不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様8社 -
2025/01/07
※2025/01/07 更新
マルウェア感染させると考えられるURLを検知（2025/01/07）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://myguyapp[.]com/c1[.]hta hxxps://myguyapp[.]com/c[.]hta |
Remcos |
| URL | hxxps://admin[.]extranet-recaptcha[.]com/confirm/login/vrPhMxXT hxxps://extranet-captcha[.]com/recaptcha-verify[.]html hxxps://simplerwebs[.]space/anrek[.]mp4 hxxps://klipdesak[.]shop/title[.]mp4 hxxps://yokesandusj[.]sbs/api hxxps://cabf[.]klipdesak[.]shop/smugle[.]bd hxxps://klipdiheqoe[.]shop/ruwkl[.]png hxxps://grooveoiy[.]cyou/api hxxps://heneyelijhr[.]click/api hxxps://exchangecumb[.]click/api hxxps://traygullibalkerj[.]click/api hxxps://giverlevekj[.]click/api hxxps://islandbreadyu[.]click/api hxxps://dreamlonggev[.]click/api hxxps://aloofysofar[.]click/api hxxps://spottercurvei[.]click/api hxxps://swiftstringjuo[.]click/api hxxps://cutefingeuker[.]click/api hxxps://shockingrefle[.]click/api hxxps://ugliesttabke[.]click/api hxxps://sloppymisskr[.]click/api hxxps://censeractersj[.]click/api hxxps://deletteproposez[.]click/api hxxps://passhudmrue[.]click/api hxxps://antssneakr[.]click/api hxxps://regularlavhis[.]click/api hxxps://diseasecooky[.]click/api hxxps://bluedlsahwi[.]click/api hxxps://titleviewvv[.]click/api hxxps://lushgammyjs[.]click/api hxxps://lastlossunbag[.]click/api hxxps://appliacnwatter[.]click/api hxxps://rainywearyrs[.]cyou/api hxxps://wrongyfallyk[.]click/api hxxps://healbewilk[.]cyou/api hxxps://glowscarrytsv[.]sbs/api hxxp://cloudewahsj[.]shop/api hxxp://trk[.]zoningweb[.]com/67755e26b1a828e7fb869370 hxxp://generatorauc[.]pro/676532b046cfbdecfd800dbf?c=ACQxeWe6XgUAa4ACAEdCFwAoAAAAAAAR hxxps://siffinisherz[.]sbs/api hxxp://5[.]253[.]59[.]212:7777/confirma3[.]com/Captcha hxxps://carveforutune[.]click/api hxxps://paymommenro[.]click/api hxxps://quitaffternav[.]sbs/api hxxps://movespendys[.]sbs/api hxxps://song-ritzy[.]sbs/api |
Lumma Stealer |
| URL | hxxp://147[.]124[.]216[.]113/image[.]exe | DBatLoader |
| URL | hxxp://337703cm[.]n9sh[.]top/Basecentral[.]php | DCRat |
| URL | hxxp://45[.]61[.]185[.]69:20722/b/mips | Kaiji |
| URL | hxxp://6sz[.]ru/[.]a/gdb hxxp://6sz[.]ru/tt/armv4eb hxxp://6sz[.]ru/tt/arc hxxp://6sz[.]ru/tt/mips hxxp://6sz[.]ru/ss/armv7l hxxp://6sz[.]ru/[.]a/busybox hxxp://6sz[.]ru/vv/mipsel hxxp://6sz[.]ru/vv/armv6l hxxp://6sz[.]ru/vv/armv7l hxxp://6sz[.]ru/vv/armv5l hxxp://6sz[.]ru/ss/armv4l hxxp://6sz[.]ru/tt/armv5l hxxp://6sz[.]ru/vv/armv4l hxxp://6sz[.]ru/tt/sh4 hxxp://6sz[.]ru/vv/riscv32 hxxp://6sz[.]ru/vv/armv4eb hxxp://6sz[.]ru/ee/armv6l hxxp://6sz[.]ru/vv/arc hxxp://6sz[.]ru/ee/armv7l hxxp://6sz[.]ru/ss/armv5l hxxp://6sz[.]ru/tt/riscv32 hxxp://6sz[.]ru/tt/armv6l hxxp://6sz[.]ru/vv/sparc hxxp://6sz[.]ru/tt/armv7l hxxp://6sz[.]ru/vv/powerpc hxxp://6sz[.]ru/ss/armv6l hxxp://6sz[.]ru/ee/armv4l hxxp://6sz[.]ru/vv/sh4 hxxp://6sz[.]ru/tt/armv4l hxxp://6sz[.]ru/vv/i686 hxxp://6sz[.]ru/ss/armv4eb hxxp://6sz[.]ru/tt/powerpc hxxp://6sz[.]ru/ee/armv5l hxxp://6sz[.]ru/tt/sparc hxxp://6sz[.]ru/tt/mips64 hxxp://6sz[.]ru/[.]a/socat hxxp://6sz[.]ru/[.]a/strace hxxp://185[.]142[.]53[.]43/4gs hxxp://185[.]142[.]53[.]205/mips hxxp://185[.]142[.]53[.]205/emips hxxp://185[.]142[.]53[.]205/esh4 hxxp://185[.]142[.]53[.]205/mpsl hxxp://185[.]142[.]53[.]205/empsl |
Bashlite |
| URL | hxxp://185[.]215[.]113[.]16/inc/696969[.]exe hxxps://185[.]219[.]81[.]132/4f85e0bfc60adccc/mozglue[.]dll hxxps://185[.]219[.]81[.]132/4f85e0bfc60adccc/vcruntime140[.]dll hxxps://185[.]219[.]81[.]132/4f85e0bfc60adccc/sqlite3[.]dll hxxps://91[.]103[.]253[.]18/1655d0b0e8ecab2d[.]php hxxps://81[.]200[.]146[.]58/linewindowstrack[.]php |
Stealc |
| URL | hxxps://tmpfiles[.]org/dl/19053641/build[.]exe hxxp://77[.]90[.]22[.]45/build[.]exe |
RedLine Stealer |
| URL | hxxp://77[.]90[.]22[.]45/server[.]exe | NjRAT |
| URL | hxxp://jujuju[.]lat/files/1[.]exe | Quasar RAT |
| URL | hxxp://bfhdkgmmhdbikgj[.]top/1[.]php hxxps://netgenius[.]life/work/original[.]js hxxps://netgenius[.]life/work/index[.]php hxxps://netgenius[.]life/work/download[.]php hxxps://ganhogosi[.]xyz/bbbb[.]zip hxxps://ecrut[.]com/5r8k[.]js hxxps://ecrut[.]com/js[.]php hxxps://thm[.]slot[.]buyaiphoneonline[.]com/merchantServices |
FAKEUPDATES |
| URL | hxxps://palmsizehelis[.]com/updater2[.]php | Satacom |
| URL | hxxp://175[.]107[.]1[.]154:44402/Mozi[.]m hxxp://103[.]124[.]138[.]115:37923/Mozi[.]m |
Mozi |
