不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様3社 -
2024/11/27
※2024/11/27 更新
マルウェア感染させると考えられるURLを検知(2024/11/27)
■IoC(※1)
Type: | IOC: | Signature: |
---|---|---|
URL | hxxps://kekzg[.]living[.]miraclesofeucharisticjesus[.]org/orderReview hxxps://073c8[.]language[.]sebtomato[.]com/viewProfile hxxps://22df8[.]language[.]sebtomato[.]com/viewProfile hxxps://nastictac[.]com/365h[.]js hxxps://00760[.]fate[.]truelance[.]com/subscribeEvent hxxps://www[.]syofi[.]com/work/original[.]js hxxps://www[.]syofi[.]com/work/das[.]php hxxps://www[.]syofi[.]com/work/xxx[.]zip hxxps://blaekindustry[.]com/work/original[.]js hxxps://blaekindustry[.]com/work/index[.]php hxxps://blaekindustry[.]com/work/fix2[.]php hxxps://blaekindustry[.]com/work/xxx[.]zip hxxps://4bb30[.]fate[.]truelance[.]com/subscribeEvent hxxps://www[.]syofi[.]com/work/fix2[.]php hxxps://www[.]syofi[.]com/work/index[.]php hxxps://obef[.]lessons[.]southsidechurchofchristla[.]org/merchantServices hxxps://ehkhl[.]lessons[.]southsidechurchofchristla[.]org/merchantServices hxxps://yaez[.]lessons[.]southsidechurchofchristla[.]org/merchantServices hxxps://yew[.]lessons[.]southsidechurchofchristla[.]org/merchantServices |
FAKEUPDATES |
URL | hxxps://qsif-9432751-neurallink-bwlprtyx-099[.]computador-hardware[.]net/simples/rosa[.]png hxxp://192[.]124[.]216[.]14/vd/sis/sistema[.]zip hxxp://192[.]124[.]216[.]14/vd/sis/sistema[.]ps1 hxxp://192[.]124[.]216[.]14/vd/sis/DownSistem[.]ps1 |
Ousaban |
URL | hxxps://peacefulmind[.]shop/api hxxp://31[.]41[.]244[.]11/files/6639161109/vg9qcBa[.]exe hxxp://31[.]41[.]244[.]11/files/6543706611/DPQSEDd[.]exe hxxps://occupy-blushi[.]sbs/api hxxps://blade-govern[.]sbs/api hxxps://story-tense-faz[.]sbs/api hxxps://disobey-curly[.]sbs/api hxxps://motion-treesz[.]sbs/api hxxps://powerful-avoids[.]sbs/api |
Lumma Stealer |
URL | hxxp://92[.]255[.]57[.]88/7550b1c08332241a/nss3[.]dll hxxp://92[.]255[.]57[.]88/7550b1c08332241a/vcruntime140[.]dll hxxp://92[.]255[.]57[.]88/7550b1c08332241a/mozglue[.]dll hxxp://92[.]255[.]57[.]88/7550b1c08332241a/msvcp140[.]dll hxxp://92[.]255[.]57[.]88/7550b1c08332241a/softokn3[.]dll hxxp://92[.]255[.]57[.]88/7550b1c08332241a/freebl3[.]dll hxxp://92[.]255[.]57[.]88/7550b1c08332241a/sqlite3[.]dll |
Stealc |
URL | hxxps://www[.]sodiumlaurethsulfatedesyroyer[.]com/tdtyhrxf/dfhsrarytrsagerfwearfwerfwerthdyttyfuiuoifjcghhbg/srtserytdjufyuudftdrgtestytdtedrtgserwegtraegryetraweg/nezfdio[.]exe | LokiBot |
URL | hxxp://146[.]70[.]155[.]254/1150/createabetterbuttersmoothsmoothykingstogetmesweeetness[.]tIF hxxp://146[.]70[.]155[.]254/1150/cr/creamymilkburnwtithsweetheartshegivenmebestterthingswhichnewandshineforme[.]hta hxxps://store10[.]gofile[.]io/download/direct/761a1107-d452-487d-ace1-7365d988ed6a/xl[.]exe hxxp://23[.]95[.]128[.]215/226/VRCCCTR[.]txt hxxp://23[.]95[.]128[.]215/226/seethepossiblethingsforentiretimetogivemebest[.]tIF |
Formbook |
URL | hxxp://198[.]46[.]178[.]192/122/wc/thinkingbestthingswhichcomingetniretimegivenmegood[.]hta hxxp://198[.]46[.]178[.]192/122/wecreatedbetterthingsgoodwayentirelifegreattogobetterthings[.]tIF hxxp://104[.]168[.]46[.]26/1422/wh/sweetbabygivenbestthignsetnirelifegivenbackbestthignsalways[.]hta hxxp://104[.]168[.]46[.]26/1422/bestofthingswithentiretimegivenebstthignstodowithgreat[.]tIF |
Remcos |
URL | hxxps://api[.]telegram[.]org/bot8105461233:AAGikrL-FY3clQOY-lg3KOIDOXSLgX28_TU/sendMessage?chat_id=6147266367 | Snake Keylogger |
URL | hxxp://sbv[.]pushswroller[.]eu/gfy/gesr[.]txt hxxp://bill[.]drillmmcsnk[.]top/hdf/vic[.]txt |
RedLine Stealer |
URL | hxxp://31[.]41[.]244[.]11/files/151334531/JIAfos7[.]exe | NetSupportManager RAT |
