不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/01/14
※2025/01/14 更新
マルウェア感染させると考えられるURLを検知（2025/01/14）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://506691cm[.]renyash[.]ru/vmpoll[.]php hxxp://89[.]23[.]100[.]242/cryptoBOT[.]exe hxxp://89[.]23[.]100[.]242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest[.]php hxxp://586580cm[.]renyash[.]ru/eternallowProcessDefaultLinuxWindowsflowerTrackTemp[.]php hxxp://588538cm[.]renyash[.]ru/polldle[.]php hxxp://886972cm[.]renyash[.]ru/externalImage[.]php hxxp://480344cm[.]renyash[.]ru/lineSecureUpdateprocessdefaultTestPublicUploadsTemporary[.]php hxxp://91[.]211[.]249[.]46/3vmApi/8/poll2GeneratorPython/ImagepipeRequestsecureprocesswpPublic[.]php hxxp://28954cm[.]darkproducts[.]ru/L1nc0In[.]php hxxp://80[.]66[.]81[.]173/1/9dbWindowsWindows/2/Windows21Cdn/BaseDb9/ProcessorGeoPollProcess/PhpPoll7temporary/providerpollhttpProcessflowerAsyncdle[.]php |
DCRat |
| URL | hxxp://151[.]106[.]34[.]115:6573/svhost[.]exe hxxp://45[.]138[.]16[.]193/win[.]exe hxxp://185[.]215[.]113[.]66/32[.]exe hxxp://66[.]63[.]187[.]250/frek/gem2[.]exe hxxp://45[.]138[.]16[.]193/install[.]bat hxxp://66[.]63[.]187[.]250/zmk/gem2[.]exe hxxp://66[.]63[.]187[.]250/zcry/gem2[.]exe hxxp://mail[.]simon[.]sttdiakonos[.]ac[.]id/zcry/gem2[.]exe hxxp://kasihcommunityschool[.]sch[.]id/zcry/gem2[.]exe hxxps://66[.]63[.]187[.]250/zcry/gem2[.]exe hxxps://mail[.]simon[.]sttdiakonos[.]ac[.]id/zcry/gem2[.]exe hxxps://kasihcommunityschool[.]sch[.]id/zcry/gem2[.]exe |
Coinminer |
| URL | hxxp://versyasist[.]space/rii[.]mp4 hxxps://rainstorm[.]cyou/v845734584/SaveManager[.]zip hxxp://rainstorm[.]cyou/o[.]txt hxxps://liftgoodus[.]cfd/api hxxps://unputplycke[.]cfd/api hxxps://detailshaeje[.]cfd/api hxxps://versyasist[.]space/rii[.]mp4 hxxps://littlenotii[.]biz/api hxxps://marketlumpe[.]biz/api hxxps://hardtofinner[.]cfd/api hxxps://hoppricerwir[.]cyou/api hxxps://whisperusz[.]biz/api hxxps://fastysticke[.]sbs/api hxxps://quinceisoz[.]cam/api hxxp://versyasist[.]guru/s6[.]mp4 hxxps://loosearendos[.]shop/api hxxps://chessimpendero[.]click/api hxxps://annoyingth[.]click/api hxxps://rampnatleadk[.]click/api hxxps://homelessdejs[.]cyou/api hxxps://enthuasticsa[.]cyou/api hxxps://toemagnifuy[.]biz/api hxxps://openlievenj[.]sbs/api hxxps://rhetoricakue[.]cyou/api hxxps://fill-tomap[.]com/megamon[.]zip hxxp://31[.]41[.]244[.]11/files/ts1388/random[.]exe hxxps://jubbenjusk[.]biz/api hxxps://beliefbidu[.]cyou/api hxxps://shitwavvez[.]cyou/api hxxps://goldyhanders[.]cyou/api hxxps://grandfathezz[.]cyou/api hxxps://sailstrangej[.]cyou/api hxxps://feerdaiks[.]biz/api hxxps://unbecoming[.]shop/api hxxp://185[.]215[.]113[.]16/inc/whiteshadow[.]exe hxxps://misha-lomonosov[.]com/api