不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様12社 -
2024/12/24
※2024/12/24 更新
マルウェア感染させると考えられるURLを検知（2024/12/24）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://154[.]213[.]186[.]115/gtop[.]sh hxxp://154[.]213[.]187[.]234:3000/hiddenbin/boatnet[.]arc hxxp://154[.]213[.]186[.]115/jackmyarmv4 hxxp://154[.]213[.]186[.]115/jackmyi586 hxxp://154[.]213[.]186[.]115/jackmymipsel hxxp://154[.]213[.]186[.]115/jackmysh4 hxxp://154[.]213[.]186[.]115/jackmyarmv4tl hxxp://154[.]213[.]186[.]115/jackmymips hxxp://154[.]213[.]186[.]115/jackmyi686 hxxp://154[.]213[.]186[.]115/jackmyarmv5 hxxp://154[.]213[.]186[.]115/jackmysparc hxxp://154[.]213[.]186[.]115/jackmypowerpc hxxp://154[.]213[.]186[.]115/jackmyarmv6 hxxp://154[.]213[.]186[.]115/jackmymips64 hxxp://154[.]213[.]186[.]115/jackmym86k hxxp://154[.]213[.]186[.]115/jackmyx86 hxxp://154[.]213[.]186[.]115/jackmyi486 |
Bashlite |
| URL | hxxps://github[.]com/att1sb/seca/raw/refs/heads/main/BowlLicensed[.]exe | Vidar |
| URL | hxxps://45[.]125[.]67[.]168/stelin/Gosjeufon[.]cpl hxxps://45[.]125[.]67[.]168/stelin/rwcla[.]cpl hxxps://kiltone[.]top/stelin/Gosjeufon[.]cpl hxxps://kiltone[.]top/stelin/rwcla[.]cpl |
Cactus |
| URL | hxxps://satpr[.]com/7y6y[.]js hxxps://satpr[.]com/js[.]php hxxp://poubnxu3jubz[.]top/1[.]php hxxp://poeiughybzu222[.]top/1[.]php hxxps://dcfei[.]xyz/work/original[.]js hxxps://dcfei[.]xyz/work/index[.]php hxxps://dcfei[.]xyz/work/download[.]php hxxps://boneyn[.]com/7y6y[.]js hxxps://boneyn[.]com/js[.]php hxxps://ykcxr[.]office[.]enewlaw[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxps://89[.]147[.]111[.]100/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxps://89[.]147[.]111[.]100/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://185[.]219[.]81[.]132/40b6c4848ca5e8ed/mozglue[.]dll hxxp://185[.]219[.]81[.]132/40b6c4848ca5e8ed/vcruntime140[.]dll hxxp://185[.]219[.]81[.]132/40b6c4848ca5e8ed/sqlite3[.]dll hxxp://185[.]219[.]81[.]132/40b6c4848ca5e8ed/softokn3[.]dll hxxp://185[.]219[.]81[.]132/40b6c4848ca5e8ed/freebl3[.]dll hxxp://185[.]215[.]113[.]16/inc/stealcy11[.]exe hxxp://185[.]215[.]113[.]16/inc/daw21[.]exe hxxp://207[.]154[.]195[.]173/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://207[.]154[.]195[.]173/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://207[.]154[.]195[.]173/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://207[.]154[.]195[.]173/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://207[.]154[.]195[.]173/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://207[.]154[.]195[.]173/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://207[.]154[.]195[.]173/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://188[.]245[.]87[.]202/vcruntime140[.]dll hxxp://188[.]245[.]87[.]202/nss3[.]dll hxxp://188[.]245[.]87[.]202/freebl3[.]dll hxxp://188[.]245[.]87[.]202/softokn3[.]dll hxxp://188[.]245[.]87[.]202/mozglue[.]dll hxxp://188[.]245[.]87[.]202/msvcp140[.]dll hxxp://91[.]211[.]250[.]247/f53d7360a78c678c[.]php hxxp://62[.]60[.]226[.]24/file/davies[.]exe hxxp://91[.]211[.]250[.]247/426c9bd7902e3b20/freebl3[.]dll hxxp://91[.]211[.]250[.]247/426c9bd7902e3b20/softokn3[.]dll hxxp://91[.]211[.]250[.]247/426c9bd7902e3b20/mozglue[.]dll hxxp://91[.]211[.]250[.]247/426c9bd7902e3b20/sqlite3[.]dll hxxp://91[.]211[.]250[.]247/426c9bd7902e3b20/vcruntime140[.]dll hxxp://91[.]211[.]250[.]247/426c9bd7902e3b20/msvcp140[.]dll hxxp://91[.]211[.]250[.]247/426c9bd7902e3b20/nss3[.]dll |
Stealc |
| URL | hxxp://s1[.]cubzyn[.]net/other/inject[.]exe | NjRAT |
| URL | hxxps://atsukaa[.]thrivezest[.]org/winwidgetshp[.]mp4 hxxp://62[.]60[.]226[.]24/file/FeedStation[.]exe hxxp://62[.]60[.]226[.]24/file/build[.]exe hxxp://62[.]60[.]226[.]24/file/asd[.]exe hxxp://62[.]60[.]226[.]24/file/123[.]exe hxxps://bashfulacid[.]lat/api hxxps://tentabatte[.]lat/api hxxps://curverpluch[.]lat/api hxxps://talkynicer[.]lat/api hxxps://shapestickyr[.]lat/api hxxps://manyrestro[.]lat/api hxxps://slipperyloo[.]lat/api hxxps://wordyfindy[.]lat/api hxxps://erectystickj[.]click/api hxxp://62[.]60[.]226[.]24/file/expt64[.]exe |
Lumma Stealer |
| URL | hxxp://147[.]45[.]49[.]66/Downloads/New_collection[.]lnk hxxp://147[.]45[.]49[.]66/Downloads/testduyhihi[.]lnk hxxp://147[.]45[.]49[.]66/Downloads/Job_Digital_Marketing[.]lnk |
QakBot |
| URL | hxxp://94[.]156[.]227[.]233/load[.]sh hxxp://94[.]156[.]227[.]233/lol[.]sh |
Gorilla |
| URL | hxxp://62[.]60[.]226[.]24/file/zxc[.]exe | SmokeLoader |
| URL | hxxp://154[.]82[.]68[.]34:16653/common[.]dll | ValleyRAT |
| URL | hxxp://176[.]126[.]86[.]20/auth/login | Meduza Stealer |
| URL | hxxp://62[.]60[.]226[.]24/file/Out[.]exe | Remcos |
| URL | hxxps://krakenlpay[.]com/8jfgndS3d/Login[.]php | Amadey |
| URL | hxxps://f[.]neko[.]pe/file/~d35Ci~adCQqRGWGduhs[.]exe | Metasploit |
| URL | hxxp://185[.]196[.]10[.]62:7061/Vre | Vjw0rm |
| URL | hxxps://maddhouzz[.]com/updater[.]php | Satacom |
| URL | hxxp://193[.]143[.]1[.]150/server[.]php | StrelaStealer |
| URL | hxxp://122[.]130[.]170[.]45/Ghst[.]exe | Ghost RAT |
| URL | hxxps://api[.]telegram[.]org/bot7535953552:AAEceAC130pKqikyDX9W3q553FopjnWE5ro/sendMessage?chat_id=1981459653 | Snake Keylogger |
