不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2024/07/26
※2024/07/26 更新
マルウェア感染させると考えられるURLを検知（2024/07/26）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://722659cl[.]nyashtop[.]top/VmhttpTempdownloads[.]php | DCRat |
| URL | hxxp://45[.]83[.]207[.]67/svchost[.]exe | NjRAT |
| URL | hxxp://198[.]46[.]174[.]139/55/winiti[.]exe | Agent Tesla |
| URL | hxxp://162[.]248[.]247[.]133/1/xmrig-6[.]20[.]0-linux-x64/xmrig-6[.]20[.]0/xmrig | XMRig |
| URL | hxxp://185[.]196[.]10[.]57/selectex-file-host/54gtxx[.]exe hxxps://globalbankpay[.]com/stealc/random[.]exe hxxps://financetodayusa[.]com/stealc/random[.]exe hxxps://www[.]globalbankpay[.]com/stealc/random[.]exe hxxps://www[.]financetodayusa[.]com/stealc/random[.]exe hxxps://www[.]globalfinmasters[.]com/stealc/random[.]exe hxxps://globalfinmasters[.]com/stealc/random[.]exe hxxp://185[.]215[.]113[.]19/stealc/random[.]exe hxxp://185[.]215[.]113[.]16/stealc/random[.]exe |
Stealc |
| URL | hxxp://91[.]92[.]246[.]160/ArPZwWiPDhT225[.]bin hxxp://212[.]162[.]149[.]108/MKZzZSTUNSlf176[.]bin hxxp://212[.]162[.]149[.]108/PpiYXOg190[.]bin hxxp://212[.]162[.]149[.]108/MmaiRdBRrlrSePv214[.]bin |
CloudEyE |
| URL | hxxp://cpanel-adminhost[.]com/VivgjseKctB249[.]bin hxxp://cpanel-adminhost[.]com/hairdressing[.]ocx hxxp://172[.]234[.]216[.]245/60/simplekisstogetmebackwithme[.]gIF hxxps://172[.]234[.]216[.]245/55/kbm/plangetitsbacktounderstandhowmuchgreatethingsaregoingtobegetbacktothethingshappeninggetbackinterstedthings____________sheisbeatyofgirlthingstogetback[.]doc hxxp://172[.]234[.]216[.]245/55/kbm/plangetitsbacktounderstandhowmuchgreatethingsaregoingtobegetbacktothethingshappeninggetbackinterstedthings____________sheisbeatyofgirlthingstogetback[.]doc hxxp://185[.]29[.]9[.]32/81/dg/simplethingsbutsuchagreatthingstobackwithinentirethingstohappenedwithentirethingsbackwith_________simplethingsbacktounderserthings[.]doc |
Remcos |
| URL | hxxp://104[.]219[.]239[.]104/54/winiti[.]exe hxxp://104[.]219[.]239[.]104/xampp/bh/simplethingstobefranksheisverybeautifulgirlevenwhichicaansethegirltogetbacktohegreattingsforme__________sheisverybeautyhotgirlsever[.]doc hxxps://sunorox[.]cloud/industries[.]exe hxxp://sunorox[.]cloud/industries[.]exe |
Formbook |
| URL | hxxp://104[.]131[.]159[.]100/load | Cobalt Strike |
| URL | hxxp://imc1[.]top/cdn-vs/22per[.]php hxxps://imc1[.]top/cdn-vs/22per[.]php hxxps://imc1[.]top/cdn-vs/original[.]js hxxps://imc1[.]top/cdn-vs/main[.]php hxxps://novidadesfresquinhas[.]online/cdn-vs/original[.]js hxxps://novidadesfresquinhas[.]online/cdn-vs/main[.]php hxxp://novidadesfresquinhas[.]online/cdn-vs/22per[.]php hxxps://packedbrick[.]com/vfRg2L1ej33bleY00JdN9pxuSvOX2mNI-nTw9UpUoPg hxxps://qxup[.]loyalty[.]hienphucuanhanloai[.]org/orderReview |
FAKEUPDATES |
| URL | hxxps://hhic[.]top/data[.]php hxxp://hhic[.]top/data[.]php |
NetSupportManager RAT |
| URL | hxxp://www[.]buyn[.]xyz/bot[.]ppc hxxp://buyn[.]xyz/bot[.]ppc hxxp://91[.]92[.]242[.]107/bot[.]ppc |
Bashlite |
| URL | hxxp://45[.]61[.]136[.]20/index[.]php/jlbcyg0q595vs4hef0 | LokiBot |
| URL | hxxp://109[.]120[.]176[.]203/api/twofish[.]php | PrivateLoader |
