サイバーリスク情報提供 Dアラート 特許取得済み

不正URLへのアクセス、不正メールの受信

メール受信した
弊社お客様
0 URLアクセスした
弊社お客様
3
2024/11/27
※2024/11/27 更新
マルウェア感染させると考えられるURLを検知(2024/11/27)
■IoC(※1)
Type: IOC: Signature:
URL hxxps://kekzg[.]living[.]miraclesofeucharisticjesus[.]org/orderReview
hxxps://073c8[.]language[.]sebtomato[.]com/viewProfile
hxxps://22df8[.]language[.]sebtomato[.]com/viewProfile
hxxps://nastictac[.]com/365h[.]js
hxxps://00760[.]fate[.]truelance[.]com/subscribeEvent
hxxps://www[.]syofi[.]com/work/original[.]js
hxxps://www[.]syofi[.]com/work/das[.]php
hxxps://www[.]syofi[.]com/work/xxx[.]zip
hxxps://blaekindustry[.]com/work/original[.]js
hxxps://blaekindustry[.]com/work/index[.]php
hxxps://blaekindustry[.]com/work/fix2[.]php
hxxps://blaekindustry[.]com/work/xxx[.]zip
hxxps://4bb30[.]fate[.]truelance[.]com/subscribeEvent
hxxps://www[.]syofi[.]com/work/fix2[.]php
hxxps://www[.]syofi[.]com/work/index[.]php
hxxps://obef[.]lessons[.]southsidechurchofchristla[.]org/merchantServices
hxxps://ehkhl[.]lessons[.]southsidechurchofchristla[.]org/merchantServices
hxxps://yaez[.]lessons[.]southsidechurchofchristla[.]org/merchantServices
hxxps://yew[.]lessons[.]southsidechurchofchristla[.]org/merchantServices
FAKEUPDATES
URL hxxps://qsif-9432751-neurallink-bwlprtyx-099[.]computador-hardware[.]net/simples/rosa[.]png
hxxp://192[.]124[.]216[.]14/vd/sis/sistema[.]zip
hxxp://192[.]124[.]216[.]14/vd/sis/sistema[.]ps1
hxxp://192[.]124[.]216[.]14/vd/sis/DownSistem[.]ps1
Ousaban
URL hxxps://peacefulmind[.]shop/api
hxxp://31[.]41[.]244[.]11/files/6639161109/vg9qcBa[.]exe
hxxp://31[.]41[.]244[.]11/files/6543706611/DPQSEDd[.]exe
hxxps://occupy-blushi[.]sbs/api
hxxps://blade-govern[.]sbs/api
hxxps://story-tense-faz[.]sbs/api
hxxps://disobey-curly[.]sbs/api
hxxps://motion-treesz[.]sbs/api
hxxps://powerful-avoids[.]sbs/api
Lumma Stealer
URL hxxp://92[.]255[.]57[.]88/7550b1c08332241a/nss3[.]dll
hxxp://92[.]255[.]57[.]88/7550b1c08332241a/vcruntime140[.]dll
hxxp://92[.]255[.]57[.]88/7550b1c08332241a/mozglue[.]dll
hxxp://92[.]255[.]57[.]88/7550b1c08332241a/msvcp140[.]dll
hxxp://92[.]255[.]57[.]88/7550b1c08332241a/softokn3[.]dll
hxxp://92[.]255[.]57[.]88/7550b1c08332241a/freebl3[.]dll
hxxp://92[.]255[.]57[.]88/7550b1c08332241a/sqlite3[.]dll
Stealc
URL hxxps://www[.]sodiumlaurethsulfatedesyroyer[.]com/tdtyhrxf/dfhsrarytrsagerfwearfwerfwerthdyttyfuiuoifjcghhbg/srtserytdjufyuudftdrgtestytdtedrtgserwegtraegryetraweg/nezfdio[.]exe LokiBot
URL hxxp://146[.]70[.]155[.]254/1150/createabetterbuttersmoothsmoothykingstogetmesweeetness[.]tIF
hxxp://146[.]70[.]155[.]254/1150/cr/creamymilkburnwtithsweetheartshegivenmebestterthingswhichnewandshineforme[.]hta
hxxps://store10[.]gofile[.]io/download/direct/761a1107-d452-487d-ace1-7365d988ed6a/xl[.]exe
hxxp://23[.]95[.]128[.]215/226/VRCCCTR[.]txt
hxxp://23[.]95[.]128[.]215/226/seethepossiblethingsforentiretimetogivemebest[.]tIF
Formbook
URL hxxp://198[.]46[.]178[.]192/122/wc/thinkingbestthingswhichcomingetniretimegivenmegood[.]hta
hxxp://198[.]46[.]178[.]192/122/wecreatedbetterthingsgoodwayentirelifegreattogobetterthings[.]tIF
hxxp://104[.]168[.]46[.]26/1422/wh/sweetbabygivenbestthignsetnirelifegivenbackbestthignsalways[.]hta
hxxp://104[.]168[.]46[.]26/1422/bestofthingswithentiretimegivenebstthignstodowithgreat[.]tIF
Remcos
URL hxxps://api[.]telegram[.]org/bot8105461233:AAGikrL-FY3clQOY-lg3KOIDOXSLgX28_TU/sendMessage?chat_id=6147266367 Snake Keylogger
URL hxxp://sbv[.]pushswroller[.]eu/gfy/gesr[.]txt
hxxp://bill[.]drillmmcsnk[.]top/hdf/vic[.]txt
RedLine Stealer
URL hxxp://31[.]41[.]244[.]11/files/151334531/JIAfos7[.]exe NetSupportManager RAT
URL hxxp://20[.]83[.]148[.]22:8080/test12[.]exe
hxxp://20[.]83[.]148[.]22:8080/test6[.]exe
hxxp://20[.]83[.]148[.]22:8080/test14[.]exe
hxxp://20[.]83[.]148[.]22:8080/pantest[.]exe
hxxp://20[.]83[.]148[.]22:8080/test9[.]exe
hxxp://20[.]83[.]148[.]22:8080/test10-29[.]exe
hxxp://20[.]83[.]148[.]22:8080/test19[.]exe
