不正URLへのアクセス、不正メールの受信

メール受信した
弊社お客様12社 URLアクセスした
弊社お客様0社

2021/04/20
※2021/04/20 更新
04/19から発生していたバンキングマルウェア（Dridex）に感染させると考えられるメールの受信・URLアクセスを検知

件名：
Invoice nnnnnn
Payment Notification - Invoice nnnnnn
Reminder: Invoice nnnnnnn
OUTSTANDING INVOICE - Re-Export Of 03/22/2021
OUTSTANDING INVOICE Of 03/22/2021
Payment Notice Of 03/22/2021
Payment Notification Of 03/22/2021
overdue invoice Of 03/22/2021

※太赤字の「n」はランダムな数字が入ります。
※上記以外の件名が利用されている可能性があります。


添付ファイル名：
nnnnnn-04192021.xls
nnnnnn_04192021.xls
OUTSTANDING_INV_Statement_nnnnnn.xls

※太赤字の「n」はランダムな数字が入ります。
※上記以外にも存在する可能性があります。


添付ファイルハッシュ値：
02521f0bb91b4c74d1590b85254f26f0d258cd780393010593ae6daaa5993753
765a0b4da72ab6434010d966df81d1853a6dcb1327b609319332390856c4ac73

※観測できた全ハッシュ値を掲載しております。


感染プロセス
メール受信
↓
添付ファイルを開き、マクロを有効化する
↓
外部URLに通信する


通信先一覧：
hxxps://1000-vulkanvegasde-bonus[.]payroll[.]gadgetoy[.]com/ze6p62[.]zip
hxxps://big[.]copasset[.]com/r4vzbg8i[.]tar
hxxps://blog[.]andradespecialedition[.]com[.]br/juv2ijivv[.]tar
hxxps://blog[.]grnstore[.]com/bk9qxypi[.]tar
hxxps://breakingbread[.]modelacademy[.]co[.]in/cp0qh5bw[.]rar
hxxps://checkouts[.]larealacademiadelmarketing[.]com/mzbltgeq[.]tar
hxxps://dashboard[.]khholdings[.]co[.]za/nde67wks[.]tar
hxxps://demo[.]g-mart[.]in/h9o65rkm2[.]zip
hxxps://dogwalking[.]kamranejaz[.]com/u0i1zr[.]rar
hxxps://events[.]blissona[.]com/g1mrfi[.]rar
hxxps://fotografia[.]rodolforegini[.]com/rzsxbxk[.]tar
hxxps://gujarati[.]timesreports[.]com/raso5xevk[.]rar
hxxps://h1[.]raniaweb[.]com/ewpzjrdv[.]tar
hxxps://hospital[.]fecom[.]in/ryhtvpb[.]tar
hxxps://ims[.]huile-indonesia[.]co[.]id/rdzgbh3y0[.]rar
hxxps://in[.]lostecolines[.]com/lc4rga91[.]rar
hxxps://incsaya[.]agenciademarketingsh[.]com/dxk5qjg[.]zip
hxxps://library[.]skscarsrjn[.]in/cbtwwmk[.]zip
hxxps://live[.]e-lift[.]co[.]za/cf3tc739q[.]rar
hxxps://lms[.]therighteousfoundation[.]org/y7gbouqxx[.]tar
hxxps://loja[.]bigfisher[.]com[.]br/e8190ys[.]rar
hxxps://love[.]e-lift[.]co[.]za/s9e70nf4[.]rar
hxxps://mail1[.]hacachurch[.]org/vz0bzxvy[.]zip
hxxps://mailwiz[.]foryourjobs[.]com/odq19vx6j[.]rar
hxxps://mapasminecraft[.]jonasefonfon[.]com/dqyjk4o[.]zip
hxxps://mmm[.]alprofessor[.]net/eyytdy[.]rar
hxxps://pallascapital[.]katchpurcity[.]com/l631jp[.]tar
