不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/07/18
※2024/07/18 更新
マルウェア感染させると考えられるURLを検知（2024/07/18）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://79[.]137[.]192[.]13/prog/669698e482bd9_finesoft[.]exe hxxp://79[.]137[.]192[.]13/lopsa/66967d2323cae_cry[.]exe |
Vidar |
| URL | hxxp://46[.]19[.]143[.]28/[.]n00b420/[.][.]vbuck[.]x86 | Bashlite |
| URL | hxxp://xss[.]ls/berduno[.]exe hxxps://whangeeeerodpz[.]shop/api |
Lumma Stealer |
| URL | hxxp://107[.]173[.]143[.]46/xampp/meh/gdfvr[.]hta hxxp://8[.]130[.]114[.]243/rmH6 hxxp://77[.]105[.]160[.]62/sapsan[.]exe |
Cobalt Strike |
| URL | hxxp://59[.]89[.]199[.]1:37301/Mozi[.]m hxxp://115[.]48[.]144[.]215:54334/Mozi[.]m |
Mozi |
| URL | hxxp://103[.]161[.]133[.]121/60960/greatlionloveroseentierworldlover[.]gIF hxxp://103[.]161[.]133[.]121/60960/BH/bh[.][.]x[.]x[.]xbh[.][.][.][.][.]x[.]x[.]x[.]xbhbh[.]doc hxxp://103[.]161[.]133[.]121/60960/ZHR[.]txt |
Snake Keylogger |
| URL | hxxps://heinltd[.]top/loud[.]doc hxxps://heinltd[.]top/loud[.]scr hxxps://heinltd[.]top/nell[.]doc hxxps://heinltd[.]top/nell[.]scr hxxps://hikplc[.]top/cbin[.]doc hxxps://hikplc[.]top/cbin[.]scr |
Formbook |
| URL | hxxp://162[.]251[.]122[.]71/FBgZu156[.]bin hxxp://162[.]251[.]122[.]71/TadxLfbdND151[.]bin hxxp://162[.]251[.]122[.]71/sZyzX148[.]bin hxxp://147[.]78[.]103[.]71/IhtTktnGZmpW163[.]bin |
CloudEyE |
| URL | hxxp://79[.]137[.]192[.]13/prog/6696629242869_crypted[.]exe | RedLine Stealer |
| URL | hxxp://77[.]91[.]77[.]81/lend/appmodedrivme[.]exe hxxp://77[.]91[.]77[.]80/lend/appmodedrivme[.]exe hxxp://77[.]91[.]77[.]82/lend/appmodedrivme[.]exe |
SystemBC |
| URL | hxxp://79[.]137[.]192[.]13/prog/669662d10259b_file150724[.]exe | STOP |
| URL | hxxp://103[.]124[.]105[.]111/mips | MooBot |
| URL | hxxp://45[.]9[.]74[.]36:8888/196371523423251[.]dll hxxp://45[.]9[.]74[.]36:8888/3144435225931[.]dll hxxp://45[.]9[.]74[.]36/out[.]php |
StrelaStealer |
| URL | hxxp://45[.]61[.]136[.]20/index[.]php/5597912977140 | LokiBot |
| URL | hxxp://novovisualcabeleireiros[.]com[.]br/BYsLV28[.]bin hxxp://ccrhs[.]shop/LB341/index[.]php |
Azorult |
| URL | hxxp://oakgrovetraining[.]com/cdn-vs/33per[.]php hxxps://oakgrovetraining[.]com/cdn-vs/33per[.]php hxxps://oakgrovetraining[.]com/cdn-vs/original[.]js hxxps://oakgrovetraining[.]com/cdn-vs/cache[.]php hxxps://vaj[.]parish[.]chuathuongxot[.]org/orderReview |
FAKEUPDATES |
| URL | hxxp://luxurycaborental[.]com/cdn-vs/data[.]php hxxps://luxurycaborental[.]com/cdn-vs/data[.]php hxxp://luxurycaborental[.]com/cdn-vs/data[.]php?12105 |
NetSupportManager RAT |
| URL | hxxps://2[.]58[.]80[.]130/sc2[.]exe hxxps://2[.]58[.]80[.]130/Ujuax[.]iso hxxps://2[.]58[.]80[.]130/scar2[.]hta |
AsyncRAT |
| URL | hxxp://192[.]3[.]101[.]135/wdeigthseven[.]vbs hxxp://192[.]3[.]101[.]135/base64newrdp[.]txt |
Agent Tesla |
| URL | hxxp://62[.]109[.]18[.]87/track3/Wordpress/GeoVideoDlejavascript/5Php1/requestprocessorLinux/Uploads/dle/Traffic/0Lowdatalife/1Wp/jsto2Temporary/ProtectPacket/VoiddbPrivate/SecureDumppoll/6Longpollserver0/Mariadb50/Bigload/externalSecureEternal/0/vmpythonsecurecpugamemultidbAsyncDatalifelocal[.]php | DCRat |
