不正URLへのアクセス、不正メールの受信

メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社

2024/12/23
※2024/12/23 更新
マルウェア感染させると考えられるURLを検知（2024/12/23）

■IoC（※1）



Type:
IOC:
Signature:


URL
hxxp://www[.]grupodulcemar[.]pe/987656789009800[.]exe
Agent Tesla


URL
hxxp://185[.]219[.]81[.]135/4175180d6b714647/nss3[.]dll
hxxp://185[.]219[.]81[.]135/4175180d6b714647/sqlite3[.]dll
hxxp://185[.]219[.]81[.]135/4175180d6b714647/freebl3[.]dll
hxxp://185[.]219[.]81[.]135/4175180d6b714647/msvcp140[.]dll
hxxp://185[.]219[.]81[.]135/4175180d6b714647/mozglue[.]dll
hxxp://185[.]219[.]81[.]135/4175180d6b714647/vcruntime140[.]dll
hxxp://185[.]219[.]81[.]135/4175180d6b714647/softokn3[.]dll
hxxp://185[.]219[.]81[.]132/4f85e0bfc60adccc/nss3[.]dll
hxxp://185[.]219[.]81[.]132/4f85e0bfc60adccc/vcruntime140[.]dll
hxxp://185[.]219[.]81[.]132/4f85e0bfc60adccc/freebl3[.]dll
hxxp://185[.]219[.]81[.]132/4f85e0bfc60adccc/softokn3[.]dll
hxxp://185[.]219[.]81[.]132/4f85e0bfc60adccc/sqlite3[.]dll
hxxp://185[.]219[.]81[.]132/4f85e0bfc60adccc/mozglue[.]dll
hxxp://185[.]219[.]81[.]132/4f85e0bfc60adccc/msvcp140[.]dll
hxxp://185[.]219[.]81[.]132/1089481c07d09d21[.]php
hxxp://185[.]219[.]81[.]132/4bcb97a14f2e1544[.]php
Stealc


URL
hxxp://teamxox[.]world/build[.]exe
RedLine Stealer


URL
hxxp://upload[.]vina-host[.]com/get/XtfGLCMk2K/windowshost[.]exe
Quasar RAT


URL
hxxps://fitgirl-repackes[.]me/av/billys[.]exe
hxxps://neroheronero[.]net/off/ruppert[.]exe
hxxp://147[.]45[.]47[.]15/script[.]hta
hxxp://147[.]45[.]44[.]216/auth/login
Meduza Stealer


URL
hxxps://wimf[.]demo[.]ezra-ai[.]com/merchantServices
hxxps://xyfe[.]demo[.]ezra-ai[.]com/merchantServices
hxxps://odziezrobocza[.]biz/work/index[.]php
hxxps://odziezrobocza[.]biz/work/original[.]js
hxxps://odziezrobocza[.]biz/work/download[.]php
hxxps://hdtele[.]com/6yq3[.]js
hxxps://hdtele[.]com/js[.]php
hxxps://hamptoninnbelton[.]com/work/original[.]js
hxxps://hamptoninnbelton[.]com/work/index[.]php
hxxps://hamptoninnbelton[.]com/work/download[.]php
hxxps://incms[.]biz/work/mmmm[.]zip
hxxps://xlu[.]demo[.]ezra-ai[.]com/merchantServices
hxxps://ipimd[.]demo[.]ezra-ai[.]com/merchantServices
hxxp://ohunhebzhbu3[.]top/1[.]php
hxxps://0da30[.]fate[.]truelance[.]com/subscribeEvent
hxxps://nsgs[.]demo[.]ezra-ai[.]com/merchantServices
hxxps://ivhg[.]law[.]kimsavagelaw[.]com/merchantServices
hxxps://mxq[.]law[.]kimsavagelaw[.]com/merchantServices
hxxps://vbjr[.]demo[.]ezra-ai[.]com/merchantServices
hxxps://qamar-alsharqia[.]com/work/index[.]php
hxxps://qamar-alsharqia[.]com/work/original[.]js
hxxps://sokrpro[.]com/w78u[.]js
hxxps://sokrpro[.]com/js[.]php
hxxp://lgbibzuehbz[.]top/1[.]php
FAKEUPDATES


