hxxp://185[.]165[.]171[.]49/havoc_x64[.]exe hxxps://185[.]165[.]171[.]49/to hxxps://185[.]165[.]171[.]49/d hxxps://185[.]165[.]171[.]49/L hxxps://185[.]165[.]171[.]49/H hxxps://185[.]165[.]171[.]49/t hxxps://185[.]165[.]171[.]49/z hxxps://185[.]165[.]171[.]49/n hxxps://185[.]165[.]171[.]49/B hxxps://185[.]165[.]171[.]49/Ro |
Havoc |
| URL | hxxp://77[.]91[.]77[.]80/cant/tuman[.]exe hxxp://77[.]91[.]77[.]81/cant/tuman[.]exe hxxp://85[.]28[.]47[.]31/stealc/random[.]exe hxxp://85[.]28[.]47[.]30/stealc/random[.]exe |
Mars Stealer |
| URL | hxxps://mutocosturoyur[.]com/YmJhM2M5ZjYyODY5/ hxxps://lolo2naberlo[.]com/YmJhM2M5ZjYyODY5/ hxxps://havalarsicaktir[.]com/YmJhM2M5ZjYyODY5/ hxxps://r4s5t2t2fa[.]com/YmJhM2M5ZjYyODY5/ hxxps://gurcustill254[.]com/YmJhM2M5ZjYyODY5/ hxxps://kesmecekarpuz[.]site/NGE2Y2RjYjdmYjg3/ hxxps://kesmecekarpuz[.]com/NGE2Y2RjYjdmYjg3/ hxxps://kesmecekarpuz145[.]com/NGE2Y2RjYjdmYjg3/ hxxps://kesmecekarpuz878[.]com/NGE2Y2RjYjdmYjg3/ hxxps://kesmecekarpuz5446[.]com/NGE2Y2RjYjdmYjg3/ hxxps://kesmecekarpuz8455[.]com/NGE2Y2RjYjdmYjg3/ |
Coper |
| URL | hxxp://77[.]105[.]132[.]27/vidar1207[.]exe hxxp://216[.]245[.]184[.]74/webdav/Windows_Components[.]exe hxxp://185[.]172[.]128[.]116/buildjj[.]exe hxxp://45[.]61[.]139[.]35/8d9973d30ceb470a/mozglue[.]dll hxxp://79[.]137[.]195[.]246/client12/plut[.]exe |
Vidar |
| URL | hxxp://77[.]91[.]77[.]81/tonik/voda[.]exe hxxp://77[.]91[.]77[.]82/tonik/voda[.]exe hxxp://77[.]91[.]77[.]82/cant/tuman[.]exe hxxp://46[.]8[.]238[.]240/201a735ed890db75[.]php hxxp://89[.]110[.]69[.]218/d055591556743e3c/freebl3[.]dll hxxp://89[.]110[.]69[.]218/d055591556743e3c/mozglue[.]dll hxxp://89[.]110[.]69[.]218/d055591556743e3c/softokn3[.]dll hxxp://89[.]110[.]69[.]218/d055591556743e3c/sqlite3[.]dll hxxp://89[.]110[.]69[.]218/d055591556743e3c/nss3[.]dll hxxp://89[.]110[.]69[.]218/d055591556743e3c/msvcp140[.]dll hxxp://89[.]110[.]69[.]218/d055591556743e3c/vcruntime140[.]dll hxxp://89[.]110[.]69[.]218/d4e186a7092be5c7[.]php hxxp://85[.]28[.]47[.]70/570d5d5e8678366c[.]php hxxp://77[.]232[.]41[.]110/large/hello[.]exe hxxp://85[.]28[.]47[.]70/663cea891445d733/nss3[.]dll hxxp://85[.]28[.]47[.]70/663cea891445d733/sqlite3[.]dll hxxp://85[.]28[.]47[.]70/663cea891445d733/freebl3[.]dll hxxp://85[.]28[.]47[.]70/663cea891445d733/msvcp140[.]dll hxxp://85[.]28[.]47[.]70/663cea891445d733/softokn3[.]dll hxxp://85[.]28[.]47[.]70/663cea891445d733/mozglue[.]dll hxxp://85[.]28[.]47[.]70/663cea891445d733/vcruntime140[.]dll hxxp://testyregerglegrjerg[.]top/9f244f7bc6ab2605/sqlite3[.]dll hxxp://testyregerglegrjerg[.]top/9f244f7bc6ab2605/nss3[.]dll hxxp://testyregerglegrjerg[.]top/9f244f7bc6ab2605/vcruntime140[.]dll hxxp://testyregerglegrjerg[.]top/9f244f7bc6ab2605/softokn3[.]dll