不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様21社 -
2024/11/26
※2024/11/26 更新
マルウェア感染させると考えられるURLを検知（2024/11/26）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://cd06e[.]asset[.]tradingvein[.]xyz/subscribeEvent hxxps://esaleerugs[.]com/e365r[.]js hxxps://opporeno8[.]com/work/xxx[.]zip hxxps://opporeno8[.]com/work/das[.]php hxxps://opporeno8[.]com/work/original[.]js hxxps://opporeno8[.]com/work/fix2[.]php hxxps://opporeno8[.]com/work/index[.]php hxxps://modandcrackedapk[.]com/work/original[.]js hxxps://modandcrackedapk[.]com/work/fix2[.]php hxxps://modandcrackedapk[.]com/work/xxx[.]zip hxxps://modandcrackedapk[.]com/work/das[.]php hxxps://modandcrackedapk[.]com/work/index[.]php hxxps://reviewtypes[.]com/work/original[.]js hxxps://reviewtypes[.]com/work/index[.]php hxxps://reviewtypes[.]com/work/xxx[.]zip hxxps://reviewtypes[.]com/work/fix2[.]php hxxps://qppwq[.]lessons[.]southsidechurchofchristla[.]org/merchantServices hxxps://cst[.]cases[.]pcohenlaw[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxps://fiorinet[.]dsqueen[.]xyz/phpserver/max_/Undergrundsbevgelses[.]aaf hxxps://b9a1[.]icu/tHxvmwgM/tOJvTHqaRQTykEjUfG184[.]bin hxxp://b2c5[.]icu/pKAMFLKF/ykTSVZvTmaIz161[.]bin hxxp://b2c5[.]icu/gpKgTZUW/Trakyyens[.]xsn hxxps://b9a1[.]icu/hUPMasYG/Nonexpansion[.]java hxxp://mertvinc[.]com[.]tr/oxzGOftLtQcGlWZ214[.]bin hxxp://mertvinc[.]com[.]tr/pqvBgXvmocLIihvW108[.]bin hxxp://146[.]70[.]95[.]248/cc/MPZMjMIAOwpGzu32[.]bin |
CloudEyE |
| URL | hxxp://18[.]181[.]154[.]24/rv/ | BazarBackdoor |
| URL | hxxp://18[.]181[.]154[.]24/9758xBqgE1azKnB[.]exe hxxps://almamas[.]com[.]ly/wblwxiun[.]rtw/pnilrykd[.]jpg |
AsyncRAT |
| URL | hxxp://45[.]141[.]26[.]170/XClient[.]exe | Formbook |
| URL | hxxp://31[.]41[.]244[.]11/files/1724962075/7mpPLxE[.]exe hxxps://foresttrail[.]shop/api hxxps://gentlewave[.]shop/api hxxp://31[.]41[.]244[.]11/files/1724962075/eDPQZkT[.]exe hxxps://cvinetwork[.]org/installer[.]exe |
Lumma Stealer |
| URL | hxxps://dugmv[.]si/xmlrpc[.]php | GootLoader |
| URL | hxxp://222[.]186[.]172[.]42:1000/W1[.]exe hxxp://222[.]186[.]172[.]42:1000/S1[.]exe hxxp://222[.]186[.]172[.]42:1000/SJZ[.]exe hxxp://222[.]186[.]172[.]42:1000/F2[.]exe hxxp://103[.]192[.]179[.]31/win[.]exe |
KrBanker |
| URL | hxxp://166[.]1[.]160[.]162/ambry/anterra[.]msi | MetaStealer |
| URL | hxxp://185[.]147[.]124[.]40/x/8[.]png | XWorm |
| URL | hxxp://104[.]168[.]7[.]19/fonsaaaaaaaaawebmadamm3453226564454[.]txt | Agent Tesla |
| URL | hxxp://185[.]215[.]113[.]206/c4becf79229cb002[.]php hxxp://92[.]255[.]57[.]88/7bbacc20a3bd2eb5[.]php |
Stealc |
| URL | hxxps://api[.]telegram[.]org/bot7578088265:AAHvd5E9MBWeIBV2JVvDWdTRg0KYKBSK8MM/sendMessage?chat_id=7365454061 hxxps://cia[.]tf/2ed7362e959d42385d4e6d231a6840dd[.]exe |
Snake Keylogger |
| URL | hxxp://31[.]41[.]244[.]11/files/6809807338/l0k3fsu[.]exe hxxp://31[.]41[.]244[.]11/files/6809807338/FFfl07u[.]exe hxxp://31[.]41[.]244[.]11/files/6809807338/3jbbEG0[.]exe |
Vidar |
| URL | hxxps://reisdevs[.]com/wp-admin/maint/patm/somes[.]exe | RedLine Stealer |
| URL | hxxps://api[.]telegram[.]org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendMessage?chat_id=6115850689 | DarkCloud |
| URL | hxxp://31[.]41[.]244[.]11/files/151334531/fqVBP7A[.]exe | NetSupportManager RAT |
| URL | hxxps://paste[.]ee/d/7cWsL/0 | Remcos |
| URL | hxxp://120[.]61[.]77[.]13:44073/Mozi[.]m | Mozi |
| URL | hxxp://31[.]41[.]244[.]11/files/7617871662/x4lburt[.]exe | DarkTortilla |
| URL | hxxp://31[.]41[.]244[.]11/files/7407486059/aWVVOSu[.]exe hxxp://31[.]41[.]244[.]11/files/7407486059/1Shasou[.]exe |
Lumar |
| URL | hxxp://103[.]192[.]179[.]31/linux_mipsel_softfloat hxxp://103[.]192[.]179[.]31/linux_mips64el_softfloat hxxp://103[.]192[.]179[.]31/linux_arm6 hxxp://103[.]192[.]179[.]31/linux_ppc64 hxxp://103[.]192[.]179[.]31/linux_mips hxxp://103[.]192[.]179[.]31/linux_mips64el hxxp://103[.]192[.]179[.]31/linux_ppc64el hxxp://103[.]192[.]179[.]31/linux_386 hxxp://103[.]192[.]179[.]31/linux_arm7 hxxp://103[.]192[.]179[.]31/linux_amd64 hxxp://103[.]192[.]179[.]31/linux_mips64_softfloat hxxp://103[.]192[.]179[.]31/linux_arm64 hxxp://103[.]192[.]179[.]31/linux_arm5 hxxp://103[.]192[.]179[.]31/linux_mips_softfloat hxxp://103[.]192[.]179[.]31/linux_mips64 hxxp://103[.]192[.]179[.]31/linux_mipsel hxxp://103[.]192[.]179[.]31/linux_aarch64 hxxp://103[.]192[.]179[.]31/runji[.]sh |
Kaiji |
