不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様8社 -
2024/11/20
※2024/11/20 更新
マルウェア感染させると考えられるURLを検知（2024/11/20）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://31[.]41[.]244[.]11/files/rodda[.]exe hxxps://appr0dress[.]cyou/api |
Lumma Stealer |
| URL | hxxps://genhil[.]com/3561[.]js hxxps://inayatullah[.]com/work/index[.]php hxxps://inayatullah[.]com/work/fix2[.]php hxxps://inayatullah[.]com/work/original[.]js hxxps://eegqzvxd[.]shop/work/index[.]php hxxps://eegqzvxd[.]shop/work/xxx[.]zip hxxps://eegqzvxd[.]shop/work/fix2[.]php hxxps://eegqzvxd[.]shop/work/original[.]js hxxps://safigdata[.]com/wp[.]js hxxps://viralnavigator[.]com/work/original[.]js hxxps://viralnavigator[.]com/work/index[.]php hxxps://viralnavigator[.]com/work/fix2[.]php hxxps://viralnavigator[.]com/work/xxx[.]zip hxxps://efr[.]strategies[.]mvpstrat[.]com/gotoCheckout hxxps://tickerwell[.]com/web[.]js hxxps://tickerwell[.]com/js[.]php hxxp://faybzuy3byz2v[.]top/1[.]php |
FAKEUPDATES |
| URL | hxxp://222[.]186[.]172[.]42:1000/C1[.]exe hxxp://222[.]186[.]172[.]42:1000/PQ1[.]exe hxxp://222[.]186[.]172[.]42:1000/CB1[.]exe hxxp://222[.]186[.]172[.]42:1000/PQ[.]exe hxxp://222[.]186[.]172[.]42:1000/PQ2[.]exe hxxp://222[.]186[.]172[.]42:1000/CB2[.]exe hxxp://222[.]186[.]172[.]42:1000/CB[.]exe |
KrBanker |
| URL | hxxp://94[.]156[.]177[.]41/maxzi/five/fre[.]php hxxp://87[.]120[.]84[.]39/txt/Xkl0PnD8zFPjfh1[.]wiz hxxp://94[.]156[.]177[.]41/maxzi/five/PvqDq929BSx_A_D_M1n_a[.]php hxxp://87[.]120[.]113[.]235/18/pin[.]php |
LokiBot |
| URL | hxxp://194[.]90[.]142[.]157/exe/exe009[.]exe | Emotet |
| URL | hxxp://194[.]90[.]142[.]157/ps1/ps1004[.]ps1 hxxp://38[.]207[.]132[.]208:8000/test[.]exe hxxp://38[.]207[.]132[.]208:8000/beacon_x64[.]exe |
Cobalt Strike |
| URL | hxxps://inspirecollege[.]co[.]uk/trashss/Jpmfwq[.]wav hxxps://inspirecollege[.]co[.]uk/trashss/Fwympkg[.]wav hxxp://inspirecollege[.]co[.]uk/trashss/Kslmdnldhtq[.]dat hxxp://inspirecollege[.]co[.]uk/trashss/Pgyehm[.]dat hxxp://inspirecollege[.]co[.]uk/trashss/Ujegysfu[.]dat hxxps://bhcc[.]com[.]sa/build[.]exe |
Remcos |
| URL | hxxp://109[.]120[.]139[.]195:9439/blecher[.]exe | Meduza Stealer |
| URL | hxxp://31[.]41[.]244[.]11/files/mixeleven[.]exe | GCleaner |
| URL | hxxp://194[.]90[.]142[.]157/ps1/ps1010[.]ps1 | Metasploit |
| URL | hxxp://38[.]180[.]228[.]120/cpu/Default4/externalrequestlinuxPoll/Track2image/BetterTest_linux/TrafficLocallowlongpoll/AsyncProvider/Uploads/providerpipepythonserverAsyncGeneratortrackdatalifeDlecdn[.]php | DCRat |
| URL | hxxp://194[.]90[.]142[.]157/dll/dll009[.]dll | PureLogs Stealer |
| URL | hxxp://115[.]48[.]10[.]59:38294/Mozi[.]m | Mozi |
| URL | hxxp://2[.]58[.]56[.]243/vmapi[.]pdf | DarkGate |
| URL | hxxp://newlinkwotolove[.]club/love/three[.]php | Kutaki |
