不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様4社 -
2024/11/18
※2024/11/18 更新
マルウェア感染させると考えられるURLを検知（2024/11/18）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]125[.]66[.]24/nabsh4 hxxp://45[.]125[.]66[.]24/zersh4 hxxp://43[.]133[.]65[.]79/empsl hxxp://43[.]133[.]65[.]79/emips hxxp://43[.]133[.]65[.]79/backdoor/emips hxxp://43[.]133[.]65[.]79/backdoor/empsl |
Bashlite |
| URL | hxxp://176[.]113[.]115[.]203/thebig/stories[.]exe | Socks5 Systemz |
| URL | hxxps://ngt-techs[.]com/work/fix[.]php hxxps://ngt-techs[.]com/work/original[.]js hxxps://ngt-techs[.]com/work/index[.]php hxxps://tqne[.]events[.]socalpocis[.]org/merchantServices hxxps://f47d5[.]language[.]sebtomato[.]com/viewProfile hxxps://crickout[.]com/work/original[.]js hxxps://crickout[.]com/work/index[.]php hxxps://crickout[.]com/work/fix[.]php hxxps://rshank[.]com/metrics[.]js hxxps://vicrin[.]com/metrics[.]js hxxps://b6a1e[.]language[.]sebtomato[.]com/viewProfile hxxps://26f0b[.]language[.]sebtomato[.]com/viewProfile hxxps://ygtvv[.]events[.]socalpocis[.]org/merchantServices hxxps://cms[.]events[.]socalpocis[.]org/merchantServices hxxps://8cdf8[.]language[.]sebtomato[.]com/viewProfile hxxps://mbw[.]events[.]socalpocis[.]org/merchantServices |
FAKEUPDATES |
| URL | hxxps://dl[.]dropboxusercontent[.]com/scl/fi/ig05j620cx7w0yshskdqk/2NOTIFICACI-N-ELECTR-NCIA-JUDICIAL-ESM-AGRADECEMOS-CONFIRMAR-RECIBIDO-15[.]tar[.]uue[.]tar[.]001?rlkey=1ornxe06529961j3gqyfcgfyk&st=gnkl8xiw&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/ulzkomtc2b3byukh0i31u/NOTIFICACI-N-ELECTR-NICA-RAMA-JUDICIAL-DE-PODER-P-BLICO-AGRADECEMOS-CONFIRMAR-RECIBIDO[.]tar[.]uue[.]tar[.]001?rlkey=6cke6338ze78lomgilwp94y2e&st=p84dq964&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/5bwo9mq29wnl5r2a4k3wy/1ARCHIVO-Nro-18-NOTIFICACI-N-ELECTR-NCIA-JUDICIAL-ESM-AGRADECEMOS-CONFIRMAR-RECIBIDO-15[.]tar[.]uue[.]tar[.]001?rlkey=ieu4fms412fp1o338yg57hz3r&st=ivpan68v&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/8nh6qq43s1qzgsjlhwq7f/ARCHIVO-Nro-18-NOTIFICACI-N-ELECTR-NCIA-JUDICIAL-ESM-AGRADECEMOS-CONFIRMAR-RECIBIDO-15[.]tar[.]uue[.]tar[.]001?rlkey=d7rytyfpyngxf5lw63u4b3ysh&st=bbolzkoo&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/dczxh5ejh61dxxjo0wzox/4NOTIFICACI-N-ELECTR-NCIA-JUDICIAL-ESM-AGRADECEMOS-CONFIRMAR-RECIBIDO-15[.]tar[.]uue[.]tar[.]001?rlkey=5ph1a4hphb7yz4teyaawc0vxl&st=hmgpb1j2&dl=0 hxxp://191[.]96[.]207[.]229/Kodreng225[.]cmd hxxp://191[.]96[.]207[.]229/Jagtfalkenes[.]vbs hxxp://191[.]96[.]207[.]229/Tomhjernet[.]wsf |
