不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様8社 -
2024/12/10
※2024/12/10 更新
マルウェア感染させると考えられるURLを検知（2024/12/10）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://185[.]226[.]181[.]36/count/Rgfbp[.]vdf hxxp://185[.]226[.]181[.]36/count/Curbjjrrn[.]vdf hxxp://185[.]215[.]113[.]209/inc/T3[.]exe hxxp://185[.]215[.]113[.]209/inc/HVNC1[.]exe hxxp://185[.]215[.]113[.]209/inc/winn[.]exe hxxp://185[.]215[.]113[.]209/inc/5KNCHALAH[.]exe |
PureCrypter |
| URL | hxxp://181[.]214[.]58[.]112/ctrl/Book[.]xls hxxp://51[.]75[.]142[.]232/Photo[.]scr hxxp://51[.]75[.]142[.]232/AV[.]scr hxxp://51[.]75[.]142[.]232/Video[.]scr hxxp://185[.]215[.]113[.]209/inc/xxz[.]exe hxxp://185[.]215[.]113[.]209/inc/h5a71wdy[.]exe hxxp://185[.]215[.]113[.]209/inc/svchost[.]exe hxxp://185[.]215[.]113[.]209/inc/gaozw40v[.]exe hxxp://185[.]215[.]113[.]209/inc/2020[.]exe hxxp://185[.]215[.]113[.]209/inc/2r61ahry[.]exe hxxp://185[.]215[.]113[.]209/inc/88aext0k[.]exe hxxps://193[.]233[.]113[.]197/build/drop2[.]exe hxxp://185[.]215[.]113[.]16/inc/xmbld[.]exe hxxp://193[.]233[.]113[.]197/build/drop2[.]exe hxxp://185[.]215[.]113[.]209/inc/xmbld[.]exe |
Coinminer |
| URL | hxxps://wwwsecure[.]icu/kunde2637252/rechnung294673929/552518251[.]html hxxp://31[.]41[.]244[.]11/files/6904700471/vdGy6gA[.]exe hxxp://31[.]41[.]244[.]11/files/6904700471/gYOFGAL[.]exe hxxp://31[.]41[.]244[.]11/files/6904700471/A1Jmc63[.]exe hxxps://gamertool[.]eu/GmdDriver[.]exe hxxps://klipcatepiu0[.]shop/int_clp_ldr_sha[.]txt hxxp://185[.]215[.]113[.]209/inc/qqq[.]exe hxxp://185[.]215[.]113[.]209/inc/GOLD1234[.]exe hxxp://185[.]215[.]113[.]209/inc/LummaC222222[.]exe hxxp://185[.]215[.]113[.]209/inc/mobiletrans[.]exe hxxp://185[.]215[.]113[.]209/inc/kp8dnpa9[.]exe hxxp://185[.]215[.]113[.]209/inc/yxrd0ob7[.]exe hxxp://185[.]215[.]113[.]209/inc/jb4w5s2l[.]exe hxxp://185[.]215[.]113[.]209/inc/shopfree[.]exe hxxp://185[.]215[.]113[.]209/lumma/random[.]exe hxxp://185[.]215[.]113[.]209/inc/zzzz1[.]exe hxxp://185[.]215[.]113[.]209/inc/PctOccurred[.]exe hxxp://185[.]215[.]113[.]209/inc/Firefox[.]exe hxxp://185[.]215[.]113[.]209/inc/postbox[.]exe hxxp://185[.]215[.]113[.]209/inc/setup[.]exe hxxp://185[.]215[.]113[.]209/inc/RDX123456[.]exe hxxp://185[.]215[.]113[.]209/inc/coreplugin[.]exe hxxp://185[.]215[.]113[.]209/inc/new_v8[.]exe hxxp://185[.]215[.]113[.]209/inc/golden[.]exe hxxp://185[.]215[.]113[.]209/inc/f86nrrc6[.]exe hxxp://185[.]215[.]113[.]209/luma/random[.]exe hxxp://185[.]215[.]113[.]209/inc/GoogleUpdate[.]exe hxxp://185[.]215[.]113[.]209/inc/j4vzzuai[.]exe hxxp://185[.]215[.]113[.]209/inc/7777[.]exe hxxp://185[.]215[.]113[.]209/inc/Amadeus[.]exe hxxp://185[.]215[.]113[.]209/inc/blackload[.]exe hxxp://185[.]215[.]113[.]209/inc/broadcom5[.]exe hxxp://185[.]215[.]113[.]209/inc/18ijuw13[.]exe hxxp://185[.]215[.]113[.]209/inc/99awhy8l[.]exe hxxp://185[.]215[.]113[.]209/inc/6nteyex7[.]exe hxxp://185[.]215[.]113[.]209/inc/7cl16anh[.]exe hxxp://185[.]219[.]81[.]14/docs/document[.]docx hxxps://www[.]mediafire[.]com/file/296vz34acpwvlh0/WonderHack[.]zip/file hxxp://185[.]215[.]113[.]209/inc/LummaC2[.]exe hxxp://185[.]215[.]113[.]16/inc/d8rb24m3[.]exe hxxp://185[.]215[.]113[.]16/inc/lega[.]exe hxxp://185[.]215[.]113[.]16/inc/dmn6qzwr[.]exe hxxp://185[.]215[.]113[.]16/inc/v_dolg[.]exe hxxp://185[.]215[.]113[.]16/inc/aqbjn3fl[.]exe hxxp://185[.]215[.]113[.]209/inc/alex2022[.]exe hxxp://185[.]215[.]113[.]16/inc/alex2022[.]exe hxxp://185[.]215[.]113[.]16/inc/n8um2y9v[.]exe hxxp://185[.]215[.]113[.]209/inc/d8rb24m3[.]exe hxxp://185[.]215[.]113[.]209/inc/lega[.]exe hxxp://185[.]215[.]113[.]209/inc/v_dolg[.]exe hxxp://185[.]215[.]113[.]209/inc/aqbjn3fl[.]exe hxxp://185[.]215[.]113[.]209/inc/n8um2y9v[.]exe hxxp://185[.]215[.]113[.]209/inc/dmn6qzwr[.]exe hxxp://bitbucket[.]org/fwegewgwe/greergoipin/downloads/ndiASjk[.]txt hxxp://bitbucket[.]org/fwegewgwe/greergoipin/downloads/krIASca[.]txt hxxps://pull-trucker[.]sbs/api hxxps://fleez-inc[.]sbs/api hxxps://crib-endanger[.]sbs/api hxxps://bored-light[.]sbs/api |
