不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様10社 -
2024/11/19
※2024/11/19 更新
マルウェア感染させると考えられるURLを検知（2024/11/19）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://34b6413903074567453981d0595033c23[.]com/YmZiMzU0OTU5NGIz/ | Coper |
| URL | hxxp://106[.]53[.]181[.]113:443/SSSd hxxp://106[.]53[.]181[.]113/12[.]exe |
Cobalt Strike |
| URL | hxxp://fbiopenup[.]top/imagepollhttpprocessgameSqlwptemptemporary[.]php | DCRat |
| URL | hxxps://api[.]telegram[.]org/bot7854764352:AAGsvrx8n7ByYi4c9ksbK9NcQWi81dzmeE8/sendMessage?chat_id=7894030394 hxxps://api[.]telegram[.]org/bot7720120586:AAEL1VybRIeGFqc29yI4D0-l0jQ_HF7ry5s/sendMessage?chat_id=6419839739 hxxps://api[.]telegram[.]org/bot8071929169:AAFUKNAcxQ6ezyCHGQASc7PxQv_smeADnUQ/sendMessage?chat_id=5985897351 |
Snake Keylogger |
| URL | hxxps://dl[.]dropboxusercontent[.]com/scl/fi/eky5rp2utq8tof1094oi2/Oficio-391-NOTIFICACI-N-ELECTR-NICA-CENDO-RAMA-RADICADO-153153135-000-6562[.]tar[.]uue[.]tar[.]001?rlkey=dil8h7h6ffwlvt15lrrnurg70&st=z29gqnxh&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/259mxho3dnhaw3wxodo4d/3NOTIFICACI-N-ELECTR-NICA-JUDICIAL-AUTO-ADMISORIO-DEMANDA-LABORAL[.]tar[.]uue[.]tar[.]001?rlkey=565r566vsgouhelnngcvb9gm0&st=pavbqg0o&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/s0y5qg6l0vkd7m23drmqg/2NOTIFICACI-N-ELECTR-NICA-JUDICIAL-AUTO-ADMISORIO-DEMANDA-LABORAL[.]tar[.]uue[.]tar[.]001?rlkey=tgkpr9bxgtbqhcfril01rtq4o&st=0wmyh1qy&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/1b3qdpnqx1ho46tgb7h7u/2OFICIO-Nro-192-NOTIFICACI-N-JUDICIAL-AUTO-ADMISORIO-DEMANDA-LABORAL-ESM[.]tar[.]uue[.]tar[.]001?rlkey=kv7tv4v03hjp1cwycaiagq3fh&st=lmaolu0a&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/qdceo4hlwma3qipt1zb0x/4OFICIO-Nro-192-NOTIFICACI-N-JUDICIAL-AUTO-ADMISORIO-DEMANDA-LABORAL-ESM[.]tar[.]uue[.]tar[.]001?rlkey=cyher2xyvds8baps52pr0i52q&st=az6vnzwy&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/e7vtebfe2qdfbjt87nvhu/OFICIO-DE-NOTIFICACI-N-EJECTR-NICA-CENDO-RAMA-JUDICIAL-DE-LA-REP-BLICA-DE-COLOMBIA[.]tar[.]cab[.]tar[.]001?rlkey=54p6fzmx3c1eovd1btwzy0re4&st=npm5oi4l&dl=0 hxxps://dl[.]dropboxusercontent[.]com/scl/fi/4qoef01jqan8sczprj79o/1OFICIO-DE-NOTIFICACI-N-EJECTR-NICA-CENDO-RAMA-JUDICIAL-DE-LA-REP-BLICA-DE-COLOMBIA[.]tar[.]cab[.]tar[.]001?rlkey=8px38d88qrq4ssw54132v5ke2&st=gg5nhz4s&dl=0 |
AsyncRAT |
| URL | hxxps://api[.]telegram[.]org/bot8136579075:AAGj0tA4jaUAY9OKp-x5cJn4qOrj2emlQuE/sendMessage?chat_id=7309975149 | DarkCloud |
| URL | hxxps://api[.]telegram[.]org/bot7180778750:AAGcpZL53RI1C6DEr2Yp4lM3UKxKArXTZ4I/ hxxps://end-vt[.]com/megafund/gambinho[.]exe |
Agent Tesla |
| URL | hxxps://additioniqqwu[.]shop/api hxxps://localwanderer[.]shop/api hxxps://lunarminds[.]shop/api hxxps://moonlight-glow[.]shop/api hxxps://naturevibes[.]shop/api hxxps://thrusstedmdwqni[.]shop/api hxxp://31[.]41[.]244[.]11/files/LummaC21[.]exe |
Lumma Stealer |
| URL | hxxps://eliztalks[.]com/wp-config[.]js hxxps://petshopsg[.]com/work/fix2[.]php hxxps://petshopsg[.]com/work/xxx[.]zip hxxps://petshopsg[.]com/work/original[.]js hxxps://petshopsg[.]com/work/index[.]php hxxps://youxj[.]staff[.]plenarykcg[.]com/merchantServices hxxps://tuw[.]events[.]socalpocis[.]org/gotoCheckout hxxps://ndur[.]events[.]socalpocis[.]org/merchantServices |
FAKEUPDATES |
| URL | hxxp://rigzuvzi3bnz3[.]top/1[.]php?s=mints13 | MintStealer |
| URL | hxxp://94[.]159[.]113[.]79:8888/94082236017531[.]dll | StrelaStealer |
| URL | hxxp://107[.]172[.]44[.]178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[.]hta hxxp://107[.]172[.]44[.]178/53/seemybestnetworkwhichgivebestthingsentirelifewithme[.]tIF |
SmokeLoader |
| URL | hxxps://heavyequipmentsales[.]au/admin/bmFpLgqmXzovv105[.]bin hxxps://heavyequipmentsales[.]au/admin/Verdensalt[.]asi |
Formbook |
| URL | hxxp://192[.]3[.]243[.]136/36/caspol[.]exe hxxp://192[.]3[.]243[.]136/37/caspol[.]exe hxxp://192[.]3[.]243[.]136/xampp/rf/seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe[.]hta hxxp://192[.]3[.]243[.]136/xampp/de/givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew[.]hta hxxp://66[.]63[.]187[.]231/657/caspol[.]exe hxxp://66[.]63[.]187[.]231/xampp/noc/seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor[.]hta hxxp://94[.]156[.]177[.]95/maxzi/five/fre[.]php |
LokiBot |
| URL | hxxp://185[.]222[.]57[.]90/zFSrvbrRquo53[.]bin | CloudEyE |
| URL | hxxps://inayatullah[.]com/work/xxx[.]zip | NetSupportManager RAT |
