不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様9社 -
2024/12/11
※2024/12/11 更新
マルウェア感染させると考えられるURLを検知（2024/12/11）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]91[.]201[.]185/20aa6cac9e2233ef/nss3[.]dll hxxp://45[.]91[.]201[.]185/20aa6cac9e2233ef/vcruntime140[.]dll hxxp://45[.]91[.]201[.]185/20aa6cac9e2233ef/softokn3[.]dll hxxp://45[.]91[.]201[.]185/20aa6cac9e2233ef/mozglue[.]dll hxxp://45[.]91[.]201[.]185/20aa6cac9e2233ef/freebl3[.]dll hxxp://45[.]91[.]201[.]185/20aa6cac9e2233ef/msvcp140[.]dll hxxp://45[.]91[.]201[.]185/20aa6cac9e2233ef/sqlite3[.]dll hxxp://92[.]255[.]57[.]89/45c616e921a794b8[.]php hxxp://92[.]255[.]57[.]89/697b92cb4e247842/sqlite3[.]dll hxxp://92[.]255[.]57[.]89/697b92cb4e247842/nss3[.]dll hxxp://92[.]255[.]57[.]89/697b92cb4e247842/vcruntime140[.]dll hxxp://92[.]255[.]57[.]89/697b92cb4e247842/msvcp140[.]dll hxxp://92[.]255[.]57[.]89/697b92cb4e247842/mozglue[.]dll hxxp://92[.]255[.]57[.]89/697b92cb4e247842/softokn3[.]dll hxxp://92[.]255[.]57[.]89/697b92cb4e247842/freebl3[.]dll |
Stealc |
| URL | hxxp://31[.]41[.]244[.]11/files/7403972632/C1J7SVw[.]exe hxxp://185[.]215[.]113[.]16/inc/l3bevvn7[.]exe hxxp://185[.]215[.]113[.]209/inc/l3bevvn7[.]exe hxxp://185[.]215[.]113[.]16/inc/t8wl838w[.]exe hxxp://185[.]215[.]113[.]209/inc/t8wl838w[.]exe hxxp://45[.]61[.]150[.]3/uploads/672b5d47b8e05_Loader[.]exe |
Coinminer |
| URL | hxxp://185[.]215[.]113[.]16/inc/2v6wf6kn[.]exe hxxp://185[.]215[.]113[.]209/inc/2v6wf6kn[.]exe |
Panda Stealer |
| URL | hxxps://cococokeys[.]com/licenseUser[.]php | Satacom |
| URL | hxxp://154[.]216[.]18[.]25/Gd85kkjf/Login[.]php | Amadey |
| URL | hxxps://doqevue[.]shop/api hxxps://keqirai[.]shop/api hxxp://185[.]215[.]113[.]16/inc/k1de2zkz[.]exe hxxp://185[.]215[.]113[.]16/inc/kxfh9qhs[.]exe hxxp://193[.]233[.]113[.]197/build/drop1[.]exe hxxp://185[.]215[.]113[.]209/inc/5hvzv2sl[.]exe hxxp://185[.]215[.]113[.]16/inc/5hvzv2sl[.]exe hxxp://185[.]215[.]113[.]16/inc/quzfesaq[.]exe hxxp://185[.]215[.]113[.]16/inc/alex2025[.]exe hxxp://185[.]215[.]113[.]16/inc/x6uvjuko[.]exe hxxp://31[.]41[.]244[.]11/files/806475321/0tClIDb[.]exe hxxp://185[.]215[.]113[.]209/inc/alex2025[.]exe hxxps://193[.]233[.]113[.]197/build/drop1[.]exe hxxp://185[.]215[.]113[.]209/inc/x6uvjuko[.]exe hxxp://185[.]215[.]113[.]209/inc/kxfh9qhs[.]exe hxxp://185[.]215[.]113[.]209/inc/quzfesaq[.]exe hxxp://185[.]215[.]113[.]209/inc/k1de2zkz[.]exe hxxps://appear-guides[.]cyou/api hxxps://property-imper[.]sbs/api hxxps://classify-shed[.]biz/api hxxp://31[.]41[.]244[.]11/files/6904700471/Z9Pp9pM[.]exe hxxps://iplogger[.]ru/259Ja6 hxxps://onefreex[.]com/api/download hxxps://ythreefr[.]pro/?data=yasGqdCKgQbSTJ&pub_id=68&yes=1sXgxRp7bSCUa54cYQZJA2TjrfkGiz&site_id=64&made=xQViPK47Fuw5BYAJIW1T9fvrlUaLtkZqNGmdMHOCD26opb3gec hxxps://motionless-temper[.]cyou/api hxxps://adjust-cheek[.]cyou/api hxxps://shirk-home[.]cyou/api hxxps://nagurui[.]shop/api hxxps://mexocey[.]shop/api hxxps://lumcopiqua6[.]shop/api hxxps://kemuvao[.]shop/api |
Lumma Stealer |
| URL | hxxps://www[.]grupodulcemar[.]pe/HKP098767890HJ[.]exe hxxp://165[.]227[.]215[.]208/399/nhu/decrationevennotwhichcreatedbestthingswithnest_________creationheorsheisveryheissheisverygoodforme_____________ureffotbestthingswithgreatdayshudeeffrot[.]doc hxxp://87[.]106[.]68[.]207/777/hn/niceappearingforentireteamtogivebestthings_______thisisagoodfreedomforentirelifegivenmebestforneedbesthings_____suchagreatideaswithgreat[.]doc hxxp://172[.]245[.]142[.]60/466/wcc/matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive[.]hta |
