不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様4社 -
2024/12/25
※2024/12/25 更新
マルウェア感染させると考えられるURLを検知（2024/12/25）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://xhwja[.]office[.]enewlaw[.]com/merchantServices hxxps://umqa[.]office[.]enewlaw[.]com/merchantServices hxxps://we-careu[.]xyz/work/download[.]php hxxps://dhusch[.]com/js[.]php hxxps://we-careu[.]xyz/work/index[.]php hxxps://dhusch[.]com/6vs5[.]js hxxps://we-careu[.]xyz/work/original[.]js hxxps://ztzb[.]office[.]enewlaw[.]com/merchantServices hxxps://dpc[.]office[.]enewlaw[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxp://87[.]120[.]113[.]47/tt/armv4l hxxp://87[.]120[.]113[.]47/vv/sh4 hxxp://87[.]120[.]113[.]47/tt/armv6l hxxp://87[.]120[.]113[.]47/tt/armv7l hxxp://87[.]120[.]113[.]47/tt/sh4 hxxp://87[.]120[.]113[.]47/tt/superh hxxp://87[.]120[.]113[.]52/tt/mips64 hxxp://87[.]120[.]113[.]52/p hxxp://87[.]120[.]113[.]52/vv/sparc hxxp://87[.]120[.]113[.]52/vv/riscv32 hxxp://87[.]120[.]113[.]52/vv/mipsel hxxp://87[.]120[.]113[.]52/vv/armv5l hxxp://87[.]120[.]113[.]52/vv/armv4l hxxp://87[.]120[.]113[.]52/tt/superh hxxp://87[.]120[.]113[.]52/vv/sh4 hxxp://87[.]120[.]113[.]52/vv/armv6l hxxp://87[.]120[.]113[.]52/vv/armv4eb hxxp://87[.]120[.]113[.]52/vv/i686 hxxp://87[.]120[.]113[.]52/vv/powerpc hxxp://87[.]120[.]113[.]52/vv/arc hxxp://87[.]120[.]113[.]52/vv/mips hxxp://87[.]120[.]113[.]52/vv/armv7l hxxp://87[.]120[.]113[.]52/vv/mips64 hxxp://87[.]120[.]113[.]52/tt/armv7l hxxp://87[.]120[.]113[.]52/tt/sh4 hxxp://87[.]120[.]113[.]52/tt/armv4l hxxp://87[.]120[.]113[.]52/tt/armv6l hxxp://87[.]120[.]113[.]52/tt/armv4eb hxxp://87[.]120[.]113[.]52/t hxxp://87[.]120[.]113[.]47/p hxxp://87[.]120[.]113[.]47/tt/armv4eb |
Bashlite |
| URL | hxxps://bitbucket[.]org/diciembre241/readerpdf/downloads/Final12[.]24[.]exe hxxp://62[.]60[.]226[.]24/file/MicrosoftWORD[.]exe |
PrivateLoader |
| URL | hxxps://158[.]69[.]36[.]15/files/xWorm[.]txt hxxps://158[.]69[.]36[.]15/files/xwormvideo[.]txt |
AsyncRAT |
| URL | hxxps://macphotoeditor[.]shop/singl6[.]mp4 | Emmenhtal |
| URL | hxxp://incomputersolutions[.]com/o/9[.]png hxxp://incomputersolutions[.]com/o/1[.]png hxxp://incomputersolutions[.]com/o/7[.]png hxxp://incomputersolutions[.]com/o/4[.]png hxxp://incomputersolutions[.]com/o/10[.]png hxxp://incomputersolutions[.]com/o/8[.]png hxxp://incomputersolutions[.]com/o/11[.]png hxxp://incomputersolutions[.]com/o/o[.]png hxxp://incomputersolutions[.]com/o/5[.]png hxxp://incomputersolutions[.]com/o/12[.]png hxxp://incomputersolutions[.]com/o/2[.]png hxxp://incomputersolutions[.]com/o/3[.]png hxxp://incomputersolutions[.]com/o/6[.]png |
NetSupportManager RAT |
| URL | hxxps://bitbucket[.]org/mynewworkspace123312/scnd/downloads/SurveillanceWalls[.]exe hxxps://bitbucket[.]org/mynewworkspace123312/scnd/downloads/FormattingCharitable[.]exe hxxp://62[.]60[.]226[.]24/file/crypt_file[.]exe hxxps://fannleadyn[.]click/api hxxps://moanungsnake[.]click/api hxxps://sickyicyerh[.]click/api hxxps://enterwahsh[.]biz/api hxxps://observerfry[.]lat/api |
Lumma Stealer |
| URL | hxxps://bitbucket[.]org/mynewworkspace123312/scnd/downloads/AHPOBS[.]exe hxxps://bitbucket[.]org/mynewworkspace123312/scnd/downloads/install[.]exe |
Loda |
| URL | hxxps://denimcard[.]com/updater[.]php hxxps://trailbuddymaps[.]com/updater[.]php |
Satacom |
| URL | hxxp://twentytk20ht[.]top/v1/upload[.]php | CryptBot |
| URL | hxxp://117[.]215[.]219[.]183:56294/Mozi[.]m | Mozi |
| URL | hxxp://185[.]231[.]69[.]191/f190e2808a5419c3[.]php hxxp://185[.]231[.]69[.]191/ec05bb5a9eb90166/nss3[.]dll hxxp://185[.]231[.]69[.]191/ec05bb5a9eb90166/sqlite3[.]dll hxxp://185[.]231[.]69[.]191/ec05bb5a9eb90166/freebl3[.]dll hxxp://185[.]231[.]69[.]191/ec05bb5a9eb90166/softokn3[.]dll hxxp://185[.]231[.]69[.]191/ec05bb5a9eb90166/vcruntime140[.]dll hxxp://185[.]231[.]69[.]191/ec05bb5a9eb90166/mozglue[.]dll hxxp://185[.]231[.]69[.]191/ec05bb5a9eb90166/msvcp140[.]dll hxxp://135[.]181[.]65[.]216/ee45b7c5e4cb75cb[.]php |
Stealc |
| URL | hxxps://bitbucket[.]org/mynewworkspace123312/scnd/downloads/tiktok_adult[.]exe | Lumar |
| URL | hxxp://66[.]63[.]187[.]173/auth/login hxxp://138[.]124[.]101[.]41/auth/login hxxp://45[.]130[.]145[.]152/auth/login |
Meduza Stealer |
| URL | hxxp://121[.]40[.]55[.]28/aQfE | Cobalt Strike |