Lumma Stealer |
| URL | hxxps://34d768db37e5e2f5a7fbc0fe1fee5b311[.]com/YzhkZjQwNDRkN2Uy/ | Coper |
| URL | hxxp://178[.]63[.]102[.]185/server/Fzbkui[.]exe hxxp://83[.]217[.]209[.]163/msh/drop3[.]exe hxxp://185[.]215[.]113[.]209/inc/dccrypt[.]exe hxxp://185[.]215[.]113[.]209/inc/DecryptJohn[.]exe hxxp://185[.]215[.]113[.]209/inc/ufw[.]exe hxxp://185[.]215[.]113[.]209/inc/3544436[.]exe hxxp://178[.]63[.]102[.]185/server/600%202024[.]exe |
PureLogs Stealer |
| URL | hxxp://178[.]63[.]102[.]185/server/8888[.]exe hxxp://178[.]63[.]102[.]185/server/32%20VPN[.]exe hxxp://178[.]63[.]102[.]185/server/850[.]exe hxxp://103[.]20[.]102[.]62/404[.]docx hxxp://185[.]215[.]113[.]209/inc/ven_protected[.]exe hxxp://185[.]215[.]113[.]209/inc/msedge[.]exe hxxp://185[.]215[.]113[.]209/inc/xt[.]exe hxxp://185[.]215[.]113[.]209/inc/rstxdhuj[.]exe hxxp://185[.]215[.]113[.]209/inc/DeliciousPart[.]exe hxxp://185[.]215[.]113[.]209/inc/WindowsUI[.]exe hxxp://185[.]215[.]113[.]209/inc/cudo[.]exe hxxp://185[.]215[.]113[.]209/inc/taskhost[.]exe hxxp://185[.]215[.]113[.]209/inc/xxxx[.]exe hxxp://185[.]215[.]113[.]209/inc/gagagggagagag[.]exe hxxp://185[.]215[.]113[.]209/inc/uctgkfb7[.]exe hxxp://185[.]215[.]113[.]16/inc/g9win6bb[.]exe hxxps://226-pth8[.]4everland[.]app/TT_Copy[.]pdf[.]exe hxxp://185[.]215[.]113[.]209/inc/g9win6bb[.]exe hxxps://164[.]68[.]126[.]53/rrats[.]exe hxxp://31[.]41[.]244[.]11/files/7219056628/9Qk4n8B[.]exe hxxp://31[.]41[.]244[.]11/files/1521297942/n4e23hz[.]exe |
AsyncRAT |
| URL | hxxp://178[.]63[.]102[.]185/server/222[.]exe hxxp://185[.]215[.]113[.]209/inc/Client_protected[.]exe hxxp://185[.]215[.]113[.]209/inc/PkContent[.]exe hxxp://185[.]215[.]113[.]209/inc/OneDrive[.]exe |
NjRAT |
| URL | hxxp://178[.]63[.]102[.]185/server/x[.]ps1 hxxp://185[.]215[.]113[.]209/inc/Pichon[.]exe hxxp://185[.]215[.]113[.]209/inc/cclent[.]exe |
Quasar RAT |
| URL | hxxps://www[.]ftsengineers[.]com/km/microcheilia[.]dwp hxxp://185[.]215[.]113[.]209/inc/Rage[.]exe hxxp://104[.]168[.]7[.]16/xcxqyXbbr179[.]bin hxxp://104[.]168[.]7[.]16/IWSfGbWezoT43[.]bin hxxps://krtopup[.]com/Phaet[.]xsn hxxp://krtopup[.]com/bUjFLHNJmXqLoJWMN142[.]bin hxxps://krtopup[.]com/bUjFLHNJmXqLoJWMN142[.]bin hxxp://krtopup[.]com/Phaet[.]xsn hxxp://pagecourierdhaul[.]com/Rfq_po_december_purchase_list_details_specifications_09_12_2024_0000000000[.]7z hxxps://pagecourierdhaul[.]com/Rfq_po_december_purchase_list_details_specifications_09_12_2024_0000000000[.]7z |
CloudEyE |
| URL | hxxps://www[.]stipamana[.]com/yuerthreytwsytysrertersedtryerytsrt/erwgsergtseggszgdargaregwa/strsrthtghtghdfghsgthw/cfdhxdzhtfxgh[.]exe hxxps://www[.]stipamana[.]com/vbsznjgzfzgolnzdgh/tydthcgfhjdfhsfghxffsjhx/vbfdhydjyfjfxhgjhxgh/pafdfgzdf[.]vbs hxxp://stipamana[.]com/yuerthreytwsytysrertersedtryerytsrt/erwgsergtseggszgdargaregwa/strsrthtghtghdfghsgthw/cfdhxdzhtfxgh[.]exe |
XenoRAT |