| URL | hxxp://221[.]15[.]198[.]201:33519/Mozi[.]m | Mozi |
| URL | hxxps://168[.]76[.]20[.]197/ready[.]apk hxxp://168[.]76[.]20[.]197/ready[.]apk hxxp://18[.]221[.]24[.]26/ready[.]apk hxxp://168[.]76[.]20[.]196/ready[.]apk hxxp://168[.]76[.]20[.]195/ready[.]apk hxxp://168[.]76[.]20[.]204/ready[.]apk hxxps://168[.]76[.]20[.]198/ready[.]apk hxxps://168[.]76[.]20[.]194/ready[.]apk hxxp://168[.]76[.]20[.]194/ready[.]apk hxxp://168[.]76[.]20[.]198/ready[.]apk hxxps://168[.]76[.]20[.]195/ready[.]apk hxxps://168[.]76[.]20[.]196/ready[.]apk hxxps://18[.]221[.]24[.]26/ready[.]apk hxxp://168[.]76[.]20[.]205/ready[.]apk hxxps://168[.]76[.]20[.]205/ready[.]apk hxxps://168[.]76[.]20[.]206/ready[.]apk hxxp://168[.]76[.]20[.]203/ready[.]apk hxxps://168[.]76[.]20[.]202/ready[.]apk hxxps://168[.]76[.]20[.]203/ready[.]apk hxxp://168[.]76[.]20[.]206/ready[.]apk hxxps://168[.]76[.]20[.]204/ready[.]apk hxxp://168[.]76[.]20[.]202/ready[.]apk hxxp://156[.]248[.]77[.]207/ready[.]apk hxxps://156[.]248[.]77[.]207/ready[.]apk hxxps://158[.]69[.]110[.]218/ready[.]apk hxxps://vps76729[.]cloudpublic[.]com[.]br/ready[.]apk hxxp://158[.]69[.]110[.]218/ready[.]apk hxxp://vps76729[.]cloudpublic[.]com[.]br/ready[.]apk hxxps://168[.]76[.]20[.]212/%E5%AF%AB%E7%9C%9F1[.]apk hxxps://168[.]76[.]20[.]210/%E5%AF%AB%E7%9C%9F1[.]apk hxxp://168[.]76[.]20[.]214/%E5%AF%AB%E7%9C%9F1[.]apk hxxp://168[.]76[.]20[.]212/%E5%AF%AB%E7%9C%9F1[.]apk hxxps://168[.]76[.]20[.]211/%E5%AF%AB%E7%9C%9F1[.]apk hxxps://168[.]76[.]20[.]214/%E5%AF%AB%E7%9C%9F1[.]apk hxxp://168[.]76[.]20[.]211/%E5%AF%AB%E7%9C%9F1[.]apk hxxps://168[.]76[.]20[.]213/%E5%AF%AB%E7%9C%9F1[.]apk hxxp://168[.]76[.]20[.]213/%E5%AF%AB%E7%9C%9F1[.]apk hxxp://168[.]76[.]20[.]210/%E5%AF%AB%E7%9C%9F1[.]apk |
SpyNote |
| URL | hxxp://185[.]215[.]113[.]16/inc/25072023[.]exe hxxp://185[.]215[.]113[.]16/inc/4ck3rr[.]exe hxxps://financetodayusa[.]com/inc/4ck3rr[.]exe hxxps://www[.]globalfinmasters[.]com/inc/4ck3rr[.]exe hxxps://globalbankpay[.]com/inc/25072023[.]exe hxxps://www[.]globalbankpay[.]com/inc/25072023[.]exe hxxps://globalfinmasters[.]com/inc/4ck3rr[.]exe hxxps://globalbankpay[.]com/inc/4ck3rr[.]exe hxxps://www[.]financetodayusa[.]com/inc/4ck3rr[.]exe hxxps://www[.]globalbankpay[.]com/inc/4ck3rr[.]exe hxxps://www[.]financetodayusa[.]com/inc/25072023[.]exe hxxps://financetodayusa[.]com/inc/25072023[.]exe hxxps://globalfinmasters[.]com/inc/25072023[.]exe hxxps://www[.]globalfinmasters[.]com/inc/25072023[.]exe hxxp://185[.]215[.]113[.]19/inc/4ck3rr[.]exe hxxp://185[.]215[.]113[.]19/inc/25072023[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]215[.]113[.]16/inc/2020[.]exe hxxp://185[.]215[.]113[.]8/nxmr[.]exe hxxps://www[.]globalfinmasters[.]com/inc/2020[.]exe hxxps://financetodayusa[.]com/inc/2020[.]exe hxxps://www[.]financetodayusa[.]com/inc/2020[.]exe hxxps://globalbankpay[.]com/inc/2020[.]exe hxxps://www[.]globalbankpay[.]com/inc/2020[.]exe hxxps://globalfinmasters[.]com/inc/2020[.]exe hxxp://185[.]215[.]113[.]19/inc/2020[.]exe |
Coinminer |
| URL | hxxp://mkstat595[.]xyz/ldx111[.]exe | SmokeLoader |
| URL | hxxp://185[.]215[.]113[.]8/newtpp[.]exe | Phorpiex |