hxxps://knotgloosi[.]shop/api hxxps://didacticwllo[.]shop/api hxxps://abandonbubbke[.]shop/api hxxps://kitealivejz[.]shop/api hxxps://getflashygai[.]shop/api hxxps://cabbagebettys[.]shop/api hxxps://joinmilkeu[.]shop/api hxxps://cravebzestysu[.]shop/api hxxps://chasedamagee[.]click/api hxxps://peacebrothez[.]click/api hxxps://receivefishe[.]click/api hxxps://noiselessreis[.]click/api hxxps://bustlingwakef[.]click/api hxxps://washytortt[.]click/api hxxps://degreehourz[.]click/api hxxps://bringybooky[.]click/api hxxps://adjoininstiff[.]click/api hxxps://tackyguarrd[.]cyou/api hxxps://seatobeyue[.]cyou/api hxxps://magnifudizy[.]cyou/api hxxps://deprivedsna[.]cyou/api hxxps://changeablemagent[.]cyou/api hxxps://finickypwk[.]lat/api hxxps://savorraiykj[.]lat/api hxxps://bloodyswif[.]lat/api hxxps://miniatureyu[.]lat/api hxxps://shoefeatthe[.]lat/api hxxps://leggelatez[.]lat/api hxxps://kickykiduz[.]lat/api hxxps://washyceehsu[.]lat/api hxxps://plodnittpw[.]lat/api hxxps://hoefeatthe[.]lat/api hxxps://ashyceehsu[.]lat/api hxxps://avorraiykj[.]lat/api hxxps://iniatureyu[.]lat/api hxxps://eggelatez[.]lat/api hxxps://inickypwk[.]lat/api hxxps://ickykiduz[.]lat/api hxxps://urtainykeo[.]lat/api hxxps://loodyswif[.]lat/api hxxps://curtainykeo[.]lat/api hxxps://royaltyfree[.]click/api hxxps://medicaljummtj[.]shop/api hxxps://burnwastefulke[.]shop/api hxxps://shootmixxej[.]shop/api hxxps://ripehungryde[.]click/api hxxps://overtyfruitz[.]shop/api hxxps://skatestringje[.]click/api hxxps://kiterexchangez[.]click/api hxxps://cultureddirtys[.]click/api hxxps://supplyedtwoz[.]click/api hxxps://produceresov[.]click/api hxxps://corruptedusz[.]cyou/api hxxps://motivatefaul[.]cyou/api hxxps://rifledford[.]cyou/api hxxps://breakfasutwy[.]cyou/api hxxps://welcomeabjesu[.]cyou/api hxxps://priceygoveiuz[.]cyou/api hxxps://fascinatterz[.]cyou/api hxxps://thepremiumstuffs[.]fun/s7[.]mp4 hxxps://thepremiumstuffs[.]shop/s5[.]mp4 hxxps://thepremiumstuffs[.]click/s6[.]mp4 hxxps://versyasist[.]live/s6[.]mp4 hxxps://thepremiumstuffs[.]website/s5[.]mp4 hxxps://thepremiumstuffs[.]site/s5[.]mp4 hxxps://thepremiumstuffs[.]xyz/s5[.]mp4 hxxps://thepremiumstuffs[.]click/s5[.]mp4 hxxps://thepremiumstuffs[.]pics/s5[.]mp4 hxxps://thepremiumstuffs[.]fun/s5[.]mp4 hxxps://thepremiumstuffs[.]space/s5[.]mp4 hxxps://thepremiumstuffs[.]online/s5[.]mp4 hxxps://thepremiumstuffs[.]quest/s5[.]mp4 hxxps://googlsearchings[.]wiki/s5[.]mp3 hxxps://googlsearchings[.]site/s5[.]mp3 hxxps://googlsearchings[.]xyz/s5[.]mp3 hxxps://googlsearchings[.]quest/s5[.]mp3 hxxps://googlsearchings[.]click/s5[.]mp3 hxxps://googlsearchings[.]sbs/s5[.]mp3 hxxps://googlsearchings[.]guru/s5[.]mp3 hxxps://googlsearchings[.]art/s5[.]mp3 hxxps://googlsearchings[.]online/s5[.]mp3 hxxps://googlsearchings[.]cfd/s5[.]mp3 |
