不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様5社 -
2024/11/21
※2024/11/21 更新
マルウェア感染させると考えられるURLを検知（2024/11/21）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://c9bebf541c17a229d921556d14a4ffd4[.]com/MWZjODg0YjhhMWVi/ hxxps://64b6c9bebf541c17a229d921556d14a4ffd4[.]com/MWZjODg0YjhhMWVi/ hxxps://74b6c9bebf541c17a229d921556d14a4ffd4[.]com/MWZjODg0YjhhMWVi/ |
Coper |
| URL | hxxps://kuotc[.]staff[.]plenarykcg[.]com/merchantServices hxxps://nyciot[.]com/js[.]php hxxps://nyciot[.]com/je5vl[.]js hxxps://segurofinalizar[.]shop/work/fix2[.]php hxxps://segurofinalizar[.]shop/work/xxx[.]zip hxxps://segurofinalizar[.]shop/work/index[.]php hxxps://segurofinalizar[.]shop/work/original[.]js hxxps://jaipurraj[.]com/work/original[.]js hxxps://jaipurraj[.]com/work/das[.]php hxxps://jaipurraj[.]com/work/fix[.]php hxxps://ywp[.]guide[.]borden-carleton[.]ca/orderReview |
FAKEUPDATES |
| URL | hxxp://94[.]156[.]177[.]41/simple/five/fre[.]php hxxp://192[.]3[.]243[.]136/55/caspol[.]exe hxxp://192[.]3[.]243[.]136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[.]hta hxxp://66[.]63[.]187[.]231/33/caspol[.]exe hxxp://66[.]63[.]187[.]231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor[.]hta hxxp://94[.]156[.]177[.]41/simple/five/PvqDq929BSx_A_D_M1n_a[.]php hxxp://www[.]grupodulcemar[.]pe/FACTURA09876567000[.]bat hxxp://66[.]63[.]187[.]231/xampp/wer/we/seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seethebestthignsalwaysgivnebestthigns[.]doc |
LokiBot |
| URL | hxxps://paste[.]ee/d/R0pct/0 hxxps://garhoudjourm[.]com/Part1[.]png hxxps://garhoudjourm[.]com/Part[.]png hxxps://paste[.]ee/d/lxvbq hxxps://garhoudjourm[.]com/Part4[.]png hxxps://garhoudjourm[.]com/Part3[.]png hxxps://garhoudjourm[.]com/Part2[.]png hxxp://190[.]9[.]223[.]135/sostener2[.]vbs hxxp://192[.]3[.]220[.]29/45/ww/seethebestthignswhichgivingbestopportunities[.]hta hxxp://66[.]63[.]187[.]150/file/build4[.]exe hxxp://186[.]169[.]34[.]190/31agosto[.]vbs |
Remcos |
| URL | hxxp://192[.]3[.]22[.]13/352/seethebestthingswithgreatsituationshandletotheprogress[.]hta hxxp://192[.]3[.]22[.]13/xampp/se/seethebestthingsentiretimewithgreatthingswithloverkiss[.]tIF |
Agent Tesla |
| URL | hxxps://bestmarsgood[.]com/test/ hxxps://cerwintifed[.]com/test/ |
Latrodectus |
| URL | hxxp://179[.]60[.]149[.]194:8080/vxhxrqnb hxxp://91[.]243[.]50[.]68:8080/rdullfph hxxp://91[.]243[.]50[.]68:8080/eqvukhda hxxps://api[.]ewfiles[.]net/api/files/Wft6eSFut |
DarkGate |
| URL | hxxp://ferreiragascuritiba[.]com[.]br/v/233_Faogvkghvqn hxxps://ferreiragascuritiba[.]com[.]br/v/233_Faogvkghvqn |
DBatLoader |
| URL | hxxp://101[.]133[.]156[.]69:7001/fwlink | Cobalt Strike |
| URL | hxxp://62[.]60[.]153[.]28/Ropsjsn_Belphegor_obf[.]exe hxxps://paste[.]ee/d/PNSBt hxxp://186[.]169[.]34[.]190/sostedcr[.]vbs |
AsyncRAT |
| URL | hxxp://31[.]177[.]109[.]184/1d85fd701b9057d3/mozglue[.]dll hxxp://31[.]177[.]109[.]184/1d85fd701b9057d3/nss3[.]dll hxxp://31[.]177[.]109[.]184/1d85fd701b9057d3/vcruntime140[.]dll hxxp://31[.]177[.]109[.]184/1d85fd701b9057d3/softokn3[.]dll hxxp://31[.]177[.]109[.]184/1d85fd701b9057d3/msvcp140[.]dll hxxp://31[.]177[.]109[.]184/1d85fd701b9057d3/sqlite3[.]dll hxxp://31[.]177[.]109[.]184/1d85fd701b9057d3/freebl3[.]dll hxxp://31[.]41[.]244[.]11/files/stealc_main1[.]exe hxxp://31[.]177[.]109[.]184/8331a12a495c21b2[.]php |
Stealc |
| URL | hxxps://potok[.]fund/maomao[.]exe hxxps://potok[.]casa/maomao[.]exe |
Vidar |
| URL | hxxp://107[.]173[.]4[.]61/31/winnit[.]exe hxxp://107[.]173[.]4[.]61/xampp/mt/generatethebstgoodpeoplesaroundtheworldwithgood[.]hta hxxps://shalouxt[.]top/Undershooting[.]hhk hxxps://shalouxt[.]top/ulABmEdjFLhPwz78[.]bin |
Formbook |
| URL | hxxps://freeagirl[.]de/wp-admin/includes/max/Edderkoppen[.]chm | CloudEyE |
| URL | hxxps://api[.]ewfiles[.]net/api/files/X8KuhJGO6 hxxps://api[.]ewfiles[.]net/api/files/7M7GSdepl hxxps://pastebin[.]com/raw/KEFttAEb |
PureCrypter |
| URL | hxxp://150[.]241[.]91[.]218/GuidanceConnectors[.]exe | SmokeLoader |
| URL | hxxp://cheat[.]underground-cheat[.]com/plugin3[.]dll hxxp://81[.]161[.]238[.]38/plugin3[.]dll hxxp://81[.]161[.]238[.]38/Winsvc[.]exe hxxp://cheat[.]underground-cheat[.]com/Winsvc[.]exe |
Coinminer |
| URL | hxxp://38[.]180[.]147[.]18/palofd | Specter |
| URL | hxxps://aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Tuyen/Tuyen[.]b64 hxxps://www[.]aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Adonis/Adonis[.]b64 hxxp://aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Tuyen/Tuyen[.]b64 hxxps://aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Adonis/Adonis[.]b64 hxxp://www[.]aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Tuyen/Tuyen[.]b64 hxxps://www[.]aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Tuyen/Tuyen[.]b64 hxxp://aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Adonis/Adonis[.]b64 hxxp://www[.]aviationchartersolutions[.]com/insurify-html-v1[.]1/documentation/assets/img/glyphicons/Server_VIP/Adonis/Adonis[.]b64 |
donut_injector |