URL
hxxp://www[.]flntp[.]ro/fintp[.]x64[.]bin
hxxp://1[.]94[.]172[.]68/02[.]08[.]2022[.]exe
hxxp://119[.]3[.]154[.]143/02[.]08[.]2022[.]exe
hxxp://183[.]6[.]90[.]61:90/02[.]08[.]2022[.]exe
hxxp://120[.]46[.]212[.]33:81/02[.]08[.]2022[.]exe
hxxp://1[.]94[.]20[.]100:7000/02[.]08[.]2022[.]exe
hxxp://149[.]88[.]89[.]205/02[.]08[.]2022[.]exe
hxxp://43[.]136[.]69[.]151:50001/02[.]08[.]2022[.]exe
hxxp://154[.]85[.]54[.]80:8080/02[.]08[.]2022[.]exe
hxxp://154[.]85[.]54[.]80:8880/02[.]08[.]2022[.]exe
hxxp://103[.]244[.]89[.]133:8888/02[.]08[.]2022[.]exe
hxxp://101[.]43[.]109[.]204:8888/02[.]08[.]2022[.]exe
hxxp://118[.]24[.]60[.]20:801/02[.]08[.]2022[.]exe
hxxp://121[.]40[.]55[.]28/02[.]08[.]2022[.]exe
hxxp://83[.]229[.]122[.]192:2003/02[.]08[.]2022[.]exe
hxxp://47[.]76[.]249[.]169/02[.]08[.]2022[.]exe
hxxp://1[.]94[.]221[.]238:8080/02[.]08[.]2022[.]exe
hxxp://110[.]41[.]147[.]219/02[.]08[.]2022[.]exe
hxxp://189[.]1[.]242[.]182/02[.]08[.]2022[.]exe
Cobalt Strike


URL
hxxp://147[.]45[.]44[.]157/Captcha[.]hta
hxxp://31[.]41[.]244[.]11/files/6069966613/8ZVMneG[.]exe
hxxps://stem-mellows[.]cyou/api
hxxps://solve[.]fizq[.]net/awjxs[.]captcha
hxxps://icyidentifysu[.]click/api
hxxps://supporse-comment[.]cyou/api
hxxps://steppriflej[.]xyz/api
hxxps://smash-boiling[.]cyou/api
hxxps://sendypaster[.]xyz/api
hxxps://ripe-blade[.]cyou/api
hxxps://pollution-raker[.]cyou/api
hxxps://hosue-billowy[.]cyou/api
hxxps://greywe-snotty[.]cyou/api
hxxps://lev-tolstoi[.]com/api
hxxps://cuddlyready[.]xyz/api
hxxps://gracefulcallou[.]click/api
Lumma Stealer


URL
hxxp://cp[.]eye-network[.]ru/lol/Aqua[.]arm7
hxxp://cp[.]eye-network[.]ru/lol/Aqua[.]x86
hxxp://cp[.]eye-network[.]ru/lol/Aqua[.]mips
hxxp://cp[.]eye-network[.]ru/lol/Aqua[.]m68k
hxxp://mariafgilbert[.]com/jklsh4
Bashlite


URL
hxxp://uspp[.]certikeys[.]org/%D0%9F%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%B0_19%2012%202024[.]zip
hxxp://track[.]novapostal[.]org/%D0%9F%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%B0_19%2012%202024[.]zip
hxxp://me[.]jmitchelldayton[.]com/%D0%9F%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%B0_19%2012%202024[.]zip
hxxp://185[.]158[.]248[.]133/%D0%9F%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%B0_19%2012%202024[.]zip
hxxp://89[.]23[.]107[.]89/Documents/Stansberry_Subscribers[.]txt[.]lnk
hxxp://89[.]23[.]107[.]89/Documents/Stansberry_CryptoPlan[.]txt[.]lnk
hxxp://89[.]23[.]107[.]89/Documents/Stansberry_Full[.]txt[.]lnk
hxxp://147[.]45[.]49[.]66/Downloads/Campain_IMG[.]lnk
hxxp://147[.]45[.]179[.]37/Documents/ChromeUpdate-x64[.]exe[.]lnk
hxxp://147[.]45[.]179[.]37/Documents/Mountains[.]jpeg[.]lnk
hxxp://147[.]45[.]49[.]66/Downloads/Campain_IMAGE[.]lnk
hxxp://147[.]45[.]49[.]66/Downloads/Job_MKT[.]lnk
hxxp://147[.]45[.]179[.]37/Documents/plinkoGame[.]lnk
hxxp://147[.]45[.]49[.]66/Downloads/Job_DGT[.]lnk
hxxp://89[.]23[.]107[.]89/Documents/Stansberry_Unsubscribed[.]txt[.]lnk
hxxp://87[.]120[.]115[.]240/Downloads/acer-nitro-v-15-2023-intel-i7-13620h-rtx-4050[.]jpg[.]lnk
hxxp://87[.]120[.]115[.]240/Downloads/vostro-3520-laptop-01_1[.]jpg[.]lnk
hxxp://87[.]120[.]115[.]240/Downloads/omen-16-rtx-3060-03[.]jpg[.]lnk
QakBot