hxxp://testyregerglegrjerg[.]top/9f244f7bc6ab2605/msvcp140[.]dll hxxp://testyregerglegrjerg[.]top/9f244f7bc6ab2605/freebl3[.]dll hxxp://testyregerglegrjerg[.]top/9f244f7bc6ab2605/mozglue[.]dll hxxp://85[.]28[.]47[.]101/56c57ad9d521c6c4/vcruntime140[.]dll hxxp://85[.]28[.]47[.]101/56c57ad9d521c6c4/softokn3[.]dll hxxp://85[.]28[.]47[.]101/56c57ad9d521c6c4/sqlite3[.]dll hxxp://85[.]28[.]47[.]101/56c57ad9d521c6c4/freebl3[.]dll hxxp://85[.]28[.]47[.]101/56c57ad9d521c6c4/msvcp140[.]dll hxxp://85[.]28[.]47[.]101/56c57ad9d521c6c4/mozglue[.]dll hxxp://85[.]28[.]47[.]101/56c57ad9d521c6c4/nss3[.]dll hxxp://5[.]230[.]253[.]197/46ea3ef0390e13b4[.]php |
Stealc |
| URL | hxxp://77[.]91[.]77[.]96/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://77[.]91[.]77[.]96/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://77[.]91[.]77[.]96/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://77[.]91[.]77[.]96/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://77[.]91[.]77[.]96/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://77[.]91[.]77[.]96/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://77[.]91[.]77[.]96/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://77[.]91[.]77[.]80/lend/potkmdaw[.]exe hxxp://77[.]91[.]77[.]82/lend/potkmdaw[.]exe hxxp://185[.]196[.]9[.]251/TPB-2-Links/TPB-1[.]exe hxxp://185[.]196[.]9[.]251/TG-Source/TG-Source-1[.]exe hxxp://185[.]196[.]9[.]251/TPB-G/TPB-GRENN-1[.]exe hxxp://185[.]196[.]9[.]251/update/TPB-1[.]exe hxxp://185[.]196[.]9[.]251/HEXO-SOFTWARE/Sazae-1[.]exe hxxp://185[.]196[.]9[.]251/HEXO-SOFTWARE/HEXO-SOFTWARE-1[.]exe hxxp://185[.]196[.]9[.]251/TPBActivetor/TPB-ACTIVATOR-1[.]exe hxxp://185[.]196[.]9[.]251/TORRENT-SPAM/TORRENT-SPAM-1[.]exe hxxp://185[.]196[.]9[.]251/FreeApps/FREE-APPS-1[.]exe hxxp://185[.]196[.]9[.]251/limetor/LIMETORRENTS-1[.]exe hxxp://185[.]196[.]9[.]251/1337/TORRENTOLD-1[.]exe hxxp://185[.]196[.]9[.]251/newz2k/Z2K-1[.]exe hxxp://185[.]196[.]9[.]251/Z2KNEW/Z2K-1[.]exe |
RecordBreaker |
| URL | hxxp://www[.]flyxz[.]top/bot[.]arm7 hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]mips hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]mpsl hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]arm6 hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]arm4 hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]arm5 hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]x86 hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]sparc hxxp://103[.]28[.]33[.]98/fuckjewishpeople[.]ppc hxxp://31[.]44[.]2[.]165/x-8[.]6-[.]SNOOPY hxxp://31[.]44[.]2[.]165/a-r[.]m-5[.]SNOOPY hxxp://31[.]44[.]2[.]165/a-r[.]m-4[.]SNOOPY hxxp://31[.]44[.]2[.]165/a-r[.]m-6[.]SNOOPY hxxp://31[.]44[.]2[.]165/p-p[.]c-[.]SNOOPY hxxp://31[.]44[.]2[.]165/s-h[.]4-[.]SNOOPY hxxp://31[.]44[.]2[.]165/m-p[.]s-l[.]SNOOPY hxxp://31[.]44[.]2[.]165/a-r[.]m-7[.]SNOOPY hxxp://31[.]44[.]2[.]165/m-i[.]p-s[.]SNOOPY hxxp://37[.]156[.]29[.]141/hidakibest[.]arm7 hxxp://51[.]79[.]142[.]121/bolonetwork[.]arm hxxp://51[.]79[.]142[.]121/bolonetwork[.]arm5 hxxp://45[.]66[.]231[.]148/arm7 |
