不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様3社 -
2024/12/26
※2024/12/26 更新
マルウェア感染させると考えられるURLを検知（2024/12/26）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://wdxd[.]office[.]enewlaw[.]com/merchantServices hxxp://nubxz4ubhxz9i[.]top/1[.]php hxxps://haimasher[.]xyz/work/download[.]php hxxps://haimasher[.]xyz/work/original[.]js hxxps://haimasher[.]xyz/work/index[.]php hxxps://suclub[.]xyz/work/original[.]js hxxps://suclub[.]xyz/work/index[.]php hxxps://suclub[.]xyz/work/download[.]php hxxps://fastard[.]com/v6s5[.]js hxxps://fastard[.]com/js[.]php hxxps://iulc[.]office[.]enewlaw[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxp://62[.]109[.]25[.]165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp[.]php hxxp://whware[.]top/RequestLowGeoLongpollWordpress[.]php hxxp://328579cm[.]renyash[.]ru/VmMulti[.]php |
DCRat |
| URL | hxxp://154[.]216[.]17[.]112/t hxxp://154[.]216[.]17[.]112/p hxxp://154[.]216[.]17[.]112/vv/sh4 hxxp://154[.]216[.]17[.]112/tt/sh4 hxxp://154[.]216[.]17[.]112/tt/armv4eb hxxp://154[.]216[.]17[.]112/tt/armv4l hxxp://64[.]49[.]14[.]19/sh4 hxxp://64[.]49[.]14[.]19/mpsl hxxp://64[.]49[.]14[.]19/mips hxxp://154[.]216[.]17[.]112/tt/armv6l hxxp://185[.]157[.]247[.]35:81/mips hxxp://212[.]64[.]215[.]71/arm hxxp://5[.]230[.]227[.]203/t hxxp://5[.]230[.]227[.]203/p hxxp://5[.]230[.]227[.]203/tt/armv7l hxxp://5[.]230[.]227[.]203/tt/armv4eb hxxp://5[.]230[.]227[.]203/tt/armv6l hxxp://5[.]230[.]227[.]203/tt/armv4l hxxp://5[.]230[.]227[.]203/vv/sh4 hxxp://5[.]230[.]227[.]203/tt/sh4 hxxp://5[.]230[.]227[.]203/tt/armv5l hxxp://5[.]230[.]227[.]203/v hxxp://185[.]142[.]53[.]43/mips |
Bashlite |
| URL | hxxps://www[.]mediafire[.]com/file/yi7p0p4yi0yttc1/EZLauncher_v1[.]0[.]zip/file hxxps://www[.]mediafire[.]com/file/dozy4usjsyigx5l/SoftWare_v1[.]8[.]zip/file hxxps://www[.]mediafire[.]com/file/s6kswowgsvqb56h/Armageddon[.]rar/file |
Lumma Stealer |
| URL | hxxp://135[.]181[.]65[.]216/4a21a126be249f0d/freebl3[.]dll hxxp://135[.]181[.]65[.]216/4a21a126be249f0d/vcruntime140[.]dll hxxp://135[.]181[.]65[.]216/4a21a126be249f0d/mozglue[.]dll hxxp://135[.]181[.]65[.]216/4a21a126be249f0d/sqlite3[.]dll hxxp://135[.]181[.]65[.]216/4a21a126be249f0d/msvcp140[.]dll hxxp://135[.]181[.]65[.]216/4a21a126be249f0d/softokn3[.]dll hxxp://135[.]181[.]65[.]216/4a21a126be249f0d/nss3[.]dll |
Stealc |
| URL | hxxps://starbursttc[.]top/YTZhZjliODdlYTI4/ | Coper |
| URL | hxxp://154[.]198[.]49[.]151/22[.]exe | ValleyRAT |
| URL | hxxp://165[.]3[.]86[.]135/m68k hxxp://165[.]3[.]86[.]135/ppc |
MooBot |