Remcos |
| URL | hxxps://www[.]stipamana[.]com/pifzjsbfigsjnfgsdfgd/dthgsfgsdfghsfghsfdgfbdbgdsf/ghdfgsdfghsdbgfbhsdhgszdbsfbsgd/profile1[.]exe hxxps://www[.]stipamana[.]com/exextnpifzjsbcvghcvfigsjnfgsdfgd/dfgjhfgyjfthgsfgsdfghsfghsfdgfbdbgdsf/gcfygkfjghdfgsdfghsdbgfbhsdhgszdbsfbsgd/wrofile1[.]exe hxxps://www[.]stipamana[.]com/sondrgskdntsdnfkhntksdthdfyhdftsrthrsthstsgsrrgs/esdtjhdfhdhfhdxdghsdthjdtgsdrsergesdhfgtfdghf/ydfgthsfgsegrsergeawegtreafrgtrsgrsretgsgrgtrgsrgts/zseytrsgzetr[.]exe |
Warzone RAT |
| URL | hxxps://dragonhack[.]shop/loader[.]exe hxxp://86[.]110[.]212[.]203/geodle/image7Generatorrequest/track/central/4Protect82/universaluniversalPythonBetter/centralDump/8Phpmulti/5requestWindowsWindows/PythonSecuretrackGenerator/externaluniversalprovider/dle/dbProtect/ExternalHttpeternal/VideoauthprotectSqlDbwindowsflowerwplocal[.]php hxxp://45[.]61[.]150[.]3/uploads/6725190f7c163_crypted[.]exe |
DCRat |
| URL | hxxps://95[.]214[.]55[.]177:1689/e21adcd5478c6d21f12/jf923j9f[.]kd10d2 | Rhadamanthys |
| URL | hxxp://89[.]147[.]110[.]254/logsbins[.]sh hxxp://93[.]123[.]85[.]251/s-h[.]4-[.]Sakura hxxp://93[.]123[.]85[.]251/m-6[.]8-k[.]Sakura hxxp://93[.]123[.]85[.]251/Sakura[.]sh hxxp://93[.]123[.]85[.]251/m-p[.]s-l[.]Sakura hxxp://93[.]123[.]85[.]251/a-r[.]m-6[.]Sakura hxxp://93[.]123[.]85[.]251/a-r[.]m-4[.]Sakura hxxp://login-cb-reaktivierung[.]com/a-r[.]m-4[.]Sakura hxxp://bwg-kundenservice[.]cfd/m-6[.]8-k[.]Sakura hxxp://login-cb-reaktivierung[.]com/p-p[.]c-[.]Sakura hxxp://bwg-kundenservice[.]cfd/a-r[.]m-7[.]Sakura hxxp://93[.]123[.]85[.]251/p-p[.]c-[.]Sakura hxxp://login-cb-reaktivierung[.]com/x-3[.]2-[.]Sakura hxxp://bwg-kundenservice[.]cfd/x-3[.]2-[.]Sakura hxxp://login-cb-reaktivieren[.]com/m-p[.]s-l[.]Sakura hxxp://login-cb-reaktivieren[.]com/x-8[.]6-[.]Sakura hxxp://login-cb-reaktivierung[.]com/x-8[.]6-[.]Sakura hxxp://login-cb-reaktivierung[.]com/a-r[.]m-5[.]Sakura hxxp://login-cb-reaktivieren[.]com/a-r[.]m-5[.]Sakura hxxp://login-cb-reaktivierung[.]com/Sakura[.]sh hxxp://bwg-kundenservice[.]cfd/a-r[.]m-5[.]Sakura hxxp://bwg-kundenservice[.]cfd/s-h[.]4-[.]Sakura hxxp://bwg-kundenservice[.]cfd/i-5[.]8-6[.]Sakura hxxp://login-cb-reaktivieren[.]com/i-5[.]8-6[.]Sakura hxxp://bwg-kundenservice[.]cfd/x-8[.]6-[.]Sakura hxxp://login-cb-reaktivieren[.]com/a-r[.]m-6[.]Sakura hxxp://bwg-kundenservice[.]cfd/m-p[.]s-l[.]Sakura hxxp://login-cb-reaktivierung[.]com/a-r[.]m-6[.]Sakura hxxp://login-cb-reaktivierung[.]com/m-6[.]8-k[.]Sakura hxxp://bwg-kundenservice[.]cfd/Sakura[.]sh hxxp://login-cb-reaktivieren[.]com/Sakura[.]sh hxxp://login-cb-reaktivierung[.]com/s-h[.]4-[.]Sakura hxxp://login-cb-reaktivieren[.]com/a-r[.]m-7[.]Sakura hxxp://login-cb-reaktivierung[.]com/a-r[.]m-7[.]Sakura hxxp://93[.]123[.]85[.]251/x-8[.]6-[.]Sakura hxxp://93[.]123[.]85[.]251/x-3[.]2-[.]Sakura hxxp://login-cb-reaktivieren[.]com/x-3[.]2-[.]Sakura hxxp://93[.]123[.]85[.]251/m-i[.]p-s[.]Sakura hxxp://bwg-kundenservice[.]cfd/a-r[.]m-4[.]Sakura hxxp://bwg-kundenservice[.]cfd/p-p[.]c-[.]Sakura hxxp://93[.]123[.]85[.]251/a-r[.]m-5[.]Sakura hxxp://login-cb-reaktivierung[.]com/m-i[.]p-s[.]Sakura hxxp://93[.]123[.]85[.]251/i-5[.]8-6[.]Sakura hxxp://login-cb-reaktivieren[.]com/p-p[.]c-[.]Sakura hxxp://login-cb-reaktivierung[.]com/i-5[.]8-6[.]Sakura hxxp://login-cb-reaktivieren[.]com/m-6[.]8-k[.]Sakura hxxp://login-cb-reaktivieren[.]com/a-r[.]m-4[.]Sakura hxxp://bwg-kundenservice[.]cfd/a-r[.]m-6[.]Sakura hxxp://login-cb-reaktivieren[.]com/s-h[.]4-[.]Sakura hxxp://login-cb-reaktivierung[.]com/m-p[.]s-l[.]Sakura hxxp://bwg-kundenservice[.]cfd/m-i[.]p-s[.]Sakura hxxp://login-cb-reaktivieren[.]com/m-i[.]p-s[.]Sakura hxxp://93[.]123[.]85[.]251/a-r[.]m-7[.]Sakura hxxp://199[.]247[.]21[.]217/bot[.]ppc hxxp://199[.]247[.]21[.]217/bot[.]m68k |