| URL | hxxp://185[.]215[.]113[.]209/inc/hashed[.]exe hxxp://185[.]215[.]113[.]209/inc/Set-up[.]exe hxxp://185[.]215[.]113[.]209/inc/Channel1[.]exe hxxp://185[.]215[.]113[.]209/inc/Setup2[.]exe hxxp://185[.]215[.]113[.]209/inc/channel[.]exe hxxp://185[.]215[.]113[.]209/inc/clcs[.]exe hxxp://185[.]215[.]113[.]209/inc/DOC[.]exe hxxp://185[.]215[.]113[.]209/inc/S%D0%B5tu%D1%80111[.]exe hxxp://185[.]215[.]113[.]209/inc/S%D0%B5tup[.]exe hxxp://185[.]215[.]113[.]209/inc/te3tlsre[.]exe hxxp://185[.]215[.]113[.]209/inc/file1[.]exe hxxp://185[.]215[.]113[.]209/inc/kmvcsaed[.]exe hxxp://185[.]215[.]113[.]209/inc/1111[.]exe hxxp://185[.]215[.]113[.]209/inc/3yh8gdte[.]exe hxxp://185[.]215[.]113[.]209/inc/3546345[.]exe hxxp://185[.]215[.]113[.]209/inc/5_6190317556063017550[.]exe hxxp://185[.]215[.]113[.]16/inc/trru7rd2[.]exe hxxp://185[.]215[.]113[.]16/inc/zk1b090h[.]exe hxxp://185[.]215[.]113[.]16/inc/szo0xbx8[.]exe hxxp://185[.]215[.]113[.]209/inc/szo0xbx8[.]exe hxxp://185[.]215[.]113[.]209/inc/zk1b090h[.]exe hxxp://185[.]215[.]113[.]209/inc/trru7rd2[.]exe |
CryptBot |
| URL | hxxp://185[.]215[.]113[.]209/reko/valid[.]exe hxxp://185[.]215[.]113[.]209/inc/resex[.]exe hxxp://185[.]215[.]113[.]209/inc/bundle[.]exe hxxp://185[.]215[.]113[.]209/inc/crypted[.]exe hxxp://185[.]215[.]113[.]209/inc/new1[.]exe hxxp://185[.]215[.]113[.]209/inc/GIFT-INFO[.]lMG[.]exe hxxp://185[.]215[.]113[.]209/inc/penis[.]exe hxxp://185[.]215[.]113[.]209/inc/myrdx[.]exe hxxp://185[.]215[.]113[.]209/inc/meta[.]exe hxxp://185[.]215[.]113[.]209/inc/frap[.]exe hxxp://185[.]215[.]113[.]209/inc/MK[.]exe hxxp://185[.]215[.]113[.]209/inc/crypteda[.]exe hxxp://185[.]215[.]113[.]209/inc/surfex[.]exe hxxp://185[.]215[.]113[.]209/inc/zxcv[.]exe hxxp://185[.]215[.]113[.]209/inc/GOLD[.]exe hxxp://185[.]215[.]113[.]209/inc/vlst[.]exe hxxp://185[.]215[.]113[.]209/inc/buildred[.]exe hxxp://185[.]215[.]113[.]209/inc/systems[.]exe hxxp://185[.]215[.]113[.]209/inc/Operation6572[.]exe hxxp://185[.]215[.]113[.]209/inc/windowsexecutable[.]exe hxxp://185[.]215[.]113[.]209/inc/kiyan[.]exe hxxp://185[.]215[.]113[.]209/inc/newbundle[.]exe hxxp://185[.]215[.]113[.]209/inc/cookie250[.]exe hxxp://185[.]215[.]113[.]209/inc/chicken123[.]exe hxxp://185[.]215[.]113[.]209/inc/scheduledllama[.]exe hxxp://185[.]215[.]113[.]209/inc/xxl[.]exe hxxp://185[.]215[.]113[.]209/inc/drchoe[.]exe hxxp://185[.]215[.]113[.]209/inc/MYNEWRDX[.]exe hxxp://185[.]215[.]113[.]209/inc/whiteheroin[.]exe hxxp://185[.]215[.]113[.]209/inc/newbundle2[.]exe hxxp://185[.]215[.]113[.]209/inc/robotic[.]exe hxxp://185[.]215[.]113[.]209/inc/cc2[.]exe hxxp://185[.]215[.]113[.]209/inc/MePaxil[.]exe hxxp://185[.]215[.]113[.]209/inc/js[.]exe hxxp://185[.]215[.]113[.]209/inc/morphic[.]exe hxxp://185[.]215[.]113[.]209/inc/BattleGermany[.]exe hxxp://185[.]215[.]113[.]209/inc/4ck3rr[.]exe hxxp://185[.]215[.]113[.]209/inc/anticheat[.]exe hxxp://185[.]215[.]113[.]209/inc/25072023[.]exe hxxp://185[.]215[.]113[.]209/inc/06082025[.]exe hxxp://185[.]215[.]113[.]209/inc/14082024[.]exe hxxps://244-3-drvu[.]4everland[.]app/bankcopys[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]215[.]113[.]209/inc/SemiconductorNot[.]exe hxxp://185[.]215[.]113[.]209/inc/splwow64[.]exe hxxp://185[.]215[.]113[.]209/soka/random[.]exe hxxp://185[.]215[.]113[.]209/mine/random[.]exe?Y hxxp://185[.]215[.]113[.]209/mine/random[.]exe hxxp://185[.]215[.]113[.]209/inc/tn8cdkzn[.]exe hxxp://185[.]215[.]113[.]209/store/random[.]exe hxxp://185[.]215[.]113[.]209/inc/Amadey[.]exe hxxp://185[.]215[.]113[.]209/inc/5gevcp8z[.]exe hxxp://185[.]215[.]113[.]209/dobre/splwow64_1[.]exe hxxp://185[.]215[.]113[.]209/dobre/random[.]exe hxxp://185[.]215[.]113[.]209/dobre/splwow64[.]exe hxxp://185[.]215[.]113[.]16/test/am209[.]exe hxxp://185[.]215[.]113[.]209/test/am209[.]exe |
Amadey |