hxxps://rapidoinfo[.]seutecnico[.]com/v7sefjd72[.]zip
hxxps://reliableglassaz[.]mbndigital[.]com/jx0q71rjm[.]tar
hxxps://simulador[.]ligapvp[.]com/x5tznk[.]rar
hxxps://sipedang[.]copasset[.]com/idxgu99t[.]rar
hxxps://site2[.]portfolioplus[.]biz/k3i18e[.]rar
hxxps://snipit[.]chriscornell[.]me/cym5jqd[.]tar
hxxps://soru[.]umre[.]tc/yha76hrg[.]zip
hxxps://staging[.]ebenisterie-beluga[.]com/i8u9l4pal[.]zip
hxxps://staging[.]moegreenssf[.]com/dhvokj[.]zip
hxxps://temp[.]viajalibro[.]com/xp1gnbjlv[.]zip
hxxps://test[.]decojitorinimioare[.]ro/ri9hxe94[.]rar
hxxps://test[.]onefourlab[.]com/bmqn8z9d[.]zip
hxxps://turanturizm[.]umre42[.]com/s0xakk7[.]zip
hxxps://unik[.]trexa[.]id/w98p0wkt[.]zip
hxxps://verifikasi[.]bizmetch[.]com/kslvx9[.]tar
hxxps://vulkan[.]ikigaichile[.]cl/a14wva7j9[.]zip
hxxps://vulkan[.]payroll[.]gadgetoy[.]com/xxgs1t[.]tar
hxxps://vulkanvegas-de[.]katchpurcity[.]com/bd4e3yw[.]tar
hxxps://vulkanvegas-de[.]veronafoodbd[.]com/uiatx1wc[.]zip
hxxps://vulkanvegasbonusmb[.]payroll[.]gadgetoy[.]com/yldqxij[.]tar
hxxps://vulkanvegasbonusuk[.]veronafoodbd[.]com/uetmmlfo[.]rar
hxxps://vulkanvegasdecom[.]ascendingtex[.]com/xxnq2nd[.]tar
hxxps://vulkanvegasgermany[.]ascendingtex[.]com/wkp07t4[.]zip
hxxps://vulkanvegasonline[.]ascendingtex[.]com/klpn1cz[.]tar
hxxps://vulkanvegasonline[.]katchpurcity[.]com/q4vjcmb6[.]zip
hxxps://web[.]almasajid[.]org/pxo138ewn[.]rar
hxxps://wp[.]foryourjobs[.]com/ex39a8k[.]zip
hxxps://1000-euro-vulkanvegas[.]payroll[.]gadgetoy[.]com/mxq8i2[.]zip
hxxps://1000-euro-vulkanvegas[.]veronafoodbd[.]com/uhk92exd[.]rar
hxxps://admin[.]bluechipconditioning[.]com/c2f790za[.]tar
hxxps://api[.]daddyimpregnant[.]com/k4tqq0[.]rar
hxxps://app[.]fakhreldeen[.]com/yrwxprua[.]rar
hxxps://app[.]ligasys[.]com/i337y99[.]tar
hxxps://app[.]siriagroservices[.]com/v7rj3cozt[.]rar
hxxps://b[.]raniaweb[.]com/o50nbad[.]tar
hxxps://belaumkm[.]jualindonesia[.]com/wfn25r9[.]rar
hxxps://big[.]onefourlab[.]com/oi5rq6w[.]zip
hxxps://blackpasta[.]makefailrepeat[.]com/hd8m2g[.]tar
hxxps://blog[.]benzermedicalequipment[.]com/tigsy1ie[.]rar
hxxps://burhman[.]bexcodeservices[.]com/hmsxxo[.]zip
hxxps://clinicas[.]facturarte[.]com[.]ar/q2gxs9tm[.]tar
hxxps://dover[.]copasset[.]com/d365sl[.]zip
hxxps://e-reporting[.]bjb[.]copasset[.]com/qocoa4[.]tar