Bashlite |
| URL | hxxps://kaoj[.]parish[.]chuathuongxot[.]org/orderReview hxxps://zznc[.]parish[.]chuathuongxot[.]org/orderReview hxxps://oey[.]parish[.]chuathuongxot[.]org/orderReview hxxps://rolqo[.]parish[.]chuathuongxot[.]org/orderReview hxxps://vzq[.]parish[.]chuathuongxot[.]org/orderReview hxxps://dhp[.]parish[.]chuathuongxot[.]org/orderReview hxxps://luxurycaborental[.]com/cdn-vs/original[.]js hxxps://luxurycaborental[.]com/cdn-vs/cache[.]php hxxp://luxurycaborental[.]com/cdn-vs/33per[.]php hxxps://e2sky[.]com/adcount[.]js hxxps://e2sky[.]com/js[.]php hxxps://talk2rami[.]com/wp-content/upgrade/qasd[.]php hxxps://ymxzm[.]award[.]vuheritagefoundation[.]org/orderReview hxxps://yff[.]parish[.]chuathuongxot[.]org/orderReview hxxps://kpe[.]parish[.]chuathuongxot[.]org/orderReview hxxps://ioj[.]award[.]vuheritagefoundation[.]org/orderReview hxxps://swuz[.]award[.]vuheritagefoundation[.]org/orderReview |
FAKEUPDATES |
| URL | hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/ny1[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Nx[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/ny0[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/ZX2[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Nx[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/N3[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/N3[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/N1[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/N1[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/njz[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/njx[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/njz[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/njx[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/ny1[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/NJ[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/NJ[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/ny0[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/P[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/P[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/ZX2[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/nc[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/nc[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/FeSarog[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/FeSarog[.]txt |
NjRAT |