Lumma Stealer |
| URL | hxxp://87[.]121[.]86[.]2:8080/mimikatz[.]exe | MimiKatz |
| URL | hxxp://103[.]130[.]212[.]99/mips hxxp://45[.]95[.]169[.]133/hiddenbin/boatnet[.]spc hxxp://146[.]19[.]24[.]68/arm6 hxxp://146[.]19[.]24[.]68/harm hxxp://146[.]19[.]24[.]68/arm5 hxxp://154[.]213[.]187[.]11/bins/camp[.]spc hxxp://154[.]213[.]187[.]11/bins/camp[.]sh4 hxxp://103[.]130[.]212[.]99/b hxxp://103[.]130[.]212[.]99/bx hxxp://103[.]130[.]212[.]99/gocl hxxp://103[.]130[.]212[.]99/wget[.]sh hxxp://103[.]130[.]212[.]99/weed |
Bashlite |
| URL | hxxp://87[.]120[.]116[.]179/files/frutos[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/ENVS/B1[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/ENVS/DS9[.]txt hxxps://api[.]telegram[.]org/bot7935009733:AAGBu91qWsmUHTs2GabvLt2Z62A3M4QqyqE/sendMessage?chat_id=6779103906 hxxps://api[.]telegram[.]org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069 |
AsyncRAT |
| URL | hxxps://185[.]215[.]113[.]209/Fru7Nk9/Login[.]php hxxps://45[.]9[.]74[.]182/b7djsdcpcz/index[.]php hxxp://193[.]106[.]191[.]112/pp2dCa3kE/Plugins/cred[.]dll |
Amadey |
| URL | hxxps://45[.]88[.]76[.]207/b38a59c5b911e689[.]php hxxps://91[.]215[.]85[.]213/4f230c0dd4efa481[.]php hxxps://77[.]105[.]164[.]86/fb31c18012444fcf/sqlite3[.]dll hxxp://95[.]215[.]204[.]109/bf95f9e2c9dd170d/sqlite3[.]dll hxxp://51[.]83[.]130[.]190/msvcp140[.]dll hxxp://34[.]105[.]147[.]92/gate/sqlite3[.]dll hxxps://91[.]103[.]253[.]170/4a7a990a47cd52ad[.]php hxxps://77[.]83[.]175[.]91/18e58bd9b3a5293b/vcruntime140[.]dll hxxps://91[.]103[.]252[.]143/522d6f9280951d7f[.]php hxxp://154[.]216[.]20[.]246/f493d73b2e06dbd2/freebl3[.]dll hxxp://154[.]216[.]20[.]246/f493d73b2e06dbd2/softokn3[.]dll hxxp://154[.]216[.]20[.]246/f493d73b2e06dbd2/msvcp140[.]dll hxxp://154[.]216[.]20[.]246/f493d73b2e06dbd2/nss3[.]dll hxxp://185[.]215[.]113[.]206/68b591d6548ec281/softokn3[.]dll? hxxp://154[.]216[.]20[.]246/f493d73b2e06dbd2/sqlite3[.]dll hxxp://154[.]216[.]20[.]246/f493d73b2e06dbd2/vcruntime140[.]dll hxxp://154[.]216[.]20[.]246/f493d73b2e06dbd2/mozglue[.]dll hxxps://45[.]88[.]76[.]207/4b4e7c1351c9e2eb/sqlite3[.]dll hxxps://77[.]220[.]212[.]32/eb51242cada87444[.]php hxxps://77[.]83[.]175[.]91/69d96d770568584a[.]php |
Stealc |
| URL | hxxp://www[.]ategorie-polecane-831[.]buzz/a03d/ hxxp://www[.]behm[.]info/a03d/ hxxp://www[.]avid-hildebrand[.]info/a03d/ hxxp://www[.]bfootball[.]net/a03d/ hxxp://www[.]arimatch-in[.]legal/a03d/ hxxp://www[.]asglobalaz[.]shop/a03d/ hxxp://www[.]atidiri[.]fun/a03d/ hxxp://www[.]argloscaremedia[.]info/a03d/ hxxp://www[.]alata[.]xyz/a03d/ hxxp://www[.]aportsystems[.]store/a03d/ hxxp://www[.]agfov4u[.]xyz/a03d/ hxxp://www[.]agiararoma[.]net/a03d/ hxxp://www[.]aja168e[.]live/a03d/ hxxp://www[.]8oosnny[.]xyz/a03d/ hxxp://www[.]9769[.]mobi/a03d/ hxxp://www[.]5970[.]pizza/a03d/ hxxp://www[.]72266[.]vip/a03d/ hxxp://www[.]52628[.]xyz/a03d/ hxxp://www[.]1fuli9902[.]shop/a03d/ hxxp://www[.]0090[.]pizza/a03d/ hxxp://www[.]cebepu[.]info/a03d/ hxxp://www[.]dj1[.]lat/a03d/ hxxp://www[.]duxrib[.]xyz/a03d/ hxxp://www[.]eatbox[.]store/a03d/ hxxp://www[.]eepvid[.]xyz/a03d/ hxxp://www[.]eleefmestreech[.]online/a03d/ hxxp://www[.]elnqdjc[.]shop/a03d/ hxxp://www[.]encortex[.]beauty/a03d/ hxxp://www[.]enelog[.]xyz/a03d/ hxxp://www[.]ensentoto[.]cloud/a03d/ hxxp://www[.]erpangina-treatment-views[.]sbs/a03d/ hxxp://www[.]fath[.]shop/a03d/ hxxp://www[.]gmgslzdc[.]sbs/a03d/ hxxp://www[.]haoyun[.]website/a03d/ hxxp://www[.]inggraphic[.]pro/a03d/ hxxp://www[.]ings-hu-13[.]today/a03d/ hxxp://www[.]istromarmitaria[.]online/a03d/ hxxp://www[.]itiz[.]xyz/a03d/ hxxp://www[.]ive-neurozoom[.]store/a03d/ hxxp://www[.]kkkk[.]shop/a03d/ hxxp://www[.]leurdivin[.]online/a03d/ hxxp://www[.]locarry[.]store/a03d/ hxxp://www[.]lphatechblog[.]xyz/a03d/ hxxp://www[.]lsaadmart[.]store/a03d/ hxxp://www[.]mmarketing[.]xyz/a03d/ hxxp://www[.]ndogaming[.]online/a03d/ hxxp://www[.]nfluencer-marketing-13524[.]bond/a03d/ hxxp://www[.]nline-advertising-34790[.]bond/a03d/ hxxp://www[.]oftware-download-92806[.]bond/a03d/ hxxp://www[.]oliticalpatriot[.]net/a03d/ hxxp://www[.]olourclubbet[.]shop/a03d/ hxxp://www[.]ome-renovation-86342[.]bond/a03d/ hxxp://www[.]onvert[.]today/a03d/ hxxp://www[.]oonlightshadow[.]shop/a03d/ hxxp://www[.]orashrine[.]store/a03d/ hxxp://www[.]orld-visa-center[.]online/a03d/ hxxp://www[.]otelhafnia[.]info/a03d/ hxxp://www[.]otorcycle-loans-19502[.]bond/a03d/ hxxp://www[.]rumpchiefofstaff[.]store/a03d/ hxxp://www[.]romatografia[.]online/a03d/ hxxp://www[.]si[.]art/a03d/ hxxp://www[.]urvivalflashlights[.]shop/a03d/ hxxp://www[.]voyagu[.]info/a03d/ hxxp://www[.]xurobo[.]info/a03d/ hxxp://www[.]yselection[.]xyz/a03d/ hxxp://www[.]utomation-tools-86423[.]bond/x07y/ hxxp://www[.]ut-mastera-remstir[.]online/x07y/ hxxp://www[.]usiness-printer-69123[.]bond/pp11/ hxxp://www[.]u-thiensu[.]online/a02d/ hxxp://www[.]sychology-degree-92767[.]bond/a02d/ hxxp://www[.]sphalt-jobs-98701[.]bond/x07y/ hxxp://www[.]ruck-driver-jobs-86708[.]bond/a02d/ hxxp://www[.]ruck-driver-training-44635[.]bond/x07y/ hxxp://www[.]ruck-driver-jobs-58337[.]bond/a02d/ hxxp://www[.]pps-27859[.]bond/pp11/ hxxp://www[.]orklift-jobs-76114[.]bond/a02d/ hxxp://www[.]oofing-jobs-29700[.]bond/a02d/ hxxp://www[.]oofing-jobs-74429[.]bond/a02d/ hxxp://www[.]onitoring-devices-97381[.]bond/x07y/ hxxp://www[.]oofcarpenternearme-jp[.]xyz/a02d/ hxxp://www[.]onitoring-devices-18459[.]bond/x07y/ hxxp://www[.]om-exchange-nft370213[.]sbs/a02d/ hxxp://www[.]ome-remodeling-83980[.]bond/pp11/ hxxp://www[.]oftware-engineering-27699[.]bond/a02d/ hxxp://www[.]octor-who-lordfilm[.]store/x07y/ hxxp://www[.]oftware-download-37623[.]bond/a02d/ hxxp://www[.]nline-gaming-56806[.]bond/x07y/ hxxp://www[.]nfluencer-marketing-41832[.]bond/a02d/ hxxp://www[.]nline-advertising-19201[.]bond/pp11/ hxxp://www[.]nderwater-corporation[.]net/pp11/ hxxp://www[.]nfluencer-marketing-21638[.]bond/pp11/ hxxp://www[.]isa-sponsored-jobs-8726311[.]live/x07y/ hxxp://www[.]itchen-remodeling-41686[.]bond/a02d/ hxxp://www[.]inomiya-furemachi[.]net/x07y/ hxxp://www[.]ikings-valhala-lordfilm[.]store/x07y/ hxxp://www[.]ental-implants-67768[.]bond/x07y/ hxxp://www[.]ental-implants-25513[.]bond/x07y/ hxxp://www[.]eat-pumps-31610[.]bond/a02d/ hxxp://www[.]earch-solar-installer-top[.]today/a02d/ hxxp://www[.]ataract-surgery-54329[.]bond/x07y/ hxxp://www[.]arehouse-inventory-94254[.]bond/pp11/ hxxp://www[.]asteri-grandavenue[.]info/pp11/ hxxp://www[.]arehouse-inventory-23414[.]bond/x07y/ hxxp://www[.]arehouse-inventory-39846[.]bond/pp11/ hxxp://www[.]aahoma-inter5[.]rest/x07y/ hxxp://www[.]11-14-6b333331[.]shop/x07y/ hxxp://www[.]yltcoventures[.]net/pp11/ hxxp://www[.]yeverydayessentials[.]store/x07y/ hxxp://www[.]yhbvc[.]xyz/a02d/ hxxp://www[.]xocivo[.]info/x07y/ hxxp://www[.]yblinds[.]xyz/a02d/ hxxp://www[.]vorachem[.]xyz/a02d/ hxxp://www[.]winomore[.]net/pp11/ hxxp://www[.]utsidetheguardrails[.]net/x07y/ hxxp://www[.]vintoken[.]xyz/pp11/ hxxp://www[.]utecak[.]shop/x07y/ hxxp://www[.]undialluzecasa[.]online/pp11/ hxxp://www[.]untech[.]tech/x07y/ hxxp://www[.]ukusindo4dpools[.]net/a02d/ hxxp://www[.]umpstartsplus[.]website/pp11/ hxxp://www[.]ujas[.]cloud/pp11/ hxxp://www[.]tiwebu[.]info/a02d/ hxxp://www[.]tudentcare[.]xyz/pp11/ hxxp://www[.]tyleyourvibe[.]shop/a02d/ hxxp://www[.]tel[.]xyz/pp11/ hxxp://www[.]tg88biz[.]icu/pp11/ hxxp://www[.]tarhub[.]website/x07y/ hxxp://www[.]tartupapps[.]cloud/pp11/ hxxp://www[.]svc[.]lat/x07y/ hxxp://www[.]styvd[.]xyz/pp11/ hxxp://www[.]su41k7v[.]xyz/x07y/ hxxp://www[.]ssiilbio[.]shop/pp11/ hxxp://www[.]strange[.]store/a02d/ hxxp://www[.]sbank[.]homes/pp11/ hxxp://www[.]sbx[.]tech/x07y/ hxxp://www[.]rumpchiefofstaff[.]store/a02d/ hxxp://www[.]rwebsolution[.]tech/pp11/ hxxp://www[.]rrm[.]lat/a02d/ hxxp://www[.]rimehealthlabs[.]online/pp11/ hxxp://www[.]ronusdt[.]one/pp11/ hxxp://www[.]roublevictimize[.]asia/x07y/ hxxp://www[.]rh799295w[.]vip/a02d/ hxxp://www[.]rhx[.]lat/pp11/ hxxp://www[.]reedomcycleparts[.]shop/x07y/ hxxp://www[.]rconsultant[.]xyz/x07y/ hxxp://www[.]reativesos[.]studio/a02d/ hxxp://www[.]randplatform[.]xyz/x07y/ hxxp://www[.]rchaea[.]pro/pp11/ hxxp://www[.]q33[.]lat/a02d/ hxxp://www[.]qweemaildwqfewew[.]live/a02d/ hxxp://www[.]psoftware[.]xyz/x07y/ hxxp://www[.]pwtpv[.]info/pp11/ hxxp://www[.]pahn[.]xyz/pp11/ hxxp://www[.]owardstheturf[.]online/pp11/ hxxp://www[.]p82520[.]icu/x07y/ hxxp://www[.]ovapioli[.]tech/pp11/ hxxp://www[.]ovevibes[.]xyz/a02d/ hxxp://www[.]orldsbestshoppingmall[.]online/pp11/ hxxp://www[.]ots[.]store/x07y/ hxxp://www[.]oratrading[.]best/a02d/ hxxp://www[.]orevitals[.]store/x07y/ hxxp://www[.]oppe[.]fun/pp11/ hxxp://www[.]oofighters[.]xyz/a02d/ hxxp://www[.]ontenbully[.]shop/a02d/ hxxp://www[.]onghu888[.]xyz/pp11/ hxxp://www[.]omptables[.]xyz/a02d/ hxxp://www[.]ondpc[.]pro/pp11/ hxxp://www[.]omestur[.]online/a02d/ hxxp://www[.]oksa[.]life/x07y/ hxxp://www[.]olvy[.]stream/pp11/ hxxp://www[.]oig[.]xyz/pp11/ hxxp://www[.]okoresmi[.]life/x07y/ hxxp://www[.]ocubox[.]xyz/a02d/ hxxp://www[.]ntentwicket[.]asia/x07y/ hxxp://www[.]nytymeoccassions[.]store/a02d/ hxxp://www[.]nityyoga[.]life/x07y/ hxxp://www[.]nfoyl[.]xyz/a02d/ hxxp://www[.]ng501[.]website/x07y/ hxxp://www[.]nalyzator[.]fun/a02d/ hxxp://www[.]m235a[.]net/a02d/ hxxp://www[.]my66[.]fun/x07y/ hxxp://www[.]lwaset[.]net/x07y/ hxxp://www[.]m1744[.]xyz/pp11/ hxxp://www[.]lsuits[.]shop/x07y/ hxxp://www[.]lueticks[.]shop/a02d/ hxxp://www[.]lkpiou[.]xyz/x07y/ hxxp://www[.]lown[.]bond/a02d/ hxxp://www[.]lazeworld[.]shop/pp11/ hxxp://www[.]lbdoanhnhan[.]net/a02d/ hxxp://www[.]laimdeep[.]fyi/x07y/ hxxp://www[.]lax[.]xyz/x07y/ hxxp://www[.]katewarehousel[.]shop/x07y/ hxxp://www[.]laimdeep[.]cyou/pp11/ hxxp://www[.]itadelohrana[.]store/x07y/ hxxp://www[.]jfghnxnvdfgh[.]icu/a02d/ hxxp://www[.]irvasenitpalvelut[.]online/a02d/ hxxp://www[.]inyurlapp[.]sbs/pp11/ hxxp://www[.]irrorbd[.]online/a02d/ hxxp://www[.]inhngoc[.]webcam/a02d/ hxxp://www[.]illamarinarv[.]net/pp11/ hxxp://www[.]iefuwqi[.]shop/pp11/ hxxp://www[.]ijibato[.]net/pp11/ hxxp://www[.]icovideo[.]zone/pp11/ hxxp://www[.]idzev[.]shop/a02d/ hxxp://www[.]hopsphereviral[.]store/x07y/ hxxp://www[.]iautomation[.]online/x07y/ hxxp://www[.]heempireofi[.]net/pp11/ hxxp://www[.]hetopgraded[.]shop/x07y/ hxxp://www[.]hingsilike[.]xyz/pp11/ hxxp://www[.]harepoint[.]legal/a02d/ hxxp://www[.]healchemists[.]xyz/a02d/ hxxp://www[.]g6fqz07uyhlgwxf[.]shop/x07y/ hxxp://www[.]grsm[.]net/pp11/ hxxp://www[.]ethelcollege[.]live/pp11/ hxxp://www[.]etworkconnect[.]xyz/pp11/ hxxp://www[.]estoremylawn[.]info/pp11/ hxxp://www[.]etail360solution[.]xyz/pp11/ hxxp://www[.]erzog[.]fun/a02d/ hxxp://www[.]estionprojetsccpm[.]online/a02d/ hxxp://www[.]ershwin[.]xyz/pp11/ hxxp://www[.]enewebsolutions[.]online/a02d/ hxxp://www[.]echviz[.]xyz/x07y/ hxxp://www[.]ele88[.]buzz/x07y/ hxxp://www[.]endown[.]graphics/a02d/ hxxp://www[.]earehspremierbody[.]net/x07y/ hxxp://www[.]ealprize[.]casino/pp11/ hxxp://www[.]coplus[.]market/a02d/ hxxp://www[.]ctinoco[.]xyz/x07y/ hxxp://www[.]bthbt[.]info/x07y/ hxxp://www[.]ceqne[.]vip/a02d/ hxxp://www[.]bsidiansurvival[.]shop/a02d/ hxxp://www[.]ashesbylainez[.]net/x07y/ hxxp://www[.]ashimono[.]studio/pp11/ hxxp://www[.]anostrastoria[.]net/x07y/ hxxp://www[.]amsexgirls[.]website/a02d/ hxxp://www[.]alacticinvesting[.]world/pp11/ hxxp://www[.]ammamiaitalia[.]net/a02d/ hxxp://www[.]aisui[.]icu/pp11/ hxxp://www[.]agdabvbux[.]net/pp11/ hxxp://www[.]agiclime[.]pro/a02d/ hxxp://www[.]acrebleu[.]xyz/x07y/ hxxp://www[.]agaviet59[.]shop/a02d/ hxxp://www[.]aatara1[.]info/x07y/ hxxp://www[.]abviehar[.]biz/pp11/ hxxp://www[.]88977[.]club/a02d/ hxxp://www[.]8betpragmatic[.]store/a02d/ hxxp://www[.]7ihyh[.]shop/pp11/ hxxp://www[.]8435[.]pizza/a02d/ hxxp://www[.]6485[.]loan/pp11/ hxxp://www[.]7849[.]plus/pp11/ hxxp://www[.]410[.]lat/x07y/ hxxp://www[.]4cw[.]lat/a02d/ hxxp://www[.]3233[.]pizza/x07y/ hxxp://www[.]3ff[.]lat/x07y/ hxxp://www[.]3s0jm[.]xyz/x07y/ hxxp://www[.]1244[.]pizza/pp11/ hxxp://www[.]200mzeus[.]store/x07y/ hxxp://www[.]1101dypxb[.]autos/pp11/ hxxp://www[.]1156[.]net/pp11/ hxxp://www[.]066661a23[.]buzz/a02d/ hxxp://www[.]eautylab[.]fun/g10y/ hxxp://www[.]milp[.]store/2j93/ hxxp://www[.]se-online[.]net/g10y/ hxxp://www[.]sertc[.]xyz/g10y/ hxxp://www[.]elax[.]xyz/g10y/ hxxp://www[.]aelo[.]xyz/g10y/ |
Formbook |
| URL | hxxps://stocktemplates[.]net/all/zall/faa[.]zip hxxps://allstatetransports[.]com/rate[.]php |
NetSupportManager RAT |
| URL | hxxp://185[.]81[.]68[.]147/tmx[.]exe hxxp://195[.]177[.]92[.]88/build[.]exe |
RedLine Stealer |
| URL | hxxp://107[.]172[.]31[.]5/comonstraints[.]vbs hxxp://192[.]3[.]27[.]144/xampp/mpa/seemebestthingsevermeetgivenbestthingsfornewways[.]hta hxxp://107[.]172[.]31[.]5/foeMMBIG[.]txt |
Agent Tesla |
| URL | hxxp://zzz[.]hnyzh[.]co/beacon_x86[.]exe hxxp://zzz[.]hnyzh[.]co/beacon_x64[.]exe hxxp://cs[.]xiaojingjingaihuifeng[.]xyz:443/wqerqwersdgfx64[.]jpg hxxp://cs[.]xiaojingjingaihuifeng[.]xyz:443/sadfasdgdfhsddfguri[.]jpg hxxp://103[.]24[.]179[.]18:7004/02[.]08[.]2022[.]exe hxxp://106[.]75[.]62[.]120:8000/02[.]08[.]2022[.]exe hxxp://121[.]40[.]19[.]66:7000/02[.]08[.]2022[.]exe hxxp://39[.]108[.]145[.]133:33892/02[.]08[.]2022[.]exe hxxp://39[.]104[.]28[.]176:999/02[.]08[.]2022[.]exe hxxp://38[.]134[.]148[.]115/02[.]08[.]2022[.]exe hxxp://47[.]104[.]181[.]208:1000/02[.]08[.]2022[.]exe hxxp://47[.]92[.]173[.]253/02[.]08[.]2022[.]exe hxxp://101[.]36[.]117[.]41:8081/02[.]08[.]2022[.]exe hxxp://159[.]75[.]229[.]64:8088/02[.]08[.]2022[.]exe hxxp://45[.]204[.]217[.]98:2002/02[.]08[.]2022[.]exe hxxp://47[.]97[.]103[.]202/02[.]08[.]2022[.]exe