hxxps://git[.]bizmetch[.]com/gjefd5mx[.]zip
hxxps://jinvati[.]works[.]jaladatechnologies[.]com/n4h84nx[.]rar
hxxps://kalotsavam[.]cbcmandya[.]com/fs7bc6[.]rar
hxxps://kultur[.]ikram[.]com[.]tr/yfuizwxk[.]rar
hxxps://mail[.]fridel[.]ind[.]br/peciqaauz[.]rar
hxxps://mbbs[.]foryourjobs[.]com/inw24ubq[.]rar
hxxps://medical[.]foryourjobs[.]com/qxu6mmim[.]rar
hxxps://members[.]fuelfitness[.]co[.]uk/w83139wj[.]rar
hxxps://meteorologiaparaamanha[.]pt[.]icetonehosting[.]com/z0hbsuv[.]rar
hxxps://my[.]nzcloudservices[.]nz/kr06lotvz[.]tar
hxxps://ncd[.]worksthal[.]com/vrz7lj[.]zip
hxxps://offer[.]fakhreldeen[.]com/cs4260d8[.]tar
hxxps://old[.]bizmetch[.]com/ysqpchww2[.]rar
hxxps://old[.]sjmarathon[.]org/zuxiopm[.]zip
hxxps://orthomax[.]agenciademarketingsh[.]com/x2n9g0s72[.]tar
hxxps://partner[.]gidicarsng[.]com/illaajv2i[.]zip
hxxps://pos[.]importsbr[.]com/qo5m4ckvp[.]tar
hxxps://quran[.]sirsyed[.]edu[.]pk/wi800cr5[.]tar
hxxps://sankalpfactory[.]mpiric[.]us/mjna8m1w[.]tar
hxxps://school[.]sipsknp[.]com/ujk3z3l[.]zip
hxxps://scraping[.]bizmetch[.]com/gb60gik0b[.]zip
hxxps://shop[.]g-mart[.]in/ynymlrtdl[.]tar
hxxps://site1[.]portfolioplus[.]biz/dudd5j3z8[.]zip
hxxps://store[.]chriscornell[.]me/pqoail[.]tar
hxxps://test[.]anyoffers[.]com/ezyfeyfv[.]zip
hxxps://test[.]auramakeup[.]ro/pparzie35[.]rar
hxxps://test[.]systemx[.]ca/ggwyur[.]tar
hxxps://test[.]veronafoodbd[.]com/b44hfz[.]zip
hxxps://test104[.]rcmasterassessoria[.]com[.]br/ka8axfx[.]rar
hxxps://testdrive[.]copasset[.]com/d8k5gtrs8[.]zip
hxxps://teste[.]sedac-ma[.]com[.]br/uumm77ku[.]rar
hxxps://theblask[.]balgopalbank[.]com/nuyetdj[.]tar
hxxps://vegasvulkandenmark[.]ascendingtex[.]com/brnm4a21s[.]tar
hxxps://vegasvulkangermany[.]payroll[.]gadgetoy[.]com/ycf2hpgry[.]zip
hxxps://videofesta[.]aikron[.]com[.]br/wmjkm2u[.]tar
hxxps://vulkanvegasbonusde[.]ascendingtex[.]com/sy4qel[.]rar
hxxps://vulkanvegasbonuskr[.]katchpurcity[.]com/jeuvko1jc[.]zip
hxxps://vulkanvegasbonusnl[.]katchpurcity[.]com/y5ekwz[.]zip
hxxps://vulkanvegascom[.]veronafoodbd[.]com/g1eds9[.]rar
hxxps://vulkanvegasissix[.]thegreatfloodsociety[.]org/sm0paaip[.]zip
hxxps://vulkanvegasonline[.]veronafoodbd[.]com/xc6b2n[.]zip
hxxps://webminar[.]bizmetch[.]com/m733ytox[.]zip
hxxps://wp[.]beneircsi[.]hu/cg0t45z[.]zip


