不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2025/01/10
※2025/01/10 更新
マルウェア感染させると考えられるURLを検知（2025/01/10）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://62[.]109[.]16[.]145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest[.]php hxxp://517300cm[.]renyash[.]ru/pipeJavascriptDefaulttrafficWp[.]php |
DCRat |
| URL | hxxps://web[.]klipdywoziy[.]shop/kunnar[.]png hxxp://generatorauc[.]pro/676532b046cfbdecfd800dbf?c=ABVPfmd9ZwUAa4ACAElUFwASAAAAAABG hxxps://versyasist[.]pics/s7[.]mp4 hxxps://tualcaldia[.]com/firma/default[.]mp4 hxxps://bigbrothercreation[.]com/bigbrotherfast[.]mp4 hxxps://versyasist[.]website/sism[.]mp3 hxxps://tintin[.]klipdesak[.]shop/rinko[.]png hxxps://heavens[.]holistic-haven[.]shop/singl5 hxxps://secretarydiff[.]click/api hxxps://advicebedsu[.]click/api hxxps://shearairybom[.]click/api hxxps://migratteabid[.]click/api hxxps://chiefdramatico[.]click/api hxxps://brasspausez[.]click/api hxxps://robinwindyu[.]click/api hxxps://fishubuckerz[.]cyou/api hxxps://breathauthorit[.]cyou/api hxxps://imbibegoos[.]cyou/api hxxps://relatiounces[.]cyou/api hxxps://lethalrleju[.]cyou/api hxxps://induceboori[.]cyou/api hxxps://inventcopper[.]cyou/api hxxps://charminammoc[.]cyou/api hxxps://nippypreciosu[.]cyou/api hxxps://desiredirefus[.]cyou/api hxxps://convergelivek[.]cyou/api hxxps://exultanturue[.]cyou/api hxxps://greatvacuutos[.]cyou/api hxxps://reallycaster[.]cyou/api hxxps://lumbersayr[.]cyou/api hxxps://truculengisau[.]biz/api hxxps://grandiouseziu[.]biz/api hxxps://punishzement[.]biz/api hxxps://nuttyshopr[.]biz/api hxxps://fraggielek[.]biz/api hxxps://spookycappy[.]biz/api hxxps://thumpecnskeak[.]biz/api hxxps://freefacerz[.]sbs/api hxxps://flockanxiius[.]sbs/api hxxps://bashusolici[.]sbs/api |
Lumma Stealer |
| URL | hxxp://212[.]162[.]149[.]153/dPJBwBmM179[.]bin hxxp://212[.]162[.]149[.]153/wgHYssmAVnbZhTGkWydyFowi171[.]bin |
CloudEyE |
| URL | hxxps://94[.]142[.]138[.]48/f9f76ae4bb7811d9[.]php hxxps://162[.]0[.]238[.]10/752e382b4dcf5e3f[.]php hxxps://94[.]142[.]138[.]48/54982f23330528c2/vcruntime140[.]dll hxxps://94[.]142[.]138[.]48/54982f23330528c2/sqlite3[.]dll hxxps://94[.]142[.]138[.]48/54982f23330528c2/mozglue[.]dll hxxps://162[.]0[.]238[.]10/dbe4ef521ee4cc21/vcruntime140[.]dll hxxps://162[.]0[.]238[.]10/dbe4ef521ee4cc21/sqlite3[.]dll hxxps://162[.]0[.]238[.]10/dbe4ef521ee4cc21/mozglue[.]dll hxxp://185[.]201[.]252[.]67/40bd1b7b157a05f2/sqlite3[.]dll hxxp://153[.]92[.]210[.]92/sqlite3[.]dll |
Stealc |
| URL | hxxp://23[.]27[.]51[.]244/chrtrome22[.]exe hxxp://87[.]121[.]86[.]234/sh hxxp://45[.]138[.]16[.]193/phpp[.]exe |
Coinminer |
| URL | hxxp://176[.]119[.]150[.]11/ss hxxp://176[.]119[.]150[.]11/sse hxxp://176[.]119[.]150[.]11/ssi hxxp://176[.]119[.]150[.]11/ssl hxxp://176[.]119[.]150[.]11/sss hxxp://176[.]119[.]150[.]11/ssb hxxp://176[.]119[.]150[.]11/ssg hxxp://176[.]119[.]150[.]11/ssx hxxp://176[.]119[.]150[.]11/ssc hxxp://176[.]119[.]150[.]11/ssp hxxp://176[.]119[.]150[.]11/ssy hxxp://176[.]119[.]150[.]11/sst hxxp://176[.]119[.]150[.]11/ssd hxxp://176[.]119[.]150[.]11/ssh hxxp://38[.]134[.]189[.]10/a-r[.]m-5[.]Sakura hxxp://31[.]43[.]163[.]57/mips |
Bashlite |
| URL | hxxp://193[.]176[.]158[.]185/b0kf3cbabr/plugins/clip64[.]dll hxxp://193[.]176[.]158[.]185/b0kf3cbabr/plugins/cred64[.]dll |
Amadey |
| URL | hxxp://upload[.]vina-host[.]com/get/IFmqapLNrp/Client-built[.]exe hxxp://anonhax[.]site/uploads/load[.]exe |
Quasar RAT |
| URL | hxxp://192[.]3[.]27[.]144/250/sweetnessgoodforgreatnessthingswithgood[.]tIF | SmokeLoader |
| URL | hxxps://www[.]vascocorretora[.]com[.]br/PPI/Lhysknv[.]dat | PureCrypter |
| URL | hxxp://81[.]161[.]238[.]16/files/08012025[.]txt | AsyncRAT |
| URL | hxxp://107[.]172[.]31[.]5/grnnnwdroiddd[.]txt | Agent Tesla |
| URL | hxxp://47[.]90[.]142[.]15:2333/123[.]exe | Meterpreter |
| URL | hxxps://exodvs[.]com/4e1q[.]js hxxps://exodvs[.]com/js[.]php hxxp://jejmbadfmeenlnk[.]top/1[.]php hxxps://bingazo[.]digital/work/index[.]php hxxps://bingazo[.]digital/work/original[.]js hxxps://bingazo[.]digital/work/download[.]php hxxps://mffaccessories[.]com/zz[.]zip |
FAKEUPDATES |
| URL | hxxp://31[.]41[.]244[.]11/files/668741820/DyM4yXX[.]exe | Vidar |
| URL | hxxp://45[.]43[.]36[.]223/x864433[.]elf | ConnectBack |
| URL | hxxp://193[.]233[.]72[.]52/byte/install[.]msi hxxp://lnbox[.]biz/byte/install[.]msi |
MetaStealer |
| URL | hxxps://api[.]telegram[.]org/bot7888110857:AAH_lE30nomQfyzYUPPXbGWeGI9ffBUijsQ/sendMessage?chat_id=7222025033 | Snake Keylogger |
| URL | hxxp://47[.]121[.]190[.]121:81/r9dN hxxp://47[.]121[.]190[.]121:81/aGDq |
Cobalt Strike |