| URL | hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Wx1[.]txt hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/Wx1[.]txt |
Warzone RAT |
| URL | hxxps://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/PR[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/Nousados/PR[.]txt |
ArrowRAT |
| URL | hxxp://77[.]91[.]77[.]81/lend/newstart[.]exe hxxp://185[.]196[.]9[.]251/TPB-2-Links/Ntprfgupx-1[.]exe hxxp://185[.]196[.]9[.]251/FreeApps/Rrobknnz-FREEAPPS[.]exe hxxp://185[.]196[.]9[.]251/newz2k/Rrobknnz-Z2K[.]exe hxxp://185[.]196[.]9[.]251/TORRENT-SPAM/Kbdxdxwj-1[.]exe hxxp://185[.]196[.]9[.]251/limetor/Rrobknnz-LIMETORRENTS[.]exe hxxp://185[.]196[.]9[.]251/TPBActivetor/Rrobknnz-TPBA[.]exe hxxp://185[.]196[.]9[.]251/1337/Rrobknnz-TORRENTOLD[.]exe hxxp://185[.]196[.]9[.]251/Z2KNEW/Rrobknnz-Z2K[.]exe hxxp://185[.]196[.]9[.]251/TG-Source/Trkyzwvg-TG-R[.]exe hxxp://88[.]198[.]89[.]4/auto/7869fe697b38eacd367fdb01cf539f58/217[.]exe |
RedLine Stealer |
| URL | hxxps://rtc-moostas[.]com/buy/ | EugenLoader |
| URL | hxxp://185[.]196[.]9[.]251/update/Rrobknnz-TPB[.]exe | N-W0rm |
| URL | hxxp://185[.]196[.]9[.]251/autotask/Eflbu[.]exe hxxps://inspirepk[.]org/tmp/1[.]exe |
SmokeLoader |
| URL | hxxp://185[.]196[.]8[.]12/am/random[.]exe hxxps://foodupdates[.]shop/webdav/shfiles/am[.]exe hxxp://downloaddining[.]com/h9fmdW5/index[.]php hxxp://downloaddining[.]com/h9fmdW5/Login[.]php hxxp://185[.]196[.]8[.]126/h9fmdW7/index[.]php |
Amadey |
| URL | hxxp://185[.]196[.]9[.]251/1337/Mfceum-4[.]exe hxxp://185[.]196[.]9[.]251/TPBActivetor/Mfceum-4[.]exe hxxp://185[.]196[.]9[.]251/FreeApps/Mfceum-4[.]exe hxxp://185[.]196[.]9[.]251/limetor/Mfceum-4[.]exe hxxp://185[.]196[.]9[.]251/newz2k/Mfceum-4[.]exe hxxp://185[.]196[.]9[.]251/Z2KNEW/Mfceum-4[.]exe hxxps://lurenjiapd[.]cloud/AV[.]scr hxxps://lurenjiapd[.]cloud/Photo[.]scr hxxps://lurenjiapd[.]cloud/Video[.]scr hxxps://lurenjiapd[.]cloud/fms/Photo[.]scr hxxps://lurenjiapd[.]cloud/fms/Video[.]scr hxxp://tsrv1[.]ws/tpeinf[.]exe hxxp://twizt[.]net/nxmr[.]exe hxxp://rddissisifigifidi[.]net/nxmr[.]exe hxxp://aeufoeahfouefhg[.]top/nxmr[.]exe hxxp://aefiabeuodbauobfafoebbf[.]net/nxmr[.]exe hxxp://aiiaiafrzrueuedur[.]net/nxmr[.]exe hxxp://deauduafzgezzfgm[.]top/nxmr[.]exe hxxp://aeufoeahfouefhg[.]top/tpeinf[.]exe hxxp://rddissisifigifidi[.]net/tpeinf[.]exe hxxp://loeghaiofiehfihf[.]to/nxmr[.]exe hxxp://thaus[.]top/nxmr[.]exe hxxp://fihsifuiiusuiuduf[.]com/nxmr[.]exe hxxp://eguaheoghouughahsu[.]cc/nxmr[.]exe hxxp://loeghaiofiehfihf[.]to/tpeinf[.]exe hxxp://thaus[.]top/tpeinf[.]exe hxxp://twizt[.]net/tpeinf[.]exe hxxp://aiiaiafrzrueuedur[.]net/tpeinf[.]exe hxxp://aefiabeuodbauobfafoebbf[.]net/tpeinf[.]exe hxxp://fihsifuiiusuiuduf[.]com/tpeinf[.]exe hxxp://deauduafzgezzfgm[.]top/tpeinf[.]exe hxxp://eguaheoghouughahsu[.]cc/tpeinf[.]exe hxxp://aefieiaehfiaehr[.]top/nxmr[.]exe hxxp://aefieiaehfiaehr[.]top/tpeinf[.]exe |