※接続しようとしたURLは、不要なアクセスを避けるため、一部変更しております。


製品対応状況
▽m-FILTER
偽装判定、アンチスパムの対応状況は
お客様のご利用設定、ご利用のバージョン、受信した個々のメールによって異なりますので
m-FILTERのアクセスログをご確認ください。

▽i-FILTER
hxxps://1000-vulkanvegasde-bonus[.]payroll[.]gadgetoy[.]com/ze6p62[.]zip
hxxps://big[.]copasset[.]com/r4vzbg8i[.]tar
hxxps://blog[.]andradespecialedition[.]com[.]br/juv2ijivv[.]tar
hxxps://blog[.]grnstore[.]com/bk9qxypi[.]tar
hxxps://breakingbread[.]modelacademy[.]co[.]in/cp0qh5bw[.]rar
hxxps://checkouts[.]larealacademiadelmarketing[.]com/mzbltgeq[.]tar
hxxps://dashboard[.]khholdings[.]co[.]za/nde67wks[.]tar
hxxps://demo[.]g-mart[.]in/h9o65rkm2[.]zip
hxxps://dogwalking[.]kamranejaz[.]com/u0i1zr[.]rar
hxxps://events[.]blissona[.]com/g1mrfi[.]rar
hxxps://fotografia[.]rodolforegini[.]com/rzsxbxk[.]tar
hxxps://gujarati[.]timesreports[.]com/raso5xevk[.]rar
hxxps://h1[.]raniaweb[.]com/ewpzjrdv[.]tar
hxxps://hospital[.]fecom[.]in/ryhtvpb[.]tar
hxxps://ims[.]huile-indonesia[.]co[.]id/rdzgbh3y0[.]rar
hxxps://in[.]lostecolines[.]com/lc4rga91[.]rar
hxxps://incsaya[.]agenciademarketingsh[.]com/dxk5qjg[.]zip
hxxps://library[.]skscarsrjn[.]in/cbtwwmk[.]zip
hxxps://live[.]e-lift[.]co[.]za/cf3tc739q[.]rar
hxxps://lms[.]therighteousfoundation[.]org/y7gbouqxx[.]tar
hxxps://loja[.]bigfisher[.]com[.]br/e8190ys[.]rar
hxxps://love[.]e-lift[.]co[.]za/s9e70nf4[.]rar
hxxps://mail1[.]hacachurch[.]org/vz0bzxvy[.]zip
hxxps://mailwiz[.]foryourjobs[.]com/odq19vx6j[.]rar
hxxps://mapasminecraft[.]jonasefonfon[.]com/dqyjk4o[.]zip
hxxps://mmm[.]alprofessor[.]net/eyytdy[.]rar
hxxps://pallascapital[.]katchpurcity[.]com/l631jp[.]tar
hxxps://rapidoinfo[.]seutecnico[.]com/v7sefjd72[.]zip
hxxps://reliableglassaz[.]mbndigital[.]com/jx0q71rjm[.]tar
hxxps://simulador[.]ligapvp[.]com/x5tznk[.]rar
hxxps://sipedang[.]copasset[.]com/idxgu99t[.]rar
hxxps://site2[.]portfolioplus[.]biz/k3i18e[.]rar
hxxps://snipit[.]chriscornell[.]me/cym5jqd[.]tar
hxxps://soru[.]umre[.]tc/yha76hrg[.]zip
hxxps://staging[.]ebenisterie-beluga[.]com/i8u9l4pal[.]zip
hxxps://temp[.]viajalibro[.]com/xp1gnbjlv[.]zip
hxxps://test[.]decojitorinimioare[.]ro/ri9hxe94[.]rar
hxxps://test[.]onefourlab[.]com/bmqn8z9d[.]zip
hxxps://turanturizm[.]umre42[.]com/s0xakk7[.]zip
hxxps://unik[.]trexa[.]id/w98p0wkt[.]zip
hxxps://verifikasi[.]bizmetch[.]com/kslvx9[.]tar
hxxps://vulkan[.]ikigaichile[.]cl/a14wva7j9[.]zip
hxxps://vulkan[.]payroll[.]gadgetoy[.]com/xxgs1t[.]tar
hxxps://vulkanvegas-de[.]katchpurcity[.]com/bd4e3yw[.]tar
hxxps://vulkanvegas-de[.]veronafoodbd[.]com/uiatx1wc[.]zip
hxxps://vulkanvegasbonusmb[.]payroll[.]gadgetoy[.]com/yldqxij[.]tar
hxxps://vulkanvegasbonusuk[.]veronafoodbd[.]com/uetmmlfo[.]rar
hxxps://vulkanvegasdecom[.]ascendingtex[.]com/xxnq2nd[.]tar
hxxps://vulkanvegasgermany[.]ascendingtex[.]com/wkp07t4[.]zip
hxxps://vulkanvegasonline[.]ascendingtex[.]com/klpn1cz[.]tar
hxxps://vulkanvegasonline[.]katchpurcity[.]com/q4vjcmb6[.]zip
hxxps://web[.]almasajid[.]org/pxo138ewn[.]rar
hxxps://wp[.]foryourjobs[.]com/ex39a8k[.]zip
カテゴリ状況：04月19日 [カテゴリ外](※1)
追加済みまたは反映予定：[脅威情報サイト]

hxxps://staging[.]moegreenssf[.]com/dhvokj[.]zip
カテゴリ状況：04月19日 [ゲーム]
追加済みまたは反映予定：[脅威情報サイト]