Bashlite |
| URL | hxxp://31[.]41[.]244[.]11/files/1521297942/H3tyh96[.]exe hxxp://172[.]233[.]139[.]5/KrnlSetup[.]exe hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/ENVS/DS7[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/ENVS/DS6[.]txt |
AsyncRAT |
| URL | hxxp://87[.]120[.]117[.]203/dog[.]exe | NjRAT |
| URL | hxxps://myguyapp[.]com/c2[.]bat hxxps://myguyapp[.]com/c2[.]hta |
XWorm |
| URL | hxxp://212[.]162[.]149[.]66/KtFSlX90[.]bin hxxp://212[.]162[.]149[.]66/JiYpNWaslXZHcEPiPEuXaEONVju173[.]bin hxxp://212[.]162[.]149[.]89/KSMZNlmay152[.]bin hxxp://212[.]162[.]149[.]89/xONeIbG151[.]bin hxxp://212[.]162[.]149[.]89/wwVHOGRH148[.]bin |
CloudEyE |
| URL | hxxp://mngfilesamp[.]site/radmir[.]exe | PureLogs Stealer |
| URL | hxxps://as4d768db37e5e2f5a7fbc0fe1fee5b311[.]com/YzhkZjQwNDRkN2Uy/ hxxps://4d768db37e5e2f5a7fbc0fe1fee5b311[.]com/YzhkZjQwNDRkN2Uy/ hxxps://44768db37e5e2f5a7fbc0fe1fee5b311[.]com/YzhkZjQwNDRkN2Uy/ hxxps://466db37e5e2f5a7fbc0fe1fee5b311[.]com/YzhkZjQwNDRkN2Uy/ |
Coper |
| URL | hxxp://keikochio[.]com/staz/gribs[.]zip hxxps://cycleconf[.]com/dwnld/2nd2_2[.]zip hxxps://cycleconf[.]com/dwnld/1st2_4[.]zip hxxps://cycleconf[.]com/dwnld/2nd2_3[.]zip hxxps://cycleconf[.]com/dwnld/2nd2_1[.]zip hxxps://cycleconf[.]com/dwnld/1st2_3[.]zip hxxps://cycleconf[.]com/dwnld/2nd2_4[.]zip hxxps://cycleconf[.]com/dwnld/1st2_2[.]zip |
NetSupportManager RAT |
| URL | hxxps://dechromo[.]com/wsjr617h[.]js hxxps://dechromo[.]com/js[.]php hxxps://lamartesana[.]info/work/index[.]php hxxps://lamartesana[.]info/work/original[.]js hxxps://lamartesana[.]info/work/download[.]php hxxps://lamartesana[.]info/work/yyy[.]zip hxxps://selbe[.]ar/wp-admin/maint/sMNGmQIh[.]txt |
FAKEUPDATES |
| URL | hxxp://94[.]159[.]113[.]204:8888/116471747828940[.]dll | StrelaStealer |
| URL | hxxp://125[.]43[.]80[.]251:54583/bin[.]sh hxxp://124[.]95[.]101[.]51:52113/bin[.]sh hxxp://221[.]15[.]195[.]66:52559/bin[.]sh hxxp://182[.]127[.]124[.]237:44919/bin[.]sh hxxp://59[.]88[.]236[.]119:56033/bin[.]sh hxxp://124[.]235[.]240[.]119:59257/bin[.]sh hxxp://49[.]72[.]96[.]6:44468/i hxxp://115[.]49[.]31[.]231:55308/i hxxp://175[.]175[.]205[.]253:50444/i hxxp://124[.]95[.]17[.]176:36261/i hxxp://42[.]87[.]151[.]12:38796/bin[.]sh hxxp://42[.]227[.]177[.]206:41587/i hxxp://123[.]13[.]165[.]191:38890/bin[.]sh hxxp://42[.]235[.]83[.]131:42522/i hxxp://123[.]9[.]101[.]41:60122/bin[.]sh hxxp://222[.]137[.]145[.]244:43595/bin[.]sh hxxp://175[.]30[.]116[.]97:53017/i hxxp://42[.]227[.]177[.]206:41587/bin[.]sh hxxp://123[.]5[.]148[.]225:57604/i hxxp://110[.]182[.]215[.]125:51129/i hxxp://115[.]50[.]0[.]138:44819/bin[.]sh hxxp://124[.]131[.]36[.]232:57467/i hxxp://42[.]243[.]138[.]141:41787/i hxxp://119[.]179[.]249[.]71:42275/i hxxp://42[.]242[.]10[.]4:37112/i hxxp://110[.]182[.]8[.]171:36962/i hxxp://222[.]137[.]80[.]21:33982/bin[.]sh hxxp://61[.]52[.]59[.]32:59567/bin[.]sh hxxp://115[.]58[.]86[.]88:39970/i hxxp://60[.]23[.]77[.]246:38513/i hxxp://1[.]70[.]184[.]139:43832/i hxxp://182[.]127[.]122[.]30:43304/i hxxp://1[.]70[.]99[.]35:36187/i hxxp://113[.]24[.]151[.]243:50004/i