不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様5社 -
2024/12/20
※2024/12/20 更新
マルウェア感染させると考えられるURLを検知（2024/12/20）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://185[.]215[.]113[.]209/inc/cvv[.]exe | DCRat |
| URL | hxxp://185[.]215[.]113[.]16/inc/1fxm3u0d[.]exe hxxp://185[.]215[.]113[.]209/inc/1fxm3u0d[.]exe hxxp://185[.]215[.]113[.]209/inc/lummetc[.]exe hxxp://185[.]215[.]113[.]209/inc/LummaC22222[.]exe hxxps://filenjjutre[.]online/GoogleChrome[.]exe hxxp://185[.]215[.]113[.]209/inc/cccc2[.]exe hxxp://185[.]215[.]113[.]209/inc/5_6253708004881862888[.]exe hxxp://danojeo[.]shop/api hxxp://185[.]215[.]113[.]209/inc/Armanivenntii_crypted_EASY[.]exe hxxp://185[.]215[.]113[.]209/inc/ji2xlo1f[.]exe hxxp://185[.]215[.]113[.]209/inc/LgendPremium[.]exe |
Lumma Stealer |
| URL | hxxp://185[.]215[.]113[.]209/inc/ha7dur10[.]exe | DanaBot |
| URL | hxxp://185[.]215[.]113[.]209/inc/pyld611114[.]exe hxxp://185[.]215[.]113[.]209/inc/pyld64[.]exe hxxp://gitrok[.]com/filez/zapret-discord-youtube_1[.]6[.]1[.]rar |
Coinminer |
| URL | hxxp://185[.]219[.]81[.]135/de4fe4f133a5af6f/nss3[.]dll hxxp://185[.]219[.]81[.]135/de4fe4f133a5af6f/vcruntime140[.]dll hxxp://185[.]219[.]81[.]135/de4fe4f133a5af6f/softokn3[.]dll hxxp://185[.]219[.]81[.]135/de4fe4f133a5af6f/msvcp140[.]dll hxxp://185[.]219[.]81[.]135/de4fe4f133a5af6f/freebl3[.]dll hxxp://185[.]219[.]81[.]135/de4fe4f133a5af6f/mozglue[.]dll hxxp://185[.]219[.]81[.]135/de4fe4f133a5af6f/sqlite3[.]dll hxxp://185[.]215[.]113[.]209/inc/343dsxs[.]exe hxxp://185[.]215[.]113[.]209/inc/qth5kdee[.]exe |
Stealc |
| URL | hxxp://185[.]215[.]113[.]209/inc/ldqj18tn[.]exe | Vidar |
| URL | hxxp://spotcarservice[.]ru/fdjskf88cvt/putty[.]exe hxxp://spotcarservice[.]ru/fdjskf88cvt/yumba/putty[.]exe hxxp://185[.]215[.]113[.]209/inc/kill[.]exe |
SmokeLoader |
| URL | hxxps://of1x[.]icu/pnTClIjB/Shotstar[.]psd hxxps://of1x[.]icu/SPJvBNUT/VgfkXiQUJNREEqCxjfN242[.]bin |
CloudEyE |
| URL | hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]mips hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]mpsl hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]arm5 hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]arm7 hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]m68k hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]i686 hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]arm6 hxxp://stop[.]eye-network[.]ru/lol/Aqua[.]sh4 hxxp://mes-demarches-renouvellement[.]com/sh4 hxxp://servvital[.]com/zersh4 hxxp://193[.]143[.]1[.]54/splsh4 |
Bashlite |
| URL | hxxp://147[.]45[.]47[.]15/script[.]ps1 hxxp://147[.]45[.]47[.]15/iviewers[.]dll hxxp://adobe-acrobat[.]com/script[.]hta |
Meduza Stealer |
| URL | hxxp://31[.]41[.]244[.]11/files/1293295511/3lthFqd[.]exe | Agent Tesla |
| URL | hxxp://185[.]215[.]113[.]209/inc/bqkriy6l[.]exe | XWorm |
| URL | hxxps://paste[.]ee/r/o8fzA/0 hxxps://bitbucket[.]org/trabajo12023/proyecto/downloads/Final1278685280[.]exe hxxps://bitbucket[.]org/trabajo12023/proyecto/downloads/AttachedStanford[.]exe hxxps://bitbucket[.]org/trabajo12023/proyecto/downloads/Simpson[.]exe hxxps://bitbucket[.]org/trabajo12023/proyecto/downloads/ROSAS[.]exe hxxps://bitbucket[.]org/trabajo12023/proyecto/downloads/AD[.]exe |
Remcos |
| URL | hxxps://www[.]al-rasikh[.]com/ms/neaters[.]txt hxxps://www[.]al-rasikh[.]com/ms/neata[.]txt hxxps://www[.]al-rasikh[.]com/ms/neats[.]txt hxxps://www[.]al-rasikh[.]com/ms/neatz[.]txt hxxps://www[.]al-rasikh[.]com/ms/neatez[.]txt hxxps://www[.]al-rasikh[.]com/ms/neatsz[.]txt |
Rhadamanthys |
| URL | hxxp://185[.]215[.]113[.]16/inc/Set-up-1[.]exe hxxp://185[.]215[.]113[.]209/inc/Set-up-1[.]exe |
CryptBot |
| URL | hxxps://gwcomics[.]com/1ght[.]js hxxps://esondent[.]com/work/original[.]js hxxps://esondent[.]com/work/yyy[.]zip hxxps://esondent[.]com/work/download[.]php hxxps://esondent[.]com/work/index[.]php hxxps://mkgd[.]demo[.]ezra-ai[.]com/merchantServices hxxps://gwcomics[.]com/js[.]php hxxp://sdubvlbbuz3vzzz[.]top/1[.]php hxxps://incms[.]biz/work/zzzz[.]zip hxxps://nibvx[.]demo[.]ezra-ai[.]com/merchantServices hxxps://sdlru[.]demo[.]ezra-ai[.]com/merchantServices hxxps://vzfy[.]demo[.]ezra-ai[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxp://185[.]215[.]113[.]209/inc/uhigdbf[.]exe | SystemBC |
| URL | hxxp://185[.]11[.]61[.]104/7jbBdsS/Login[.]php | Amadey |
| URL | hxxps://jery2helly4now[.]site/N2Y5ZmU3OTI5ZDky/ hxxps://lehoetrb6j1h6[.]online/N2Y5ZmU3OTI5ZDky/ hxxps://venndzy75hjeklr[.]top/N2Y5ZmU3OTI5ZDky/ hxxps://koleitgehndhe782hr[.]online/YWFiM2VkMmFmNWFh/ hxxps://lfoi45frhre4frjhyfrh[.]online/YWFiM2VkMmFmNWFh/ hxxps://agenoikleiocbgr54[.]life/YWFiM2VkMmFmNWFh/ hxxps://juiruhf5be6743yhyjdj[.]xyz/YWFiM2VkMmFmNWFh/ |
Coper |