| URL | hxxp://185[.]215[.]113[.]209/inc/seo[.]exe hxxp://185[.]215[.]113[.]209/inc/j86piuq9[.]exe hxxp://185[.]215[.]113[.]209/inc/noll[.]exe hxxp://185[.]215[.]113[.]209/store/Vidar[.]exe hxxp://185[.]215[.]113[.]209/inc/vidar[.]exe hxxp://185[.]215[.]113[.]209/inc/PharmaciesDetection[.]exe hxxp://185[.]215[.]113[.]209/inc/sgx4824p[.]exe hxxp://185[.]215[.]113[.]209/inc/ControlledAccessPoint[.]exe hxxp://185[.]215[.]113[.]209/inc/InfluencedNervous[.]exe hxxp://185[.]215[.]113[.]209/inc/0b44ippu[.]exe hxxp://185[.]215[.]113[.]209/inc/build_2024-07-24_23-16[.]exe hxxp://185[.]215[.]113[.]209/inc/build_2024-07-27_00-41[.]exe hxxp://185[.]215[.]113[.]209/inc/build_2024-07-25_20-56[.]exe |
Vidar |
| URL | hxxp://185[.]215[.]113[.]209/inc/nano[.]exe hxxp://185[.]215[.]113[.]209/inc/Survox[.]exe |
Nanocore RAT |
| URL | hxxp://185[.]215[.]113[.]209/inc/Cbmefxrmnv[.]exe hxxp://185[.]215[.]113[.]209/inc/Ewpeloxttug[.]exe hxxp://185[.]215[.]113[.]209/inc/Ukodbcdcl[.]exe hxxp://185[.]215[.]113[.]209/inc/gawdth[.]exe hxxp://185[.]215[.]113[.]209/inc/jsawdtyjde[.]exe hxxp://185[.]215[.]113[.]209/inc/Mswgoudnv[.]exe hxxp://185[.]215[.]113[.]209/inc/Cvimelugfq[.]exe hxxp://185[.]215[.]113[.]209/inc/Opdxdyeul[.]exe |
SystemBC |
| URL | hxxp://185[.]215[.]113[.]209/inc/clsid[.]exe hxxps://aquafusion[.]com[.]co/ngbx/ngown[.]exe hxxp://drdavidfishbein[.]com/file/125[.]txt hxxp://drdavidfishbein[.]com/files/128[.]txt |
Agent Tesla |
| URL | hxxp://185[.]215[.]113[.]209/inc/prem1[.]exe hxxp://185[.]215[.]113[.]209/inc/stealc_default2[.]exe hxxp://185[.]215[.]113[.]209/steam/random[.]exe?9I/ hxxp://185[.]215[.]113[.]209/inc/stealc_valenciga[.]exe hxxp://185[.]215[.]113[.]209/inc/needmoney[.]exe hxxp://185[.]215[.]113[.]209/inc/pimer_bbbcontents7[.]exe hxxp://185[.]215[.]113[.]209/inc/stealc_default[.]exe hxxp://185[.]215[.]113[.]209/steam/random[.]exe?9I hxxp://185[.]215[.]113[.]209/steam/random[.]exe hxxp://185[.]215[.]113[.]209/inc/stealc_daval[.]exe hxxp://185[.]215[.]113[.]209/inc/5447jsX[.]exe hxxp://185[.]215[.]113[.]209/inc/12[.]exe hxxp://185[.]215[.]113[.]209/inc/4434[.]exe hxxp://185[.]215[.]113[.]209/test/num[.]exe hxxp://185[.]215[.]113[.]16/inc/d4cye08a[.]exe hxxp://185[.]215[.]113[.]209/inc/d4cye08a[.]exe hxxp://45[.]91[.]201[.]185/e3e098fc1797439d[.]php |
Stealc |
| URL | hxxp://185[.]215[.]113[.]209/inc/DiskUtility[.]exe hxxp://185[.]215[.]113[.]209/inc/xyaw4fkp[.]exe hxxp://185[.]215[.]113[.]209/inc/kitty[.]exe hxxp://185[.]215[.]113[.]209/inc/crypted25[.]exe hxxp://185[.]215[.]113[.]209/inc/BaddStore[.]exe |
XWorm |
| URL | hxxp://185[.]215[.]113[.]209/inc/soft2[.]exe | DanaBot |
| URL | hxxp://185[.]215[.]113[.]209/inc/Vn70wVxW[.]exe hxxp://185[.]215[.]113[.]209/inc/out_test_sig[.]exe |
MetaStealer |
| URL | hxxp://185[.]215[.]113[.]209/inc/explorer[.]exe hxxp://185[.]215[.]113[.]209/inc/freedom[.]exe hxxp://185[.]215[.]113[.]209/inc/88851n80[.]exe hxxps://wgs[.]com[.]pk/js/oOoNAwEXZZvmjZS[.]exe hxxp://103[.]237[.]86[.]5/xampp/uh/nicenamewithgoodheartwithentiretimegivenbemebest_________thrnothinghavewhichfeelgreatwithgoodnewsforever________sheissupposetogivethemgreatthigns[.]doc |
Formbook |
| URL | hxxp://185[.]215[.]113[.]209/inc/torque[.]exe hxxp://185[.]215[.]113[.]209/inc/univ[.]exe |
GCleaner |
| URL | hxxp://185[.]215[.]113[.]209/inc/file[.]exe hxxp://185[.]215[.]113[.]209/inc/DEF[.]exe hxxps://www[.]grupodulcemar[.]pe/factura[.]exe hxxps://grupodulcemar[.]pe/H8hsp6zrMtJI2hC[.]exe hxxps://www[.]grupodulcemar[.]pe/H8hsp6zrMtJI2hC[.]exe hxxps://grupodulcemar[.]pe/PO076567890000[.]exe hxxps://www[.]grupodulcemar[.]pe/PO076567890000[.]exe hxxps://www[.]grupodulcemar[.]pe/FACTURA-0987678[.]exe hxxps://grupodulcemar[.]pe/IB9876789000[.]exe hxxp://www[.]mva[.]by/tags/scancop[.]exe hxxps://haramb[.]net/sol2[.]exe hxxp://haramb[.]net/KillingInstructional[.]exe hxxp://bitbucket[.]org/fwegewgwe/greergoipin/downloads/ecIihoe[.]txt hxxp://grupodulcemar[.]pe/INVOICE-9876[.]exe hxxps://www[.]grupodulcemar[.]pe/IB9876789000[.]exe hxxp://77[.]105[.]161[.]126/file/build[.]exe |