hxxp://39[.]89[.]190[.]166:58114/i hxxp://82[.]200[.]248[.]206:56952/bin[.]sh hxxp://42[.]7[.]199[.]193:55964/i hxxp://60[.]23[.]76[.]73:45544/i hxxp://115[.]62[.]154[.]235:55411/i hxxp://221[.]230[.]38[.]202:25625/i hxxp://117[.]209[.]241[.]149:58983/i hxxp://123[.]4[.]195[.]76:34438/i hxxp://223[.]10[.]70[.]98:54889/i hxxp://115[.]49[.]31[.]231:55308/bin[.]sh hxxp://67[.]214[.]245[.]59:51986/i hxxp://175[.]147[.]157[.]79:36147/i hxxp://42[.]180[.]9[.]149:50026/i hxxp://117[.]196[.]162[.]65:58421/i hxxp://116[.]140[.]175[.]214:54785/i hxxp://221[.]225[.]58[.]103:33600/i hxxp://175[.]175[.]205[.]253:50444/bin[.]sh hxxp://117[.]87[.]65[.]94:37825/i hxxp://218[.]61[.]230[.]222:54640/i hxxp://117[.]199[.]28[.]215:55844/i hxxp://58[.]47[.]105[.]20:49008/bin[.]sh hxxp://27[.]37[.]24[.]19:53422/bin[.]sh hxxp://123[.]5[.]148[.]225:57604/bin[.]sh hxxp://61[.]0[.]181[.]46:47815/i hxxp://175[.]30[.]116[.]97:53017/bin[.]sh hxxp://123[.]185[.]109[.]25:42096/i hxxp://119[.]179[.]198[.]21:48047/i hxxp://221[.]202[.]191[.]96:37174/i hxxp://114[.]238[.]67[.]252:52936/i hxxp://123[.]4[.]242[.]12:50124/i hxxp://113[.]228[.]45[.]69:51389/i hxxp://42[.]239[.]114[.]112:40485/i hxxp://27[.]215[.]84[.]21:49191/i hxxp://223[.]151[.]73[.]146:34084/i hxxp://113[.]229[.]191[.]206:36793/i hxxp://1[.]70[.]177[.]102:37915/i hxxp://182[.]113[.]39[.]240:36787/bin[.]sh hxxp://213[.]100[.]213[.]47:40994/i hxxp://110[.]182[.]251[.]138:53938/i hxxp://113[.]25[.]213[.]126:45366/i hxxp://222[.]139[.]34[.]215:58474/bin[.]sh hxxp://123[.]135[.]236[.]89:49522/i hxxp://192[.]176[.]50[.]190:33952/i hxxp://168[.]195[.]81[.]1:39444/i hxxp://49[.]72[.]96[.]6:44468/bin[.]sh hxxp://124[.]131[.]36[.]232:57467/bin[.]sh hxxp://200[.]59[.]85[.]116:33108/i hxxp://175[.]174[.]72[.]147:36012/i hxxp://42[.]235[.]83[.]131:42522/bin[.]sh hxxp://223[.]8[.]215[.]108:59468/i hxxp://163[.]142[.]95[.]34:41347/i hxxp://113[.]26[.]154[.]72:40362/i hxxp://222[.]188[.]185[.]203:47760/i hxxp://42[.]178[.]97[.]54:58224/i hxxp://123[.]12[.]24[.]230:51704/i hxxp://119[.]115[.]48[.]215:60921/i hxxp://42[.]4[.]117[.]204:33722/i hxxp://113[.]222[.]146[.]31:56559/i hxxp://119[.]179[.]249[.]71:42275/bin[.]sh hxxp://42[.]86[.]121[.]248:45564/i hxxp://123[.]14[.]115[.]38:43462/i hxxp://27[.]215[.]51[.]97:53253/i hxxp://221[.]225[.]235[.]253:58506/i hxxp://42[.]55[.]23[.]168:50049/i hxxp://175[.]31[.]228[.]178:36056/i hxxp://42[.]57[.]255[.]222:46034/i hxxp://61[.]53[.]110[.]123:54602/bin[.]sh hxxp://27[.]37[.]89[.]135:50109/i hxxp://42[.]54[.]131[.]167:45050/bin[.]sh hxxp://115[.]55[.]138[.]152:40943/i hxxp://115[.]50[.]65[.]47:36244/i hxxp://60[.]19[.]221[.]4:38764/i hxxp://223[.]13[.]82[.]9:54296/i hxxp://119[.]189[.]236[.]196:58341/i hxxp://124[.]45[.]19[.]159:60005/i hxxp://175[.]173[.]61[.]150:50092/i hxxp://45[.]186[.]52[.]185:41085/i hxxp://42[.]57[.]217[.]38:33655/i hxxp://175[.]165[.]90[.]9:52490/i hxxp://113[.]229[.]85[.]102:46737/i hxxp://115[.]56[.]13[.]16:51105/i hxxp://61[.]52[.]156[.]230:38464/i hxxp://60[.]23[.]76[.]73:45544/bin[.]sh hxxp://83[.]249[.]236[.]177:50011/i hxxp://42[.]56[.]141[.]222:40856/i hxxp://115[.]52[.]17[.]227:47826/i hxxp://113[.]228[.]158[.]193:33263/i hxxp://182[.]127[.]179[.]192:46571/i hxxp://112[.]113[.]221[.]103:40470/i hxxp://42[.]230[.]213[.]254:39025/i hxxp://109[.]248[.]235[.]149:60158/i hxxp://115[.]58[.]171[.]37:45469/i hxxp://82[.]200[.]248[.]206:56952/i hxxp://42[.]56[.]138[.]124:40227/i hxxp://124[.]94[.]69[.]180:34391/i