Coinminer |
| URL | hxxp://itechnetworkbd[.]com:4433/globals[.]css | Cobalt Strike |
| URL | hxxp://203[.]232[.]37[.]151/av_downloader1[.]1[.]exe | Babadeda |
| URL | hxxp://574056cm[.]nyashka[.]top/ExternalCpuDefaultdb[.]php hxxp://949542cm[.]nyashka[.]top/externaldefaultprivate[.]php hxxp://193046cm[.]nyashka[.]top/externaleternal_pollpacketLongpollapitestUploads[.]php |
DCRat |
| URL | hxxp://ns2[.]check-time[.]ru/asdf[.]EXE | Rhadamanthys |
| URL | hxxps://a[.]spynote[.]us/dx/25804[.]apk hxxps://a[.]spynote[.]us/dx/27610[.]apk hxxps://a[.]spynote[.]us/dx/24404[.]apk hxxps://a[.]spynote[.]us/dx/20632[.]apk hxxps://a[.]spynote[.]us/dx/8320[.]apk hxxps://a[.]spynote[.]us/dx/20714[.]apk hxxps://a[.]spynote[.]us/dx/27314[.]apk hxxps://a[.]spynote[.]us/dx/29157[.]apk hxxps://a[.]spynote[.]us/dx/11965[.]apk hxxps://a[.]spynote[.]us/d/23828[.]apk hxxps://panel[.]spynote[.]us/dx/27314[.]apk hxxps://a[.]spynote[.]us/dx/25461[.]apk hxxps://a[.]spynote[.]us/dx/10188[.]apk hxxps://a[.]spynote[.]us/d/24046[.]apk hxxps://a[.]spynote[.]us/dx/8212[.]apk hxxps://a[.]spynote[.]us/dx/7072[.]apk hxxps://a[.]spynote[.]us/dx/12179[.]apk hxxps://a[.]spynote[.]us/dx/9232[.]apk hxxps://a[.]spynote[.]us/dx/8156[.]apk hxxps://a[.]spynote[.]us/dx/20009[.]apk hxxps://a[.]spynote[.]us/dx/17752[.]apk hxxps://a[.]spynote[.]us/dx/4417[.]apk hxxps://a[.]spynote[.]us/d/28460[.]apk hxxps://a[.]spynote[.]us/dx/18901[.]apk hxxps://a[.]spynote[.]us/dx/10646[.]apk hxxps://a[.]spynote[.]us/dx/20049[.]apk hxxps://a[.]spynote[.]us/dx/28002[.]apk hxxps://a[.]spynote[.]us/dx/6513[.]apk hxxps://a[.]spynote[.]us/dx/13483[.]apk hxxps://panel[.]spynote[.]us/d/4943[.]apk hxxps://a[.]spynote[.]us/d/4943[.]apk hxxps://panel[.]spynote[.]us/dx/25461[.]apk hxxps://panel[.]spynote[.]us/d/14257[.]apk hxxps://a[.]spynote[.]us/d/14471[.]apk hxxps://panel[.]spynote[.]us/d/10339[.]apk hxxps://a[.]spynote[.]us/d/5664[.]apk hxxps://panel[.]spynote[.]us/d/1625[.]apk hxxps://a[.]spynote[.]us/d/142[.]apk hxxps://a[.]spynote[.]us/d/16260[.]apk hxxps://a[.]spynote[.]us/d/2327[.]apk hxxps://a[.]spynote[.]us/d/10368[.]apk hxxps://a[.]spynote[.]us/d/14257[.]apk hxxps://panel[.]spynote[.]us/dx/24404[.]apk hxxps://a[.]spynote[.]us/d/10339[.]apk hxxps://panel[.]spynote[.]us/d/10368[.]apk hxxps://panel[.]spynote[.]us/dx/4417[.]apk hxxps://panel[.]spynote[.]us/dx/20049[.]apk hxxps://a[.]spynote[.]us/d/10366[.]apk hxxps://a[.]spynote[.]us/d/19203[.]apk hxxps://panel[.]spynote[.]us/dx/8156[.]apk hxxps://panel[.]spynote[.]us/d/16250[.]apk hxxps://panel[.]spynote[.]us/d/14471[.]apk hxxps://panel[.]spynote[.]us/d/24046[.]apk