hxxp://20[.]83[.]148[.]22:8080/test10[.]exe
hxxp://20[.]83[.]148[.]22:8080/test_again4[.]exe
hxxp://20[.]83[.]148[.]22:8080/test23[.]exe
hxxp://20[.]83[.]148[.]22:8080/test5[.]exe
hxxp://20[.]83[.]148[.]22:8080/test11[.]exe
hxxp://20[.]83[.]148[.]22:8080/test20[.]exe
hxxp://20[.]83[.]148[.]22:8080/test_again3[.]exe
hxxp://20[.]83[.]148[.]22:8080/test16[.]exe
hxxp://20[.]83[.]148[.]22:8080/test13[.]exe
hxxp://20[.]83[.]148[.]22:8080/test_again2[.]exe
hxxp://20[.]83[.]148[.]22:8080/test15[.]exe
hxxp://20[.]83[.]148[.]22:8080/test18[.]exe
hxxp://20[.]83[.]148[.]22:8080/test21[.]exe
hxxp://20[.]83[.]148[.]22:8080/test22[.]exe
hxxp://20[.]83[.]148[.]22:8080/test8[.]exe
hxxp://20[.]83[.]148[.]22:8080/test7[.]exe
hxxp://20[.]83[.]148[.]22:8080/test-again[.]exe
hxxp://20[.]83[.]148[.]22:8080/test17[.]exe
Cobalt Strike
URL hxxp://31[.]41[.]244[.]11/files/7462340654/VBVEd6f[.]exe Vidar
URL hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Stealer[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Recovery[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HRDP[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Microphone[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/WSound[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/FileManager[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Ngrok-Installer[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/FilesSearcher[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/VoiceChat[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Performance[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Programs[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HVNC[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Regedit[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ActiveWindows[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HiddenApps[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Keylogger[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/RemoteDesktop[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/StartupManager[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/WebCam[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HBrowser[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/TCPConnections[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Chat[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Maps[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/UACBypass[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ReverseProxy[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ProcessManager[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Shell[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/RunPE[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Cmstp-Bypass[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/HVNCMemory[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Clipboard[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Options[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Chromium[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/MessageBox[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Informations[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Ransomware[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/Pastime[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Plugins/ServiceManager[.]dll
hxxp://68[.]178[.]207[.]33:8000/RR/XWorm-5[.]6/Xworm%20V5[.]6[.]exe
hxxp://68[.]178[.]207[.]33:8000/XClient[.]exe
XWorm
URL hxxp://sageskills-uk[.]com:1224/pdown
hxxp://86[.]104[.]74[.]51:1224/pdown
StrelaStealer
URL hxxp://31[.]41[.]244[.]11/files/7187702529/UqhRb9F[.]exe XenoRAT
URL hxxp://31[.]41[.]244[.]11/files/7407486059/Tq4a1Bz[.]exe Lumar
※1「i-FILTER」アクセスログを検索し端末を特定してください 不要なアクセスを避けるため、一部変更しております。 ■製品対応状況(※2) ▽i-FILTER(※3) ・[脅威情報サイト]カテゴリでブロック可能 ※2 ブロックの可否は各製品の設定によるため、実際の結果はアクセスログを参照してください。 ※3 暗号化された通信の場合は、SSL Adapterの設定を「利用」にする必要があります。
イベント・セミナー情報