hxxp://81[.]26[.]81[.]234:45223/i hxxp://42[.]52[.]243[.]127:46648/i hxxp://112[.]248[.]185[.]107:53199/i hxxp://42[.]224[.]209[.]187:35810/i hxxp://220[.]201[.]32[.]89:53407/i hxxp://188[.]150[.]42[.]185:47598/i hxxp://188[.]150[.]45[.]193:34358/i hxxp://218[.]61[.]230[.]222:54640/bin[.]sh hxxp://113[.]0[.]48[.]178:46718/i hxxp://115[.]55[.]219[.]174:55000/i hxxp://113[.]239[.]251[.]102:49310/i hxxp://88[.]88[.]147[.]126:3320/i hxxp://175[.]173[.]191[.]168:57074/i hxxp://188[.]149[.]139[.]44:45582/i hxxp://175[.]146[.]228[.]83:33347/i hxxp://83[.]253[.]55[.]207:48793/i hxxp://200[.]59[.]85[.]137:60519/i hxxp://113[.]27[.]29[.]3:49694/i hxxp://175[.]150[.]177[.]187:38493/i hxxp://112[.]248[.]114[.]36:57858/i hxxp://123[.]4[.]207[.]48:42456/i hxxp://115[.]55[.]61[.]129:45681/i hxxp://175[.]150[.]73[.]51:58277/i hxxp://115[.]59[.]63[.]57:57574/i hxxp://42[.]225[.]196[.]36:34645/i hxxp://110[.]183[.]51[.]114:34881/bin[.]sh hxxp://175[.]175[.]24[.]181:36078/i hxxp://123[.]11[.]79[.]191:53933/i hxxp://42[.]232[.]25[.]80:33002/i hxxp://116[.]101[.]91[.]129:57656/i hxxp://113[.]231[.]211[.]230:32835/i hxxp://39[.]65[.]204[.]194:49881/i hxxp://113[.]236[.]33[.]201:35717/i hxxp://116[.]138[.]209[.]47:35579/bin[.]sh hxxp://77[.]125[.]241[.]132:52311/i hxxp://42[.]58[.]217[.]69:41391/i hxxp://42[.]5[.]230[.]38:55387/i hxxp://221[.]202[.]209[.]170:49038/i hxxp://123[.]135[.]236[.]89:49522/bin[.]sh hxxp://42[.]6[.]197[.]110:38748/i hxxp://182[.]119[.]229[.]47:47067/i hxxp://182[.]126[.]123[.]61:38524/i hxxp://123[.]12[.]20[.]54:50904/i hxxp://123[.]175[.]66[.]169:39980/i hxxp://42[.]230[.]39[.]147:40973/bin[.]sh hxxp://190[.]109[.]227[.]23:39295/i hxxp://115[.]63[.]9[.]136:49149/i hxxp://68[.]115[.]131[.]242:44024/i hxxp://113[.]26[.]95[.]127:56656/i hxxp://39[.]73[.]60[.]252:59225/i hxxp://27[.]37[.]105[.]200:38016/i hxxp://115[.]50[.]227[.]55:42724/i hxxp://125[.]44[.]33[.]51:38382/i hxxp://123[.]13[.]165[.]191:38890/i hxxp://223[.]13[.]56[.]56:35346/i hxxp://42[.]231[.]217[.]170:60373/i hxxp://182[.]119[.]228[.]71:34233/i hxxp://72[.]180[.]130[.]39:40481/bin[.]sh hxxp://115[.]55[.]42[.]83:40066/i hxxp://27[.]215[.]181[.]98:39050/i hxxp://39[.]73[.]205[.]152:35387/i hxxp://106[.]41[.]51[.]45:38124/i hxxp://209[.]16[.]67[.]24:3739/i hxxp://223[.]13[.]82[.]9:54296/bin[.]sh hxxp://115[.]62[.]158[.]86:32875/i hxxp://175[.]149[.]110[.]241:58851/i hxxp://27[.]223[.]162[.]5:60578/i hxxp://115[.]49[.]251[.]191:35530/i hxxp://113[.]238[.]98[.]61:49922/i hxxp://109[.]58[.]130[.]86:49402/bin[.]sh hxxp://117[.]196[.]162[.]65:58421/bin[.]sh hxxp://117[.]81[.]45[.]146:55263/i hxxp://60[.]18[.]85[.]137:42653/i hxxp://113[.]236[.]254[.]83:44636/i hxxp://42[.]57[.]242[.]116:39347/i hxxp://222[.]138[.]103[.]46:49228/i hxxp://39[.]79[.]136[.]163:47069/i hxxp://182[.]117[.]26[.]30:47202/i hxxp://14[.]168[.]188[.]136:38849/i hxxp://42[.]224[.]30[.]131:52830/i hxxp://115[.]58[.]86[.]88:39970/bin[.]sh hxxp://96[.]33[.]218[.]253:59821/i hxxp://115[.]56[.]7[.]48:47553/i hxxp://223[.]8[.]217[.]120:39842/i hxxp://42[.]242[.]10[.]4:37112/bin[.]sh hxxp://125[.]40[.]154[.]180:48530/i hxxp://113[.]26[.]181[.]34:51920/i hxxp://113[.]26[.]87[.]3:60420/i hxxp://27[.]215[.]87[.]241:41097/i hxxp://188[.]151[.]133[.]177:48122/i hxxp://117[.]215[.]212[.]62:55462/i hxxp://216[.]247[.]214[.]225:3213/i hxxp://182[.]112[.]53[.]7:57047/i hxxp://74[.]83[.]55[.]56:3481/i hxxp://175[.]174[.]76[.]173:37336/i hxxp://112[.]248[.]187[.]208:43771/i