Remcos |
| URL | hxxp://185[.]215[.]113[.]209/inc/neonn[.]exe hxxp://185[.]215[.]113[.]209/inc/neon[.]exe hxxp://185[.]215[.]113[.]209/inc/armadegon[.]exe |
DarkTortilla |
| URL | hxxp://185[.]215[.]113[.]209/inc/ConsiderableWinners[.]exe hxxp://117[.]72[.]36[.]133/beacon_x64[.]exe hxxps://47[.]244[.]167[.]171:801/02[.]08[.]2022[.]exe hxxps://1[.]94[.]204[.]34:4444/02[.]08[.]2022[.]exe hxxp://touduanyiyuan[.]bugmakerx[.]cn/02[.]08[.]2022[.]exe hxxps://43[.]226[.]125[.]43:10443/02[.]08[.]2022[.]exe hxxps://39[.]106[.]152[.]236:11443/02[.]08[.]2022[.]exe hxxp://0xawad[.]xyz/02[.]08[.]2022[.]exe hxxps://124[.]220[.]180[.]112:2087/02[.]08[.]2022[.]exe hxxp://192[.]210[.]243[.]27:9999/02[.]08[.]2022[.]exe hxxp://59[.]110[.]136[.]135:380/02[.]08[.]2022[.]exe hxxp://44[.]243[.]209[.]238/02[.]08[.]2022[.]exe hxxps://175[.]27[.]160[.]188:2096/02[.]08[.]2022[.]exe hxxp://123[.]207[.]61[.]138/02[.]08[.]2022[.]exe hxxps://185[.]212[.]60[.]145:18443/02[.]08[.]2022[.]exe hxxps://101[.]133[.]229[.]117:18080/02[.]08[.]2022[.]exe hxxps://47[.]100[.]180[.]123:50055/02[.]08[.]2022[.]exe hxxp://93[.]123[.]109[.]99/02[.]08[.]2022[.]exe hxxps://43[.]138[.]10[.]93:43810/02[.]08[.]2022[.]exe hxxps://111[.]229[.]187[.]190:8344/02[.]08[.]2022[.]exe hxxps://1[.]94[.]204[.]34:4443/02[.]08[.]2022[.]exe hxxps://120[.]26[.]46[.]50:8879/02[.]08[.]2022[.]exe hxxps://worksafevictoria[.]com/02[.]08[.]2022[.]exe hxxp://zblmt[.]gjc1314[.]com/02[.]08[.]2022[.]exe hxxps://39[.]99[.]128[.]40:35001/02[.]08[.]2022[.]exe hxxps://172[.]96[.]237[.]159:1443/02[.]08[.]2022[.]exe hxxps://154[.]92[.]14[.]41:2998/02[.]08[.]2022[.]exe hxxp://198[.]2[.]253[.]251:2024/02[.]08[.]2022[.]exe hxxps://80[.]76[.]51[.]166:1433/02[.]08[.]2022[.]exe hxxps://138[.]68[.]163[.]61/02[.]08[.]2022[.]exe hxxp://124[.]71[.]74[.]122/02[.]08[.]2022[.]exe hxxps://148[.]135[.]77[.]103:55555/02[.]08[.]2022[.]exe hxxp://go1[.]sigmasb[.]com/02[.]08[.]2022[.]exe hxxps://43[.]138[.]10[.]93:5555/02[.]08[.]2022[.]exe hxxps://124[.]71[.]202[.]76:15555/02[.]08[.]2022[.]exe hxxps://43[.]226[.]125[.]42:10443/02[.]08[.]2022[.]exe hxxps://121[.]199[.]28[.]252:15242/02[.]08[.]2022[.]exe hxxps://189[.]1[.]216[.]187:8443/02[.]08[.]2022[.]exe hxxps://42[.]51[.]37[.]127:33399/02[.]08[.]2022[.]exe hxxps://42[.]51[.]37[.]127:8087/02[.]08[.]2022[.]exe hxxps://44[.]243[.]209[.]238/02[.]08[.]2022[.]exe hxxp://113[.]45[.]171[.]161:88/02[.]08[.]2022[.]exe hxxps://170[.]130[.]165[.]23:444/02[.]08[.]2022[.]exe hxxps://4[.]200[.]9[.]84/02[.]08[.]2022[.]exe hxxps://124[.]221[.]184[.]239:5443/02[.]08[.]2022[.]exe hxxps://124[.]222[.]23[.]253:9999/02[.]08[.]2022[.]exe hxxps://174[.]138[.]50[.]62:2087/02[.]08[.]2022[.]exe hxxps://101[.]35[.]141[.]80:8443/02[.]08[.]2022[.]exe hxxps://120[.]24[.]38[.]217:4433/02[.]08[.]2022[.]exe hxxp://47[.]236[.]244[.]191/02[.]08[.]2022[.]exe hxxps://34[.]226[.]46[.]150:8443/02[.]08[.]2022[.]exe hxxps://cityoall[.]com/02[.]08[.]2022[.]exe hxxps://116[.]62[.]69[.]12:44440/02[.]08[.]2022[.]exe hxxp://113[.]44[.]130[.]196/02[.]08[.]2022[.]exe hxxp://dev[.]cyberark-igiwax[.]com/02[.]08[.]2022[.]exe hxxp://47[.]90[.]142[.]15:804/02[.]08[.]2022[.]exe hxxps://43[.]139[.]60[.]87/02[.]08[.]2022[.]exe hxxps://60[.]204[.]134[.]21/02[.]08[.]2022[.]exe hxxps://124[.]220[.]180[.]112:21548/02[.]08[.]2022[.]exe hxxps://121[.]37[.]66[.]33:12266/02[.]08[.]2022[.]exe hxxps://45[.]14[.]226[.]17/02[.]08[.]2022[.]exe hxxp://47[.]242[.]206[.]77:8888/02[.]08[.]2022[.]exe hxxps://124[.]222[.]93[.]70/02[.]08[.]2022[.]exe hxxps://119[.]28[.]129[.]27:22443/02[.]08[.]2022[.]exe