AsyncRAT |
| URL | hxxps://files[.]offshore[.]cat/api/file/1f2f8dcd-4562-4d52-94e1-b5460d55c3ec/download | Remcos |
| URL | hxxps://dudtybresah[.]cyou/api hxxps://njprfirm[.]com/burgi[.]zip hxxps://goldenstream[.]shop/api hxxps://pub[.]foodie-safari[.]shop/naailq1 hxxps://download[.]cdn-serveri6731-ns[.]shop/Downloads/cdn1/Instruction_18112[.]pdf[.]lnk hxxp://31[.]41[.]244[.]11/files/nicko[.]exe hxxps://processhol[.]sbs/api hxxps://peepburry828[.]sbs/api hxxps://p3ar11fter[.]sbs/api hxxps://p10tgrace[.]sbs/api hxxps://3xp3cts1aim[.]sbs/api hxxps://c0al1t1onmatch[.]cyou/api hxxps://acrith0t[.]cyou/api |
Lumma Stealer |
| URL | hxxp://paytest[.]infinitegalaxy[.]cn:9880/AV[.]scr hxxp://paytest[.]infinitegalaxy[.]cn:9880/Photo[.]scr hxxp://paytest[.]infinitegalaxy[.]cn:9880/Video[.]scr |
Coinminer |
| URL | hxxp://47[.]120[.]46[.]210:81/02[.]08[.]2022[.]exe hxxp://47[.]120[.]47[.]63:58008/MiDc |
Cobalt Strike |
| URL | hxxp://104[.]168[.]32[.]140/jUPSCuLd221[.]bin hxxp://93[.]123[.]109[.]168/penAhbiRpprGoKtV203[.]bin hxxp://mertvinc[.]com[.]tr/LAbxmTzNBCWjnKNdG58[.]bin hxxp://93[.]123[.]109[.]168/EgJusGc103[.]bin |
CloudEyE |
| URL | hxxps://altraonline[.]com/SKOblik[.]exe hxxp://31[.]41[.]244[.]11/files/SKOblik[.]exe |
DanaBot |
| URL | hxxp://192[.]3[.]243[.]136/33/seemybestthingswhichcallyoubabygirlwhichgiveuhotchicks[.]tIF hxxp://192[.]3[.]243[.]136/32/seemybestthingswithentirelifetimethingstodomybest[.]tIF hxxp://192[.]3[.]243[.]136/33/nu/bestgirlfriendwhowintheheartwithentirelifegivenubestthigns[.]hta hxxp://192[.]3[.]243[.]136/32/nc/kissmegoodthingwhichgivemebestthignswithgirluaremy[.]hta |
LokiBot |
| URL | hxxps://api[.]telegram[.]org/bot7774773345:AAG6Pdf74XrhiB9eM8YXfCsSAzVQHpI9KRs/sendMessage?chat_id=780684111 | DarkCloud |
| URL | hxxp://mhlc[.]shop/GI341/index[.]php | Azorult |
| URL | hxxp://31[.]41[.]244[.]11/files/123[.]exe | NetSupportManager RAT |
| URL | hxxps://api[.]telegram[.]org/bot7807072238:AAGtzAOTofEY8lBHcrZusyYa_emOxp-S_-s/sendMessage?chat_id=7361435574 | Snake Keylogger |
| URL | hxxp://117[.]217[.]131[.]27:57149/Mozi[.]m hxxp://182[.]123[.]250[.]169:34841/Mozi[.]m |
Mozi |
| URL | hxxps://176[.]111[.]174[.]140/osupdater[.]exe hxxp://176[.]111[.]174[.]140/osupdater[.]exe |
RedLine Stealer |
| URL | hxxp://95[.]163[.]152[.]69:9439/chelentano[.]exe | Meduza Stealer |
| URL | hxxp://79[.]23[.]237[.]23/necr0[.]py | Tsunami |
| URL | hxxp://79[.]137[.]203[.]19/7hgd5fx4/index[.]php | Amadey |