hxxp://175[.]165[.]115[.]126:35682/i hxxp://219[.]157[.]166[.]104:43007/i hxxp://110[.]182[.]120[.]137:37375/i hxxp://117[.]200[.]94[.]165:34465/i hxxp://113[.]231[.]222[.]197:49310/i hxxp://42[.]55[.]96[.]174:34115/i hxxp://182[.]118[.]154[.]46:33519/i hxxp://90[.]230[.]28[.]6:51459/i hxxp://42[.]7[.]138[.]203:55879/i hxxp://223[.]12[.]4[.]247:34805/i hxxp://115[.]55[.]184[.]167:38734/i hxxp://115[.]62[.]154[.]235:55411/bin[.]sh hxxp://221[.]14[.]10[.]150:53250/bin[.]sh hxxp://175[.]174[.]87[.]91:51018/i hxxp://61[.]52[.]75[.]251:34615/i hxxp://42[.]234[.]130[.]49:57283/i hxxp://72[.]180[.]130[.]39:40481/i hxxp://60[.]18[.]85[.]243:49067/i hxxp://117[.]242[.]237[.]22:55329/bin[.]sh hxxp://123[.]13[.]108[.]226:60117/i hxxp://60[.]23[.]141[.]105:45113/i hxxp://123[.]188[.]84[.]19:54141/i hxxp://123[.]175[.]55[.]253:43985/i hxxp://60[.]18[.]8[.]85:37201/i hxxp://5[.]59[.]106[.]115:41048/i hxxp://87[.]110[.]33[.]130:38028/i hxxp://113[.]26[.]177[.]152:44642/bin[.]sh hxxp://46[.]8[.]46[.]114:35372/i hxxp://221[.]15[.]187[.]248:40912/i hxxp://117[.]199[.]28[.]215:55844/bin[.]sh hxxp://116[.]138[.]209[.]47:35579/i hxxp://42[.]226[.]76[.]221:35899/i hxxp://115[.]55[.]57[.]23:39306/i hxxp://179[.]42[.]74[.]137:53170/i hxxp://112[.]248[.]187[.]184:34653/i hxxp://138[.]207[.]174[.]248:36448/i hxxp://124[.]234[.]246[.]127:56111/i hxxp://110[.]183[.]56[.]43:34398/i hxxp://221[.]15[.]197[.]32:57595/i hxxp://115[.]63[.]8[.]51:47486/i hxxp://110[.]183[.]51[.]114:34881/i hxxp://119[.]117[.]161[.]182:57952/i hxxp://103[.]175[.]188[.]36:43885/i hxxp://27[.]215[.]82[.]29:52546/i hxxp://39[.]90[.]146[.]217:39970/i hxxp://200[.]59[.]85[.]90:59937/i hxxp://39[.]74[.]33[.]226:54515/i hxxp://175[.]165[.]129[.]32:47330/i hxxp://180[.]115[.]122[.]164:56150/i hxxp://112[.]248[.]108[.]151:38023/i hxxp://42[.]59[.]229[.]127:49421/i hxxp://117[.]209[.]85[.]1:33449/i hxxp://164[.]163[.]25[.]225:60619/i hxxp://187[.]49[.]145[.]6:11771/i hxxp://217[.]208[.]108[.]46:44392/i hxxp://61[.]53[.]149[.]254:50351/i hxxp://117[.]209[.]241[.]10:47897/i hxxp://61[.]53[.]91[.]56:33761/i hxxp://1[.]70[.]160[.]40:39469/i hxxp://42[.]85[.]212[.]65:43636/i hxxp://182[.]121[.]52[.]240:44144/bin[.]sh hxxp://185[.]248[.]12[.]157:47471/i hxxp://115[.]58[.]148[.]14:48642/i hxxp://24[.]96[.]184[.]50:56088/i hxxp://200[.]59[.]85[.]238:49868/i hxxp://61[.]53[.]110[.]123:54602/i hxxp://175[.]173[.]25[.]230:33471/i hxxp://222[.]137[.]80[.]21:33982/i hxxp://123[.]13[.]49[.]148:41806/i hxxp://42[.]230[.]52[.]57:58870/i hxxp://223[.]15[.]55[.]17:33575/i hxxp://60[.]19[.]151[.]165:46343/i hxxp://182[.]127[.]108[.]91:54249/i hxxp://59[.]187[.]205[.]72:3946/i hxxp://188[.]150[.]21[.]103:60199/i hxxp://182[.]120[.]61[.]85:59769/i hxxp://42[.]230[.]33[.]251:34172/i hxxp://175[.]147[.]158[.]223:54760/i hxxp://112[.]235[.]163[.]193:52057/i hxxp://61[.]53[.]149[.]254:50351/bin[.]sh hxxp://117[.]255[.]189[.]171:50004/i hxxp://123[.]190[.]31[.]51:40706/i hxxp://223[.]10[.]70[.]98:54889/bin[.]sh hxxp://27[.]202[.]180[.]8:33886/i hxxp://59[.]88[.]232[.]223:38867/i hxxp://27[.]223[.]162[.]5:60578/bin[.]sh hxxp://175[.]151[.]117[.]147:52678/i hxxp://116[.]248[.]10[.]137:40180/bin[.]sh hxxp://125[.]45[.]58[.]30:58260/i hxxp://42[.]55[.]23[.]168:50049/bin[.]sh hxxp://182[.]127[.]124[.]237:44919/i hxxp://111[.]70[.]24[.]154:48214/bin[.]sh hxxp://27[.]19[.]152[.]246:43113/bin[.]sh hxxp://59[.]98[.]199[.]0:40544/bin[.]sh hxxp://5[.]191[.]21[.]161:60833/bin[.]sh hxxp://113[.]26[.]93[.]6:60728/i