hxxps://45[.]14[.]226[.]17:45621/02[.]08[.]2022[.]exe hxxps://39[.]104[.]22[.]98:29926/02[.]08[.]2022[.]exe hxxps://121[.]40[.]63[.]121:8888/02[.]08[.]2022[.]exe hxxps://81[.]70[.]222[.]4:4443/02[.]08[.]2022[.]exe hxxps://20[.]189[.]79[.]97:8614/02[.]08[.]2022[.]exe hxxp://120[.]46[.]28[.]4:8081/02[.]08[.]2022[.]exe hxxps://47[.]100[.]180[.]123:30005/02[.]08[.]2022[.]exe hxxp://107[.]173[.]57[.]205:8899/02[.]08[.]2022[.]exe hxxps://47[.]237[.]118[.]17/02[.]08[.]2022[.]exe hxxps://api[.]co-operativefinance[.]com/02[.]08[.]2022[.]exe hxxp://114[.]55[.]145[.]198/02[.]08[.]2022[.]exe hxxp://80[.]76[.]51[.]166/02[.]08[.]2022[.]exe hxxps://38[.]6[.]216[.]52:2053/02[.]08[.]2022[.]exe hxxps://101[.]32[.]37[.]92:2096/02[.]08[.]2022[.]exe hxxps://47[.]242[.]50[.]82/02[.]08[.]2022[.]exe hxxps://124[.]221[.]127[.]219:19455/02[.]08[.]2022[.]exe hxxps://18[.]166[.]176[.]228/02[.]08[.]2022[.]exe hxxps://103[.]77[.]210[.]65:63443/02[.]08[.]2022[.]exe hxxps://209[.]97[.]139[.]27/02[.]08[.]2022[.]exe hxxps://admin[.]aishangzhua[.]com/02[.]08[.]2022[.]exe hxxps://124[.]222[.]170[.]30:33890/02[.]08[.]2022[.]exe hxxp://106[.]75[.]61[.]100:6699/02[.]08[.]2022[.]exe hxxps://47[.]120[.]60[.]201:8443/02[.]08[.]2022[.]exe hxxps://8[.]137[.]114[.]210:4433/02[.]08[.]2022[.]exe hxxps://1[.]117[.]93[.]65:54847/02[.]08[.]2022[.]exe hxxp://85[.]158[.]145[.]96:8888/02[.]08[.]2022[.]exe hxxps://1[.]12[.]226[.]143:8888/02[.]08[.]2022[.]exe hxxps://101[.]35[.]228[.]105:20443/02[.]08[.]2022[.]exe hxxps://157[.]245[.]14[.]245:8086/02[.]08[.]2022[.]exe hxxps://92[.]118[.]170[.]81:53421/02[.]08[.]2022[.]exe hxxps://59[.]110[.]136[.]135:2443/02[.]08[.]2022[.]exe hxxp://156[.]244[.]45[.]11/02[.]08[.]2022[.]exe hxxps://39[.]107[.]79[.]119:4443/02[.]08[.]2022[.]exe hxxps://121[.]41[.]89[.]22/02[.]08[.]2022[.]exe hxxps://125[.]75[.]36[.]125:63443/02[.]08[.]2022[.]exe hxxp://122[.]10[.]224[.]68:8080/02[.]08[.]2022[.]exe hxxps://81[.]70[.]105[.]188:10443/02[.]08[.]2022[.]exe hxxps://60[.]204[.]134[.]21:8443/02[.]08[.]2022[.]exe hxxp://192[.]3[.]98[.]53:3389/02[.]08[.]2022[.]exe hxxps://dev[.]cyberark-igiwax[.]com/02[.]08[.]2022[.]exe hxxps://47[.]90[.]142[.]15:5432/02[.]08[.]2022[.]exe hxxp://cityoall[.]com/02[.]08[.]2022[.]exe hxxps://47[.]98[.]154[.]34:10443/02[.]08[.]2022[.]exe hxxps://108[.]186[.]93[.]132/02[.]08[.]2022[.]exe hxxps://43[.]138[.]20[.]240:4443/02[.]08[.]2022[.]exe hxxp://120[.]46[.]212[.]33:4433/02[.]08[.]2022[.]exe hxxps://47[.]92[.]92[.]116/02[.]08[.]2022[.]exe hxxps://43[.]143[.]143[.]226:60002/02[.]08[.]2022[.]exe hxxp://124[.]222[.]164[.]43:6667/02[.]08[.]2022[.]exe hxxps://94[.]74[.]105[.]131:8888/02[.]08[.]2022[.]exe hxxps://121[.]37[.]66[.]33:16851/02[.]08[.]2022[.]exe hxxps://173[.]231[.]247[.]84:64114/02[.]08[.]2022[.]exe hxxps://174[.]138[.]50[.]62:3388/02[.]08[.]2022[.]exe hxxps://121[.]37[.]170[.]202:4433/02[.]08[.]2022[.]exe hxxps://121[.]89[.]212[.]43:8443/02[.]08[.]2022[.]exe hxxps://47[.]93[.]243[.]161:39124/02[.]08[.]2022[.]exe hxxps://47[.]92[.]192[.]119:8443/02[.]08[.]2022[.]exe hxxps://141[.]98[.]197[.]31:7786/02[.]08[.]2022[.]exe hxxp://106[.]126[.]3[.]52:8088/02[.]08[.]2022[.]exe hxxp://license[.]bugmakerx[.]cn/02[.]08[.]2022[.]exe hxxps://37[.]10[.]71[.]240:444/02[.]08[.]2022[.]exe hxxp://172[.]245[.]84[.]70/02[.]08[.]2022[.]exe hxxp://114[.]132[.]190[.]53/02[.]08[.]2022[.]exe hxxps://59[.]110[.]136[.]135:4443/02[.]08[.]2022[.]exe hxxps://119[.]45[.]130[.]147:18444/02[.]08[.]2022[.]exe hxxps://154[.]221[.]16[.]176:12443/02[.]08[.]2022[.]exe hxxp://121[.]37[.]170[.]202:9999/02[.]08[.]2022[.]exe hxxps://47[.]98[.]194[.]85/02[.]08[.]2022[.]exe hxxps://43[.]153[.]158[.]146:8443/02[.]08[.]2022[.]exe