URL
hxxp://www[.]grupodulcemar[.]pe/FTQP098767800[.]exe
Snake Keylogger


URL
hxxp://57[.]129[.]55[.]225/225/enn/mniscreenthinkinggoodforentiretimegoodfotbusubessthings[.]hta
hxxps://paste[.]ee/r/muVvq/0
hxxp://57[.]129[.]55[.]225/225/economicthingsaregoingaroundwithhusbandwithgoodnewsgreatforeverybodygiven[.]tIF
Remcos


URL
hxxp://160[.]22[.]121[.]182/STATO/Vskhdvzxu[.]mp3
CloudEyE


URL
hxxp://45[.]94[.]31[.]128/un1/uhard[.]dat
Coinminer


URL
hxxp://59[.]97[.]125[.]78:44272/Mozi[.]m
hxxp://175[.]107[.]0[.]178:57273/Mozi[.]m
hxxp://103[.]199[.]180[.]105:40951/Mozi[.]m
hxxp://117[.]215[.]129[.]210:59952/Mozi[.]m
hxxp://59[.]98[.]142[.]78:44280/Mozi[.]m
Mozi


URL
hxxp://703648cm[.]renyash[.]top/provider_cpugame[.]php
hxxp://89[.]23[.]96[.]180/03/authtraffic_1/PythonApi/Linux/8Cdnsecureprotect/multi/1/mariadb7Cdn/24/Lowlongpollvm/ImagepythonRequestLowGeocpuwpTemporary[.]php
hxxp://185[.]230[.]138[.]58/video7/Dle/publicupdate/4/GeneratorgeneratorDump/_Async/Flower/asyncSecure52/6Public5/VoiddbJs7/better/temporaryUploads/8/04providerTemporary/TempwpsecureVoiddb/Longpoll7ProtonPrivate/PhpUpdateSqlDatalife[.]php
hxxp://195[.]10[.]205[.]157/Public/Pollauth8/TestLocalapi/1Base/Temp/Todumpprovider/7Eternal/game/63multi/29Dump/5/multiHttp0Request/_securebigload[.]php
DCRat


URL
hxxps://premiumprotectiondis[.]org/webpanel/Panel/login[.]php
Gomorrah stealer


URL
hxxp://212[.]193[.]31[.]8/3ofn3jf3e2ljk2/index[.]php
hxxp://212[.]193[.]31[.]8/3ofn3jf3e2ljk2/Plugins/cred64[.]dll
hxxp://212[.]193[.]31[.]8/3ofn3jf3e2ljk2/Plugins/clip64[.]dll
hxxp://212[.]193[.]31[.]8/3ofn3jf3e2ljk2/Login[.]php
Amadey


URL
hxxp://194[.]5[.]97[.]156:7657/Vre
Vjw0rm


URL
hxxp://43[.]249[.]172[.]195:888/112[.]sh
XOR DDoS


URL
hxxps://riverflowbd[.]top/YTZhZjliODdlYTI4/
Coper


URL
hxxps://publicspeaking[.]co[.]id/okoye/Panel/five/fre[.]php
hxxp://publicspeaking[.]co[.]id/okoye/Panel/five/fre[.]php
LokiBot




※1「i-FILTER」アクセスログを検索し端末を特定してください
    不要なアクセスを避けるため、一部変更しております。


■製品対応状況（※2）
▽i-FILTER（※3）
・[脅威情報サイト]カテゴリでブロック可能

※2 ブロックの可否は各製品の設定によるため、実際の結果はアクセスログを参照してください。
※3 暗号化された通信の場合は、SSL Adapterの設定を「利用」にする必要があります。