hxxp://110[.]183[.]51[.]210:47657/bin[.]sh hxxp://42[.]179[.]48[.]42:36250/i hxxp://59[.]88[.]236[.]119:56033/i hxxp://216[.]244[.]203[.]24:40126/i hxxp://115[.]49[.]30[.]41:38613/bin[.]sh hxxp://175[.]173[.]61[.]150:50092/bin[.]sh hxxp://42[.]87[.]151[.]12:38796/i hxxp://14[.]168[.]188[.]136:38849/bin[.]sh hxxp://5[.]59[.]106[.]115:41048/bin[.]sh hxxp://123[.]9[.]101[.]41:60122/i hxxp://117[.]208[.]28[.]111:44307/bin[.]sh hxxp://27[.]207[.]202[.]175:53523/bin[.]sh hxxp://42[.]228[.]218[.]124:50646/bin[.]sh hxxp://180[.]115[.]87[.]144:38074/i hxxp://222[.]139[.]34[.]215:58474/i hxxp://182[.]114[.]32[.]179:60572/bin[.]sh hxxp://117[.]255[.]189[.]171:50004/bin[.]sh hxxp://42[.]7[.]237[.]139:54172/i hxxp://59[.]88[.]232[.]223:38867/bin[.]sh hxxp://221[.]14[.]160[.]6:32861/i hxxp://60[.]23[.]227[.]217:46597/i hxxp://182[.]127[.]101[.]10:38247/bin[.]sh hxxp://113[.]238[.]164[.]236:48928/bin[.]sh hxxp://113[.]238[.]179[.]43:35385/bin[.]sh hxxp://163[.]142[.]94[.]4:33223/i hxxp://200[.]59[.]85[.]90:59937/bin[.]sh hxxp://113[.]27[.]29[.]3:49694/bin[.]sh hxxp://119[.]185[.]160[.]25:53172/bin[.]sh hxxp://113[.]168[.]89[.]20:38344/bin[.]sh hxxp://42[.]230[.]52[.]57:58870/bin[.]sh hxxp://42[.]235[.]187[.]61:48092/bin[.]sh hxxp://125[.]41[.]5[.]227:59387/bin[.]sh hxxp://182[.]126[.]123[.]61:38524/bin[.]sh hxxp://42[.]54[.]131[.]167:45050/i hxxp://222[.]137[.]144[.]135:50382/i hxxp://61[.]52[.]59[.]32:59567/i hxxp://61[.]3[.]24[.]70:57753/i hxxp://117[.]216[.]85[.]162:51206/bin[.]sh hxxp://42[.]57[.]242[.]116:39347/bin[.]sh hxxp://179[.]42[.]74[.]137:53170/bin[.]sh hxxp://42[.]7[.]237[.]139:54172/bin[.]sh hxxp://115[.]50[.]0[.]138:44819/i hxxp://60[.]18[.]8[.]85:37201/bin[.]sh hxxp://124[.]95[.]101[.]51:52113/i hxxp://124[.]235[.]240[.]119:59257/i hxxp://222[.]137[.]145[.]244:43595/i hxxp://221[.]15[.]195[.]66:52559/i hxxp://102[.]207[.]138[.]151:58193/i hxxp://113[.]26[.]177[.]152:44642/i hxxp://1[.]70[.]140[.]182:38029/i hxxp://180[.]115[.]87[.]144:38074/bin[.]sh hxxp://175[.]146[.]227[.]210:48198/bin[.]sh hxxp://115[.]48[.]152[.]58:37021/i hxxp://219[.]157[.]50[.]188:46277/bin[.]sh hxxp://42[.]59[.]229[.]127:49421/bin[.]sh hxxp://222[.]168[.]236[.]231:34837/i hxxp://123[.]13[.]164[.]143:59827/i hxxp://27[.]37[.]82[.]179:56102/i hxxp://182[.]122[.]195[.]237:36567/bin[.]sh hxxp://110[.]182[.]184[.]157:40854/i hxxp://27[.]19[.]152[.]246:43113/i hxxp://42[.]230[.]139[.]221:52434/i hxxp://1[.]70[.]124[.]96:41622/bin[.]sh hxxp://59[.]88[.]0[.]185:38438/bin[.]sh hxxp://117[.]242[.]252[.]146:34309/bin[.]sh hxxp://125[.]41[.]5[.]227:59387/i hxxp://222[.]185[.]73[.]78:49194/bin[.]sh hxxp://27[.]202[.]179[.]104:33886/i hxxp://42[.]228[.]218[.]124:50646/i hxxp://221[.]202[.]18[.]220:49839/bin[.]sh hxxp://175[.]148[.]52[.]37:44440/bin[.]sh hxxp://120[.]61[.]70[.]179:46089/bin[.]sh hxxp://118[.]44[.]144[.]198:4403/i hxxp://42[.]230[.]139[.]221:52434/bin[.]sh hxxp://113[.]238[.]164[.]236:48928/i hxxp://42[.]235[.]187[.]61:48092/i hxxp://42[.]4[.]117[.]204:33722/bin[.]sh hxxp://115[.]48[.]152[.]58:37021/bin[.]sh hxxp://113[.]168[.]89[.]20:38344/i hxxp://222[.]168[.]236[.]231:34837/bin[.]sh hxxp://175[.]173[.]84[.]77:58340/bin[.]sh hxxp://219[.]157[.]189[.]41:41832/bin[.]sh hxxp://123[.]12[.]24[.]230:51704/bin[.]sh hxxp://1[.]70[.]177[.]102:37915/bin[.]sh hxxp://117[.]222[.]249[.]24:51573/bin[.]sh hxxp://175[.]148[.]52[.]37:44440/i hxxp://117[.]255[.]188[.]15:34982/bin[.]sh hxxp://124[.]163[.]185[.]34:11698/i hxxp://221[.]202[.]18[.]220:49839/i