hxxps://a[.]spynote[.]us/d/16340[.]apk hxxps://panel[.]spynote[.]us/dx/28002[.]apk hxxps://panel[.]spynote[.]us/dx/20714[.]apk hxxps://panel[.]spynote[.]us/dx/13483[.]apk hxxps://panel[.]spynote[.]us/dx/10188[.]apk hxxps://panel[.]spynote[.]us/d/5664[.]apk hxxps://panel[.]spynote[.]us/d/23828[.]apk hxxps://a[.]spynote[.]us/d/10123[.]apk hxxps://panel[.]spynote[.]us/dx/9232[.]apk hxxps://panel[.]spynote[.]us/d/16290[.]apk hxxps://panel[.]spynote[.]us/d/1683[.]apk hxxps://panel[.]spynote[.]us/d/23184[.]apk hxxps://a[.]spynote[.]us/d/23184[.]apk hxxps://a[.]spynote[.]us/d/15472[.]apk hxxps://panel[.]spynote[.]us/dx/18901[.]apk hxxps://panel[.]spynote[.]us/d/11108[.]apk hxxps://panel[.]spynote[.]us/d/15472[.]apk hxxps://a[.]spynote[.]us/d/16250[.]apk hxxps://panel[.]spynote[.]us/d/16260[.]apk hxxps://panel[.]spynote[.]us/d/2327[.]apk hxxps://a[.]spynote[.]us/d/11735[.]apk hxxps://a[.]spynote[.]us/d/1625[.]apk hxxps://a[.]spynote[.]us/d/11108[.]apk hxxps://panel[.]spynote[.]us/d/142[.]apk hxxps://a[.]spynote[.]us/d/1[.]apk hxxps://panel[.]spynote[.]us/d/10113[.]apk hxxps://panel[.]spynote[.]us/dx/12179[.]apk hxxps://a[.]spynote[.]us/d/16290[.]apk hxxps://panel[.]spynote[.]us/dx/8212[.]apk hxxps://panel[.]spynote[.]us/d/16340[.]apk hxxps://panel[.]spynote[.]us/d/19203[.]apk hxxps://panel[.]spynote[.]us/d/10123[.]apk hxxps://a[.]spynote[.]us/d/1683[.]apk hxxps://a[.]spynote[.]us/d/10113[.]apk hxxps://panel[.]spynote[.]us/dx/20009[.]apk hxxps://panel[.]spynote[.]us/dx/29157[.]apk hxxps://panel[.]spynote[.]us/dx/8320[.]apk hxxps://panel[.]spynote[.]us/d/28460[.]apk hxxps://panel[.]spynote[.]us/dx/11965[.]apk hxxps://panel[.]spynote[.]us/d/11735[.]apk hxxps://panel[.]spynote[.]us/dx/25804[.]apk hxxps://panel[.]spynote[.]us/d/1[.]apk hxxps://panel[.]spynote[.]us/dx/10646[.]apk hxxps://panel[.]spynote[.]us/dx/17752[.]apk hxxps://panel[.]spynote[.]us/dx/6513[.]apk hxxps://panel[.]spynote[.]us/dx/7072[.]apk hxxps://panel[.]spynote[.]us/dx/27610[.]apk hxxps://panel[.]spynote[.]us/dx/20632[.]apk hxxps://panel[.]spynote[.]us/d/10366[.]apk hxxp://45[.]130[.]151[.]211/dx/13483[.]apk hxxp://45[.]130[.]151[.]211/dx/9232[.]apk hxxp://45[.]130[.]151[.]211/dx/11965[.]apk hxxp://45[.]130[.]151[.]211/dx/4417[.]apk hxxp://45[.]130[.]151[.]211/dx/10646[.]apk hxxp://45[.]130[.]151[.]211/d/142[.]apk hxxp://45[.]130[.]151[.]211/d/1[.]apk hxxp://45[.]130[.]151[.]211/d/19203[.]apk hxxp://45[.]130[.]151[.]211/d/14257[.]apk hxxp://45[.]130[.]151[.]211/d/11735[.]apk hxxp://45[.]130[.]151[.]211/d/15472[.]apk hxxp://45[.]130[.]151[.]211/d/5664[.]apk hxxp://45[.]130[.]151[.]211/d/24046[.]apk hxxp://45[.]130[.]151[.]211/dx/20632[.]apk hxxp://45[.]130[.]151[.]211/dx/29157[.]apk hxxp://45[.]130[.]151[.]211/dx/8320[.]apk