URL | hxxp://20[.]83[.]148[.]22:8080/test12[.]exe hxxp://20[.]83[.]148[.]22:8080/test6[.]exe hxxp://20[.]83[.]148[.]22:8080/test14[.]exe hxxp://20[.]83[.]148[.]22:8080/pantest[.]exe hxxp://20[.]83[.]148[.]22:8080/test9[.]exe hxxp://20[.]83[.]148[.]22:8080/test10-29[.]exe hxxp://20[.]83[.]148[.]22:8080/test19[.]exe hxxp://20[.]83[.]148[.]22:8080/test10[.]exe hxxp://20[.]83[.]148[.]22:8080/test_again4[.]exe hxxp://20[.]83[.]148[.]22:8080/test23[.]exe hxxp://20[.]83[.]148[.]22:8080/test5[.]exe hxxp://20[.]83[.]148[.]22:8080/test11[.]exe hxxp://20[.]83[.]148[.]22:8080/test20[.]exe hxxp://20[.]83[.]148[.]22:8080/test_again3[.]exe hxxp://20[.]83[.]148[.]22:8080/test16[.]exe hxxp://20[.]83[.]148[.]22:8080/test13[.]exe hxxp://20[.]83[.]148[.]22:8080/test_again2[.]exe hxxp://20[.]83[.]148[.]22:8080/test15[.]exe hxxp://20[.]83[.]148[.]22:8080/test18[.]exe hxxp://20[.]83[.]148[.]22:8080/test21[.]exe hxxp://20[.]83[.]148[.]22:8080/test22[.]exe hxxp://20[.]83[.]148[.]22:8080/test8[.]exe hxxp://20[.]83[.]148[.]22:8080/test7[.]exe hxxp://20[.]83[.]148[.]22:8080/test-again[.]exe hxxp://20[.]83[.]148[.]22:8080/test17[.]exe |
Cobalt Strike |
URL | hxxp://31[.]41[.]244[.]11/files/7462340654/VBVEd6f[.]exe | Vidar |
URL | hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Stealer[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Recovery[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HRDP[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Microphone[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/WSound[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/FileManager[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Ngrok-Installer[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/FilesSearcher[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/VoiceChat[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Performance[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Programs[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HVNC[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Regedit[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ActiveWindows[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HiddenApps[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Keylogger[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/RemoteDesktop[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/StartupManager[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/WebCam[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HBrowser[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/TCPConnections[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Chat[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Maps[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/UACBypass[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ReverseProxy[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ProcessManager[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Shell[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/RunPE[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Cmstp-Bypass[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HVNCMemory[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Clipboard[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Options[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Chromium[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/MessageBox[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Informations[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Ransomware[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Pastime[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ServiceManager[.]dll hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Xworm%20V5[.]6[.]exe hxxp://68[.]178[.]207[.]33:8000/XClient[.]exe |
XWorm |
URL | hxxp://sageskills-uk[.]com:1224/pdown hxxp://86[.]104[.]74[.]51:1224/pdown |
StrelaStealer |
URL | hxxp://31[.]41[.]244[.]11/files/7187702529/UqhRb9F[.]exe | XenoRAT |
URL | hxxp://31[.]41[.]244[.]11/files/7407486059/Tq4a1Bz[.]exe | Lumar |