hxxps://192[.]252[.]183[.]228:2087/02[.]08[.]2022[.]exe hxxps://45[.]128[.]146[.]227:2087/02[.]08[.]2022[.]exe hxxp://service[.]bugmakerx[.]cn/02[.]08[.]2022[.]exe hxxps://101[.]43[.]112[.]155/02[.]08[.]2022[.]exe hxxps://23[.]95[.]44[.]80:40843/02[.]08[.]2022[.]exe hxxps://43[.]153[.]222[.]28:4545/02[.]08[.]2022[.]exe hxxps://52[.]238[.]29[.]163/02[.]08[.]2022[.]exe hxxps://101[.]43[.]99[.]236:61443/02[.]08[.]2022[.]exe hxxps://47[.]113[.]217[.]92:8899/02[.]08[.]2022[.]exe hxxp://101[.]34[.]209[.]220:8099/02[.]08[.]2022[.]exe hxxps://43[.]138[.]246[.]207:8443/02[.]08[.]2022[.]exe hxxps://47[.]100[.]63[.]226:9977/02[.]08[.]2022[.]exe hxxps://101[.]201[.]247[.]232:4433/02[.]08[.]2022[.]exe hxxps://110[.]40[.]177[.]142:18443/02[.]08[.]2022[.]exe hxxp://154[.]223[.]20[.]231:801/02[.]08[.]2022[.]exe hxxps://124[.]71[.]152[.]79/02[.]08[.]2022[.]exe hxxps://8[.]131[.]50[.]94:46531/02[.]08[.]2022[.]exe hxxps://43[.]226[.]125[.]41:10443/02[.]08[.]2022[.]exe hxxps://43[.]246[.]208[.]199:8443/02[.]08[.]2022[.]exe hxxps://210[.]87[.]202[.]127/02[.]08[.]2022[.]exe hxxp://111[.]173[.]118[.]193:81/02[.]08[.]2022[.]exe hxxps://185[.]158[.]251[.]38:444/02[.]08[.]2022[.]exe hxxps://49[.]232[.]249[.]109:20443/02[.]08[.]2022[.]exe hxxps://117[.]50[.]181[.]189:10001/02[.]08[.]2022[.]exe hxxp://34[.]23[.]75[.]214:10443/02[.]08[.]2022[.]exe hxxp://47[.]116[.]27[.]92:8081/02[.]08[.]2022[.]exe hxxp://ylmcbeta-invite[.]bugmakerx[.]cn/02[.]08[.]2022[.]exe hxxp://yhgger[.]top/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://185[.]215[.]113[.]209/inc/dsds[.]exe hxxps://83[.]217[.]208[.]134/9fcc2685c3ccafd/mau3oarl[.]3v7qf hxxps://193[.]124[.]205[.]63:7390/1d7c07d7f0b063/xtt6wabb[.]8qt3e hxxps://83[.]217[.]208[.]134/9fcc2685c3ccafd/1gjc75ih[.]m8duc hxxps://83[.]217[.]208[.]134/9fcc2685c3ccafd/evhh1lph[.]0xkmk hxxps://83[.]217[.]208[.]134/9fcc2685c3ccafd/pa8qm8h9[.]hc0r5 hxxp://185[.]215[.]113[.]16/inc/europe123[.]exe hxxp://185[.]215[.]113[.]16/inc/nSoft[.]exe hxxp://185[.]215[.]113[.]209/inc/europe123[.]exe hxxp://185[.]215[.]113[.]209/inc/nSoft[.]exe hxxp://45[.]61[.]150[.]3/uploads/6754320458bc4_1stepa[.]exe hxxp://45[.]61[.]150[.]3/uploads/6738b50a04340_ranis[.]exe hxxp://45[.]61[.]150[.]3/uploads/67387c6f68f64_step[.]exe hxxp://45[.]61[.]150[.]3/uploads/67396a7a86935_rh_0[.]8[.]0[.]exe hxxp://45[.]61[.]150[.]3/uploads/67388f469af27_max[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/znkjdgnjsfjnrg[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zfesnthjns[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/ztksefyjsef[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zfkhleijadrg[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zperviy[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zptjhdawtijhse[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zptjdaejthse[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zkrtosdlth[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zajudrgsre[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zgthjrdsef[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zheffthasf[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zmbtdyjfdj[.]exe hxxps://github[.]com/rimase12/urika/raw/refs/heads/main/zotpfkesk[.]exe hxxp://45[.]61[.]150[.]3/uploads/673217ec3ab40_dghersmaxsfdt[.]exe hxxp://45[.]61[.]150[.]3/uploads/6739c39006922_fdyghbsrd[.]exe |
Rhadamanthys |
| URL | hxxp://185[.]215[.]113[.]209/inc/NorthSperm[.]exe | StormKitty |
| URL | hxxp://185[.]215[.]113[.]209/inc/SingerJudy[.]exe hxxp://185[.]215[.]113[.]209/inc/XClient_protected[.]exe hxxp://185[.]215[.]113[.]209/inc/AnneSalt[.]exe |
Venom RAT |
| URL | hxxp://185[.]215[.]113[.]209/inc/crypted8888[.]exe | Mars Stealer |