hxxp://45[.]130[.]151[.]211/d/14471[.]apk hxxp://45[.]130[.]151[.]211/d/1683[.]apk hxxp://45[.]130[.]151[.]211/d/23828[.]apk hxxp://45[.]130[.]151[.]211/d/23184[.]apk hxxp://45[.]130[.]151[.]211/d/4943[.]apk hxxp://45[.]130[.]151[.]211/dx/18901[.]apk hxxp://45[.]130[.]151[.]211/dx/20009[.]apk hxxp://45[.]130[.]151[.]211/d/16290[.]apk hxxp://45[.]130[.]151[.]211/d/10366[.]apk hxxp://45[.]130[.]151[.]211/d/10123[.]apk hxxp://45[.]130[.]151[.]211/d/11108[.]apk hxxps://45[.]130[.]151[.]211/dx/25804[.]apk hxxp://45[.]130[.]151[.]211/d/10339[.]apk hxxp://45[.]130[.]151[.]211/d/10113[.]apk hxxp://45[.]130[.]151[.]211/d/10368[.]apk hxxps://45[.]130[.]151[.]211/dx/10188[.]apk hxxps://45[.]130[.]151[.]211/dx/25461[.]apk hxxps://45[.]130[.]151[.]211/dx/10646[.]apk hxxp://45[.]130[.]151[.]211/d/16340[.]apk hxxp://45[.]130[.]151[.]211/dx/17752[.]apk hxxp://45[.]130[.]151[.]211/dx/20714[.]apk hxxp://45[.]130[.]151[.]211/d/1625[.]apk hxxp://45[.]130[.]151[.]211/dx/27314[.]apk hxxp://45[.]130[.]151[.]211/d/28460[.]apk hxxp://45[.]130[.]151[.]211/dx/7072[.]apk hxxp://45[.]130[.]151[.]211/dx/6513[.]apk hxxp://45[.]130[.]151[.]211/dx/24404[.]apk hxxp://45[.]130[.]151[.]211/dx/27610[.]apk hxxp://45[.]130[.]151[.]211/d/2327[.]apk hxxp://45[.]130[.]151[.]211/dx/20049[.]apk hxxp://45[.]130[.]151[.]211/dx/8212[.]apk hxxp://45[.]130[.]151[.]211/dx/25804[.]apk hxxp://45[.]130[.]151[.]211/dx/12179[.]apk hxxp://45[.]130[.]151[.]211/dx/8156[.]apk hxxp://45[.]130[.]151[.]211/d/16260[.]apk hxxp://45[.]130[.]151[.]211/d/16250[.]apk hxxp://45[.]130[.]151[.]211/dx/25461[.]apk hxxp://45[.]130[.]151[.]211/dx/10188[.]apk hxxp://45[.]130[.]151[.]211/dx/28002[.]apk hxxps://45[.]130[.]151[.]211/d/16340[.]apk hxxps://45[.]130[.]151[.]211/d/16250[.]apk hxxps://45[.]130[.]151[.]211/d/2327[.]apk hxxps://45[.]130[.]151[.]211/d/23184[.]apk hxxps://45[.]130[.]151[.]211/dx/8320[.]apk hxxps://45[.]130[.]151[.]211/d/15472[.]apk hxxps://45[.]130[.]151[.]211/dx/8212[.]apk hxxps://45[.]130[.]151[.]211/d/10339[.]apk hxxps://45[.]130[.]151[.]211/d/23828[.]apk hxxps://45[.]130[.]151[.]211/dx/28002[.]apk hxxps://45[.]130[.]151[.]211/d/10368[.]apk hxxps://45[.]130[.]151[.]211/d/19203[.]apk hxxps://45[.]130[.]151[.]211/dx/24404[.]apk hxxps://45[.]130[.]151[.]211/d/1625[.]apk hxxps://45[.]130[.]151[.]211/d/14257[.]apk hxxps://45[.]130[.]151[.]211/d/28460[.]apk hxxps://45[.]130[.]151[.]211/d/11108[.]apk hxxps://45[.]130[.]151[.]211/d/5664[.]apk hxxps://45[.]130[.]151[.]211/d/16260[.]apk hxxps://45[.]130[.]151[.]211/d/14471[.]apk hxxps://45[.]130[.]151[.]211/dx/8156[.]apk hxxps://45[.]130[.]151[.]211/dx/18901[.]apk hxxps://45[.]130[.]151[.]211/dx/13483[.]apk hxxps://45[.]130[.]151[.]211/d/11735[.]apk hxxps://45[.]130[.]151[.]211/d/4943[.]apk