不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2024/12/19
※2024/12/19 更新
マルウェア感染させると考えられるURLを検知（2024/12/19）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://paste[.]ee/r/9yXNA/0 hxxps://158[.]69[.]36[.]15/files/remcos[.]txt hxxp://23[.]95[.]122[.]252/450/vbc[.]exe hxxp://89[.]23[.]96[.]203/333/12[.]exe |
Remcos |
| URL | hxxp://vitantgroup[.]com/Plugins/clip64[.]dll hxxp://185[.]215[.]113[.]209/lego/ama[.]exe |
Amadey |
| URL | hxxp://95[.]215[.]204[.]123/6da61cc9df0e0899/vcruntime140[.]dll hxxp://95[.]215[.]204[.]123/6da61cc9df0e0899/mozglue[.]dll hxxp://95[.]215[.]204[.]123/6da61cc9df0e0899/msvcp140[.]dll hxxp://95[.]215[.]204[.]123/6da61cc9df0e0899/softokn3[.]dll hxxp://95[.]215[.]204[.]123/6da61cc9df0e0899/freebl3[.]dll hxxp://185[.]219[.]81[.]135/c708352984fb7ac0[.]php |
Stealc |
| URL | hxxps://fuarez[.]cyou/xx hxxps://polovoiinspektor[.]shop/RalphCvs[.]exe |
Vidar |
| URL | hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/ENVS/DS8[.]txt hxxp://194[.]26[.]192[.]76:8080/WorldWindClient[.]zip |
AsyncRAT |
| URL | hxxp://124[.]158[.]5[.]149:8081/cmc[.]elf | ConnectBack |
| URL | hxxp://103[.]87[.]10[.]156/master hxxp://185[.]215[.]113[.]209/inc/networkmanager[.]exe hxxp://185[.]215[.]113[.]16/inc/networkmanager[.]exe |
Sliver |
| URL | hxxps://spend-shiny[.]cyou/api hxxps://push-hook[.]cyou/api hxxps://automatic-meaty[.]sbs/api hxxps://wrappyskmwio[.]store/api hxxp://31[.]41[.]244[.]11/files/6989783370/8oMoEDZ[.]exe hxxp://31[.]41[.]244[.]11/files/6989783370/AwT7h8g[.]exe hxxp://185[.]215[.]113[.]16/inc/2kudv4ea[.]exe hxxp://185[.]215[.]113[.]209/inc/2kudv4ea[.]exe hxxp://185[.]215[.]113[.]209/inc/CompleteStudio[.]exe hxxp://185[.]215[.]113[.]16/inc/zq6a1iqg[.]exe hxxp://185[.]215[.]113[.]209/inc/zq6a1iqg[.]exe hxxp://31[.]41[.]244[.]11/files/dodo/random[.]exe hxxps://kliptizq[.]shop/int_clp_ldr_sha[.]txt hxxps://klipxevojie[.]shop/int_clp_sha[.]txt |
Lumma Stealer |
| URL | hxxp://47[.]92[.]131[.]203:189/Qua6 | Cobalt Strike |
| URL | hxxps://cronoze[.]com:8817/pentium[.]php hxxps://muuxxu[.]com:8817/pentium[.]php |
Brute Ratel C4 |
| URL | hxxp://212[.]162[.]149[.]92/FbuhjxbSFSc116[.]bin hxxp://147[.]189[.]131[.]252/sgGnH85[.]bin hxxps://www[.]tdejb[.]com/ef/ef[.]bin hxxps://www[.]tdejb[.]com/ef/Skifterne[.]sea hxxps://www[.]astenterprises[.]com[.]pk/ef/ef[.]vbs hxxps://www[.]fornid[.]com/lm/List%20of%20required%20items%20and%20services[.]docx hxxp://87[.]120[.]112[.]91/Downloads/List%20of%20required%20items%20and%20services[.]pdf[.]vbs |
CloudEyE |
| URL | hxxp://84[.]38[.]133[.]48/TeoRHdGgbvsSqoRyBIQpbDk31[.]bin hxxp://84[.]38[.]133[.]48/LSOzHkHtJlArws124[.]bin hxxp://192[.]3[.]243[.]136/americasssss[.]txt |
Agent Tesla |
| URL | hxxp://home[.]tventjo20vs[.]top/lwRwtEGztSQcWvXoArFS90 hxxp://home[.]fivetk5vt[.]top/hLfzXsaqNtoEGyaUtOMJ1734 |
CryptBot |
| URL | hxxps://calbbs[.]com/5gt5[.]js hxxps://buylevlen[.]xyz/work/yyy[.]zip hxxps://buylevlen[.]xyz/work/original[.]js hxxps://buylevlen[.]xyz/work/download[.]php hxxps://buylevlen[.]xyz/work/index[.]php hxxps://gotintouch[.]shop/work/yyyy[.]zip hxxps://calbbs[.]com/js[.]php hxxp://bnbuzu49ibz4[.]top/1[.]php hxxps://vmz[.]sectors[.]bowentaxlaw[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxp://173[.]214[.]167[.]74/xampp/dcv/greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns[.]hta hxxp://173[.]214[.]167[.]74/444/nicerose[.]exe |
DBatLoader |
| URL | hxxp://185[.]215[.]113[.]209/inc/1[.]exe | XWorm |
| URL | hxxp://125[.]33[.]224[.]168:8085/AV[.]scr hxxp://123[.]115[.]162[.]181:8085/Photo[.]scr hxxp://125[.]33[.]224[.]168:8085/Video[.]scr hxxp://110[.]189[.]17[.]228:89/Photo[.]scr hxxp://110[.]189[.]17[.]228:89/AV[.]scr hxxp://110[.]189[.]17[.]228:89/Video[.]scr hxxp://125[.]33[.]224[.]168:8085/Photo[.]scr hxxp://123[.]115[.]162[.]181:8085/Video[.]scr hxxp://123[.]115[.]162[.]181:8085/AV[.]scr |
Coinminer |
| URL | hxxp://210[.]125[.]101[.]75/agent[.]exe | Metasploit |
| URL | hxxp://47[.]120[.]46[.]210/exe/winPEASx64[.]exe | RedLine Stealer |
| URL | hxxp://189[.]241[.]217[.]195/local[.]exe hxxp://189[.]241[.]217[.]195/Client-built[.]exe hxxp://189[.]241[.]217[.]195/client-builtlocal[.]exe |
Quasar RAT |
| URL | hxxps://gotintouch[.]shop/work/yyyy[.]zip?69565 | NetSupportManager RAT |
| URL | hxxp://154[.]213[.]187[.]106/bot[.]ppc hxxp://botnet[.]sharkcdn[.]net/bot[.]m68k hxxp://botnet[.]sharkcdn[.]net/bot[.]ppc hxxp://154[.]213[.]187[.]106/bot[.]m68k |
Bashlite |
| URL | hxxp://31[.]41[.]244[.]11/files/7055252561/x0qQ2DH[.]exe | Formbook |
| URL | hxxp://93[.]176[.]52[.]107/Dark_Brout_ncrypt[.]exe hxxp://93[.]176[.]52[.]107/Dark_Autre_ncrypt[.]exe |
DarkComet |
| URL | hxxp://93[.]176[.]52[.]107/Nan_Autre_ncrypt[.]exe | Nanocore RAT |