| URL | hxxp://185[.]215[.]113[.]209/inc/DCRatBuild[.]exe hxxp://185[.]215[.]113[.]209/inc/onlysteal[.]exe hxxp://185[.]215[.]113[.]209/inc/AI2[.]exe hxxp://45[.]61[.]150[.]3/uploads/674857771c8f9_chainintocrtdllsvc[.]exe hxxp://45[.]61[.]150[.]3/uploads/6739579c67c14_bridgemsdrivermonitor[.]exe hxxp://45[.]61[.]150[.]3/uploads/675091d4369df_RakBot[.]exe hxxp://45[.]61[.]150[.]3/uploads/674383a591a45_crypted[.]exe hxxp://306039cm[.]nyashcrack[.]top/geoGeneratorwordpresswpprivatetempDownloads[.]php |
DCRat |
| URL | hxxp://update[.]volam2005pk[.]com/hostfile/taptin/game[.]exe | Gozi |
| URL | hxxps://www[.]grupodulcemar[.]pe/factura098765678[.]exe hxxp://grupodulcemar[.]pe/factura098765678[.]exe hxxp://grupodulcemar[.]pe/DFSA0987789000PO[.]exe hxxp://www[.]grupodulcemar[.]pe/DFSA0987789000PO[.]exe |
LokiBot |
| URL | hxxps://www[.]grupodulcemar[.]pe/PHJG9876789000[.]exe hxxp://grupodulcemar[.]pe/FACTURA-09876RT567800[.]exe hxxp://grupodulcemar[.]pe/FACT0987789000900[.]exe hxxps://grupodulcemar[.]pe/PHJG9876789000[.]exe hxxps://api[.]telegram[.]org/bot7349048185:AAHLm8Aap_epDdcaT0ahDVTg27Uu0WBVu5s/sendMessage?chat_id=806477590 hxxps://www[.]grupodulcemar[.]pe/FACTURA-09876RT567800[.]exe hxxps://api[.]telegram[.]org/bot7692220058:AAEny12fSzuKXI7iNJaESECu5UR80nmwLAQ/sendMessage?chat_id=7342994424 hxxps://api[.]telegram[.]org/bot7971510363:AAH477ofdLYaboEb0PeeyOtbxApvVZT953M/sendMessage?chat_id=7405587880 hxxp://drdavidfishbein[.]com/files/cos[.]txt |
Snake Keylogger |
| URL | hxxp://87[.]120[.]84[.]39/txt/w1svdfWNYHVYMjK[.]exe hxxp://87[.]120[.]84[.]39/txt/agAWHfkktABCGLe[.]exe |
MASS Logger |
| URL | hxxp://185[.]215[.]113[.]16/inc/xao8gh38[.]exe hxxp://185[.]215[.]113[.]209/inc/xao8gh38[.]exe |
Panda Stealer |
| URL | hxxp://t[.]0000o[.]xyz:88/javaw[.]exe | Ghost RAT |
| URL | hxxps://quanlyphongnet[.]com/net/boot[.]exe | Cerbu |
| URL | hxxps://2ig[.]cs[.]alab01[.]de/payloads/v/m_x64_rev_tcp_unstaged_80[.]exe | Meterpreter |
| URL | hxxps://www[.]clubedasluluzinhasro[.]com[.]br/assets/image/inlandsPom[.]exe | Azorult |
| URL | hxxps://193[.]233[.]113[.]197/build/drop3[.]exe hxxp://193[.]233[.]113[.]197/build/drop3[.]exe |
Phemedrone Stealer |
| URL | hxxps://jitcom[.]info/work/index[.]php hxxps://jitcom[.]info/work/download[.]php hxxps://ynzal[.]com//wp-admin/maint/XRTTbATw[.]txt hxxps://jitcom[.]info/work/original[.]js hxxps://habfan[.]com/js[.]php hxxps://habfan[.]com/7y7hf3j[.]js hxxps://jitcom[.]info/work/yyy[.]zip hxxps://ynzal[.]com/wp-admin/maint/HHGBHYDN[.]txt hxxps://hil[.]material[.]amstillroofing[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxp://109[.]176[.]207[.]235/m68k hxxp://109[.]176[.]207[.]235/ppc hxxp://109[.]176[.]207[.]235/mips hxxp://109[.]176[.]207[.]235/sh4 hxxp://109[.]176[.]207[.]235/mipsel hxxp://109[.]176[.]207[.]235/co hxxp://109[.]176[.]207[.]235/x86 hxxp://109[.]176[.]207[.]235/dc hxxp://109[.]176[.]207[.]235/i686 hxxp://109[.]176[.]207[.]235/dss hxxp://109[.]176[.]207[.]235/586 hxxp://109[.]176[.]207[.]235/arm61 |
Bashlite |
| URL | hxxps://lordexploit[.]xyz/Lord_Exploit[.]exe | BlankGrabber |
| URL | hxxp://185[.]172[.]57[.]22/Private[.]txt[.]scr hxxp://185[.]172[.]57[.]22/Passwords[.]txt[.]scr hxxp://185[.]172[.]57[.]22/Lady%20Gaga[.]mp3[.]scr hxxp://185[.]172[.]57[.]22/Document[.]txt[.]scr hxxp://185[.]172[.]57[.]22/Me[.]jpg[.]scr hxxp://185[.]172[.]57[.]22/Porn[.]mp4[.]scr hxxp://185[.]172[.]57[.]22/Horror%20movie%202024[.]mp4[.]scr hxxp://185[.]172[.]57[.]22/Document_838929[.]txt[.]scr hxxp://185[.]172[.]57[.]22/2pac[.]mp3[.]scr |
Phorpiex |
| URL | hxxp://31[.]41[.]244[.]11/files/5996006993/Nr9Eazj[.]exe | Sliver |