hxxps://45[.]130[.]151[.]211/d/10366[.]apk hxxps://45[.]130[.]151[.]211/dx/20009[.]apk hxxps://45[.]130[.]151[.]211/dx/20632[.]apk hxxps://45[.]130[.]151[.]211/dx/17752[.]apk hxxps://45[.]130[.]151[.]211/dx/12179[.]apk hxxps://45[.]130[.]151[.]211/dx/11965[.]apk hxxps://45[.]130[.]151[.]211/d/16290[.]apk hxxps://45[.]130[.]151[.]211/dx/7072[.]apk hxxps://45[.]130[.]151[.]211/dx/20714[.]apk hxxps://45[.]130[.]151[.]211/d/24046[.]apk hxxps://45[.]130[.]151[.]211/d/142[.]apk hxxps://45[.]130[.]151[.]211/dx/4417[.]apk hxxps://45[.]130[.]151[.]211/dx/29157[.]apk hxxps://45[.]130[.]151[.]211/dx/27314[.]apk hxxps://45[.]130[.]151[.]211/dx/27610[.]apk hxxps://45[.]130[.]151[.]211/d/1683[.]apk hxxps://45[.]130[.]151[.]211/dx/9232[.]apk hxxps://45[.]130[.]151[.]211/dx/6513[.]apk hxxps://45[.]130[.]151[.]211/dx/20049[.]apk hxxps://45[.]130[.]151[.]211/d/10123[.]apk hxxps://45[.]130[.]151[.]211/d/10113[.]apk hxxps://45[.]130[.]151[.]211/d/1[.]apk |
SpyNote |
| URL | hxxps://85[.]209[.]133[.]132/file/install[.]exe | XWorm |
| URL | hxxp://45[.]88[.]91[.]107/running/LgGFdDAm/AntiVirus[.]exe hxxp://45[.]88[.]91[.]107/LgGFdDAm3/AntiVirus1[.]exe hxxp://45[.]88[.]91[.]107/all%20file/LgGFdDAm/main[.]exe hxxp://45[.]88[.]91[.]107/running/rkAIWKEr/win1[.]exe hxxp://45[.]88[.]91[.]107/LgGFdDAm/main[.]exe hxxp://45[.]88[.]91[.]107/rkAIWKEr2/win1[.]exe |
Venom RAT |
| URL | hxxp://45[.]88[.]91[.]107/me/Rihypax_LetThereBeNightingale_obf[.]exe | Formbook |
| URL | hxxps://covid19help[.]top/mano[.]scr hxxps://covid19help[.]top/nick[.]scr |
Agent Tesla |
| URL | hxxp://104[.]248[.]205[.]66/index[.]php/wp?s=831 hxxps://ampol[.]top/dukas[.]scr hxxp://104[.]248[.]205[.]66/index[.]php/file[.]php?an=74870072817 hxxp://45[.]61[.]136[.]20/index[.]php/slide?post=1 |
LokiBot |
| URL | hxxp://tsrv1[.]ws/pei[.]exe hxxp://aiiaiafrzrueuedur[.]net/pei[.]exe hxxp://eguaheoghouughahsu[.]cc/pei[.]exe hxxp://thaus[.]top/npp[.]exe hxxp://twizt[.]net/npp[.]exe hxxp://deauduafzgezzfgm[.]top/pei[.]exe hxxp://aefiabeuodbauobfafoebbf[.]net/npp[.]exe hxxp://fihsifuiiusuiuduf[.]com/npp[.]exe hxxp://thaus[.]top/pei[.]exe hxxp://fihsifuiiusuiuduf[.]com/pei[.]exe hxxp://loeghaiofiehfihf[.]to/npp[.]exe hxxp://deauduafzgezzfgm[.]top/npp[.]exe hxxp://aefiabeuodbauobfafoebbf[.]net/pei[.]exe hxxp://twizt[.]net/pei[.]exe hxxp://aeufoeahfouefhg[.]top/npp[.]exe hxxp://rddissisifigifidi[.]net/pei[.]exe hxxp://aeufoeahfouefhg[.]top/pei[.]exe hxxp://aiiaiafrzrueuedur[.]net/npp[.]exe hxxp://loeghaiofiehfihf[.]to/pei[.]exe hxxp://eguaheoghouughahsu[.]cc/npp[.]exe hxxp://rddissisifigifidi[.]net/npp[.]exe hxxp://aefieiaehfiaehr[.]top/npp[.]exe hxxp://aefieiaehfiaehr[.]top/pei[.]exe |
Phorpiex |
| URL | hxxps://foodupdates[.]shop/webdav/shfiles/cp[.]exe | HijackLoader |