hxxp://59[.]88[.]0[.]185:38438/i hxxp://113[.]228[.]158[.]193:33263/bin[.]sh hxxp://120[.]61[.]70[.]179:46089/i hxxp://109[.]248[.]235[.]149:60158/bin[.]sh hxxp://36[.]49[.]51[.]104:46245/bin[.]sh hxxp://116[.]240[.]168[.]144:45419/i hxxp://113[.]231[.]211[.]230:32835/bin[.]sh hxxp://1[.]70[.]16[.]90:47668/bin[.]sh hxxp://27[.]202[.]178[.]234:33886/i hxxp://113[.]236[.]157[.]219:60453/bin[.]sh hxxp://42[.]56[.]141[.]222:40856/bin[.]sh hxxp://182[.]127[.]180[.]250:33193/bin[.]sh hxxp://222[.]140[.]163[.]197:45300/bin[.]sh hxxp://175[.]146[.]227[.]210:48198/i hxxp://60[.]9[.]214[.]188:47379/bin[.]sh hxxp://219[.]155[.]203[.]133:39973/bin[.]sh hxxp://219[.]157[.]189[.]41:41832/i hxxp://110[.]182[.]120[.]137:37375/bin[.]sh hxxp://115[.]52[.]5[.]130:51529/i hxxp://1[.]70[.]124[.]96:41622/i hxxp://117[.]199[.]59[.]170:48900/bin[.]sh hxxp://125[.]44[.]33[.]51:38382/bin[.]sh hxxp://219[.]157[.]50[.]188:46277/i hxxp://123[.]8[.]57[.]125:49911/i hxxp://113[.]236[.]157[.]219:60453/i hxxp://182[.]123[.]211[.]12:46430/bin[.]sh hxxp://60[.]21[.]172[.]217:39137/bin[.]sh hxxp://61[.]54[.]70[.]53:35776/bin[.]sh hxxp://117[.]209[.]81[.]228:41901/bin[.]sh hxxp://221[.]1[.]158[.]104:49398/bin[.]sh hxxp://27[.]221[.]225[.]79:48077/bin[.]sh hxxp://117[.]255[.]188[.]15:34982/i hxxp://27[.]202[.]171[.]98:46397/bin[.]sh hxxp://115[.]56[.]159[.]60:43100/bin[.]sh hxxp://110[.]183[.]23[.]202:49898/bin[.]sh hxxp://175[.]148[.]87[.]219:33892/bin[.]sh hxxp://85[.]105[.]33[.]198:43587/i hxxp://39[.]79[.]136[.]163:47069/bin[.]sh hxxp://60[.]9[.]214[.]188:47379/i hxxp://182[.]127[.]180[.]250:33193/i hxxp://42[.]178[.]227[.]160:45192/bin[.]sh hxxp://117[.]254[.]101[.]126:48023/i hxxp://115[.]55[.]61[.]129:45681/bin[.]sh hxxp://125[.]41[.]187[.]11:56627/bin[.]sh hxxp://219[.]155[.]203[.]133:39973/i hxxp://198[.]2[.]94[.]34:58603/bin[.]sh hxxp://175[.]147[.]216[.]4:55161/bin[.]sh hxxp://117[.]209[.]91[.]146:35337/bin[.]sh hxxp://82[.]50[.]89[.]53:33129/bin[.]sh hxxp://182[.]123[.]245[.]194:40063/bin[.]sh hxxp://60[.]21[.]172[.]217:39137/i hxxp://221[.]1[.]158[.]104:49398/i hxxp://175[.]165[.]81[.]186:35601/bin[.]sh hxxp://115[.]56[.]159[.]60:43100/i hxxp://27[.]221[.]225[.]79:48077/i hxxp://42[.]243[.]142[.]124:57791/bin[.]sh hxxp://117[.]209[.]81[.]228:41901/i hxxp://117[.]209[.]95[.]31:45283/i hxxp://121[.]239[.]136[.]84:40081/bin[.]sh hxxp://110[.]183[.]23[.]202:49898/i hxxp://36[.]49[.]51[.]104:46245/i hxxp://117[.]209[.]84[.]238:47498/Mozi[.]m |
Mozi |
| URL | hxxp://195[.]230[.]23[.]72:8085/svchosts[.]exe hxxp://195[.]230[.]23[.]72:8085/5dismhost[.]exe hxxp://195[.]230[.]23[.]72:8085/4dismhost[.]exe hxxp://195[.]230[.]23[.]72:8085/6dismhost[.]exe hxxp://195[.]230[.]23[.]72:8085/3dismhost[.]exe |
Cobalt Strike |
| URL | hxxp://195[.]230[.]23[.]72:8085/any_dsk[.]exe | Babadeda |
| URL | hxxps://www[.]grupodulcemar[.]pe/5MHIOPXJKTPrNvo[.]exe | Snake Keylogger |
| URL | hxxps://200[.]9[.]154[.]61/APP/136BET[.]apk hxxps://200[.]9[.]154[.]61/APP/CNC[.]apk hxxps://200[.]9[.]154[.]61/APP/HHBET[.]apk hxxps://200[.]9[.]154[.]61/APP/ONLYFANS[.]apk hxxps://200[.]9[.]154[.]61/APP/hide[.]apk |
SpyMax |
| URL | hxxp://www[.]stipamana[.]com/jedrshyyjdft/Panel/five/fre[.]php | LokiBot |
| URL | hxxp://89[.]197[.]154[.]116:7810/Dgh61oy-x6f-nP-dmcuf-QD5D-HTsnvgpPrU5ZqBaoF3yTiZFrT9qdHiiAYHFqJYJ8bL3Udk_BAnI7pooQnKoLkQmQXqW5gBJj1lJibOQFtDcbtsndU8PI4 | Metasploit |
| URL | hxxp://65[.]38[.]121[.]151:8080/transaction[.]pdf[.]lnk | VenomLNK |