hxxps://1000-euro-vulkanvegas[.]payroll[.]gadgetoy[.]com/mxq8i2[.]zip
hxxps://1000-euro-vulkanvegas[.]veronafoodbd[.]com/uhk92exd[.]rar
hxxps://admin[.]bluechipconditioning[.]com/c2f790za[.]tar
hxxps://api[.]daddyimpregnant[.]com/k4tqq0[.]rar
hxxps://app[.]fakhreldeen[.]com/yrwxprua[.]rar
hxxps://app[.]ligasys[.]com/i337y99[.]tar
hxxps://app[.]siriagroservices[.]com/v7rj3cozt[.]rar
hxxps://b[.]raniaweb[.]com/o50nbad[.]tar
hxxps://belaumkm[.]jualindonesia[.]com/wfn25r9[.]rar
hxxps://big[.]onefourlab[.]com/oi5rq6w[.]zip
hxxps://blackpasta[.]makefailrepeat[.]com/hd8m2g[.]tar
hxxps://blog[.]benzermedicalequipment[.]com/tigsy1ie[.]rar
hxxps://burhman[.]bexcodeservices[.]com/hmsxxo[.]zip
hxxps://clinicas[.]facturarte[.]com[.]ar/q2gxs9tm[.]tar
hxxps://dover[.]copasset[.]com/d365sl[.]zip
hxxps://e-reporting[.]bjb[.]copasset[.]com/qocoa4[.]tar
hxxps://git[.]bizmetch[.]com/gjefd5mx[.]zip
hxxps://jinvati[.]works[.]jaladatechnologies[.]com/n4h84nx[.]rar
hxxps://kalotsavam[.]cbcmandya[.]com/fs7bc6[.]rar
hxxps://kultur[.]ikram[.]com[.]tr/yfuizwxk[.]rar
hxxps://mail[.]fridel[.]ind[.]br/peciqaauz[.]rar
hxxps://mbbs[.]foryourjobs[.]com/inw24ubq[.]rar
hxxps://medical[.]foryourjobs[.]com/qxu6mmim[.]rar
hxxps://members[.]fuelfitness[.]co[.]uk/w83139wj[.]rar
hxxps://meteorologiaparaamanha[.]pt[.]icetonehosting[.]com/z0hbsuv[.]rar
hxxps://my[.]nzcloudservices[.]nz/kr06lotvz[.]tar
hxxps://ncd[.]worksthal[.]com/vrz7lj[.]zip
hxxps://offer[.]fakhreldeen[.]com/cs4260d8[.]tar
hxxps://old[.]bizmetch[.]com/ysqpchww2[.]rar
hxxps://old[.]sjmarathon[.]org/zuxiopm[.]zip
hxxps://orthomax[.]agenciademarketingsh[.]com/x2n9g0s72[.]tar
hxxps://partner[.]gidicarsng[.]com/illaajv2i[.]zip
hxxps://pos[.]importsbr[.]com/qo5m4ckvp[.]tar
hxxps://sankalpfactory[.]mpiric[.]us/mjna8m1w[.]tar
hxxps://school[.]sipsknp[.]com/ujk3z3l[.]zip
hxxps://scraping[.]bizmetch[.]com/gb60gik0b[.]zip
hxxps://shop[.]g-mart[.]in/ynymlrtdl[.]tar
hxxps://site1[.]portfolioplus[.]biz/dudd5j3z8[.]zip
hxxps://store[.]chriscornell[.]me/pqoail[.]tar
hxxps://test[.]anyoffers[.]com/ezyfeyfv[.]zip
hxxps://test[.]auramakeup[.]ro/pparzie35[.]rar
hxxps://test[.]systemx[.]ca/ggwyur[.]tar
hxxps://test[.]veronafoodbd[.]com/b44hfz[.]zip
hxxps://test104[.]rcmasterassessoria[.]com[.]br/ka8axfx[.]rar
hxxps://testdrive[.]copasset[.]com/d8k5gtrs8[.]zip
hxxps://teste[.]sedac-ma[.]com[.]br/uumm77ku[.]rar
hxxps://theblask[.]balgopalbank[.]com/nuyetdj[.]tar
hxxps://vegasvulkandenmark[.]ascendingtex[.]com/brnm4a21s[.]tar
hxxps://vegasvulkangermany[.]payroll[.]gadgetoy[.]com/ycf2hpgry[.]zip
hxxps://videofesta[.]aikron[.]com[.]br/wmjkm2u[.]tar
hxxps://vulkanvegasbonusde[.]ascendingtex[.]com/sy4qel[.]rar
hxxps://vulkanvegasbonuskr[.]katchpurcity[.]com/jeuvko1jc[.]zip
hxxps://vulkanvegasbonusnl[.]katchpurcity[.]com/y5ekwz[.]zip
hxxps://vulkanvegascom[.]veronafoodbd[.]com/g1eds9[.]rar
hxxps://vulkanvegasissix[.]thegreatfloodsociety[.]org/sm0paaip[.]zip
hxxps://vulkanvegasonline[.]veronafoodbd[.]com/xc6b2n[.]zip
hxxps://webminar[.]bizmetch[.]com/m733ytox[.]zip
hxxps://wp[.]beneircsi[.]hu/cg0t45z[.]zip
カテゴリ状況：04月20日 [カテゴリ外](※1)
追加済みまたは反映予定：[脅威情報サイト]

hxxps://quran[.]sirsyed[.]edu[.]pk/wi800cr5[.]tar
カテゴリ状況：04月20日 [学校・教育施設]
追加済みまたは反映予定：[脅威情報サイト]


上記すべてのURL：ダウンロードフィルター(※2)

（※1）「推奨フィルタ―設定」でブロック可能
（※2）i-FILTER Ver.10.3以降、ファイルのダウンロードを制御することが可能です。