不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/09/10
※2024/09/10 更新
マルウェア感染させると考えられるURLを検知（2024/09/10）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://youtransfer[.]net/handler/download?action=download&download_id=Jgc6sLaF&private_id=0&url=https%253A%252F%252Fyoutransfer[.]net%252FJgc6sLaF hxxps://voinformatica[.]com[.]pt/l[.]exe hxxps://cutesliprpepo[.]shop/api |
Lumma Stealer |
| URL | hxxp://154[.]216[.]17[.]214/cpu[.]jpg hxxp://154[.]216[.]17[.]214/dev[.]jpg hxxp://37[.]156[.]29[.]141/141[.]zip |
Coinminer |
| URL | hxxp://216[.]245[.]184[.]245/1[.]zip/Client/cobaltstrike-client[.]jar hxxp://116[.]196[.]117[.]112:8888/w68x |
Cobalt Strike |
| URL | hxxps://voinformatica[.]com[.]pt/s[.]exe hxxp://147[.]45[.]44[.]104/yuop/66dda11e4dbe5_crystealc[.]exe hxxp://185[.]215[.]113[.]103/e2b1563c6670f193[.]php hxxp://62[.]204[.]41[.]151/ScreenDataSync[.]exe hxxp://31[.]41[.]244[.]9/doku/burda[.]exe |
Stealc |
| URL | hxxps://voinformatica[.]com[.]pt/v[.]exe | Vidar |
| URL | hxxp://89[.]197[.]154[.]116/AvosLocker[.]exe | AvosLocker |
| URL | hxxp://147[.]45[.]44[.]104/revada/66dd9bfe41964_w9[.]exe hxxp://147[.]45[.]44[.]104/lopsa/66dd9b656c6a0_cry[.]exe hxxp://147[.]45[.]44[.]104/revada/66dd9b20d75ea_otr[.]exe |
RedLine Stealer |
| URL | hxxp://80[.]76[.]176[.]23/prompt[.]exe | Meterpreter |
| URL | hxxps://cxwm[.]podcast[.]lisameyerson[.]com/orderReview hxxps://moneymoj[.]com/cdn-vs/original[.]js hxxps://moneymoj[.]com/cdn-vs/index[.]php hxxps://moneymoj[.]com/cdn-vs/update[.]php hxxps://swiftflicks[.]com/cdn-vs/original[.]js hxxps://swiftflicks[.]com/cdn-vs/index[.]php hxxps://swiftflicks[.]com/cdn-vs/update[.]php hxxps://ipva2024-detransp[.]com/data[.]php hxxps://ganharcomblog[.]com/cdn-vs/original[.]js hxxps://ganharcomblog[.]com/cdn-vs/index[.]php hxxps://ganharcomblog[.]com/cdn-vs/update[.]php |
FAKEUPDATES |
| URL | hxxp://137[.]184[.]191[.]215/index[.]php/check?post=073989953 | LokiBot |
| URL | hxxp://147[.]45[.]44[.]104/prog/66d5df681876c_file010924[.]exe | STOP |
| URL | hxxps://api[.]telegram[.]org/bot7323804265:AAGOrHmilwRNOOZbuVQa6WTtwu__mfCEENE/sendMessage?chat_id=7365454061 | Snake Keylogger |
| URL | hxxp://147[.]45[.]44[.]104/revada/66deebee3b2d7_lyla2[.]exe hxxp://154[.]216[.]17[.]216/joffer2[.]exe |
CryptBot |
| URL | hxxp://185[.]240[.]104[.]133/Update[.]exe | BlankGrabber |
| URL | hxxps://exodushacks[.]xyz/app/Exodus[.]zip | Exodus |
| URL | hxxps://wikiwiki19[.]xyz/NDVjODg4NjBjMGE1/ hxxps://sdnvvskdnjsdkls[.]xyz/NDVjODg4NjBjMGE1/ hxxps://sdnskdnjsdkls[.]xyz/NDVjODg4NjBjMGE1/ hxxps://sdnskdnjsdkls[.]online/NDVjODg4NjBjMGE1/ hxxps://uhgtr9jjdiuriegvjudf[.]top/N2Y5ZmU3OTI5ZDky/ hxxps://ukhfrerl84hnfjdlns[.]online/N2Y5ZmU3OTI5ZDky/ hxxps://menetory4gert[.]xyz/N2Y5ZmU3OTI5ZDky/ hxxps://hdewuhunfrv74f[.]site/N2Y5ZmU3OTI5ZDky/ hxxps://kuurjfds8rjrdiwse[.]online/N2Y5ZmU3OTI5ZDky/ |
Coper |
| URL | hxxp://45[.]91[.]200[.]135/api/firecom[.]php hxxp://45[.]91[.]200[.]135/api/flash[.]php hxxp://45[.]91[.]200[.]135/api/firepro[.]php |
PrivateLoader |