hxxp://139[.]9[.]107[.]79:55555/02[.]08[.]2022[.]exe hxxp://59[.]110[.]136[.]135:180/02[.]08[.]2022[.]exe hxxp://94[.]232[.]42[.]84:8094/02[.]08[.]2022[.]exe hxxp://106[.]53[.]83[.]169:60127/updates[.]rss hxxp://106[.]53[.]83[.]169/beacon[.]exe hxxp://156[.]224[.]19[.]17:4444/02[.]08[.]2022[.]exe hxxp://124[.]221[.]5[.]207:1444/02[.]08[.]2022[.]exe hxxp://43[.]156[.]63[.]124:9090/02[.]08[.]2022[.]exe hxxp://144[.]48[.]8[.]193/02[.]08[.]2022[.]exe hxxp://158[.]247[.]215[.]233:9999/02[.]08[.]2022[.]exe hxxp://18[.]183[.]60[.]128/02[.]08[.]2022[.]exe hxxp://123[.]60[.]184[.]253:8080/02[.]08[.]2022[.]exe hxxp://120[.]194[.]219[.]28:89/02[.]08[.]2022[.]exe hxxp://101[.]133[.]238[.]18:9001/02[.]08[.]2022[.]exe hxxp://157[.]230[.]12[.]133/02[.]08[.]2022[.]exe hxxp://106[.]14[.]69[.]133:8999/02[.]08[.]2022[.]exe hxxp://47[.]96[.]143[.]115:8086/02[.]08[.]2022[.]exe hxxp://120[.]46[.]28[.]4:8889/02[.]08[.]2022[.]exe hxxp://43[.]133[.]36[.]25:8083/02[.]08[.]2022[.]exe hxxp://43[.]143[.]123[.]40:11111/02[.]08[.]2022[.]exe hxxp://185[.]49[.]69[.]101/02[.]08[.]2022[.]exe hxxp://83[.]220[.]170[.]242/02[.]08[.]2022[.]exe hxxp://87[.]120[.]125[.]55:8087/02[.]08[.]2022[.]exe hxxp://45[.]221[.]99[.]49/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://87[.]120[.]116[.]179/files/covija[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/RG[.]txt hxxps://candwfarmsllc[.]com/c2[.]bat hxxp://87[.]120[.]116[.]179/files/sexo[.]txt |
Remcos |
| URL | hxxp://87[.]120[.]112[.]242:8000/login/?next=/ | Spectre Rat |
| URL | hxxps://glccf[.]com/js[.]php hxxps://glccf[.]com/5o8u[.]js hxxps://apex-shop[.]online/work/setup[.]php hxxps://mffaccessories[.]com/external_extensions[.]zip hxxps://apex-shop[.]online/work/original[.]js hxxps://apex-shop[.]online/work/index[.]php hxxp://diebinjmajbkhhg[.]top/1[.]php hxxps://bapalal[.]com/57f4[.]js hxxps://bapalal[.]com/js[.]php hxxp://kmaealcfcalhcac[.]top/1[.]php hxxp://canjjclmlnicbga[.]top/vo50gtns7dhtr[.]php hxxp://kmaealcfcalhcac[.]top/qzotx2r4w7htr[.]php hxxp://dckhgjimeghemhl[.]top/0obs5ktr2vhtr[.]php?id=VAULT&key=76127545828&s=527 hxxp://jejmbadfmeenlnk[.]top/tfm6euy09zhtr[.]php hxxps://prpages[.]com/4e2e[.]js hxxps://prpages[.]com/js[.]php hxxp://lggknhaffleahbh[.]top/1[.]php hxxps://taymodel[.]top/work/original[.]js hxxps://taymodel[.]top/work/index[.]php hxxps://taymodel[.]top/work/help[.]php hxxps://mffaccessories[.]com/debug[.]zip |
FAKEUPDATES |
| URL | hxxps://api[.]telegram[.]org/bot8171365907:AAFhWO_13bnElnPqwo1PSMXeHNO4L26rV00/sendMessage?chat_id=7361435574 hxxps://api[.]telegram[.]org/bot7767004773:AAG_mBqrFYZNr81F28ktwLAJ3brPq5BTRzg/sendMessage?chat_id=1217600190 hxxps://api[.]telegram[.]org/bot7979504653:AAFm_-f-R46w_TvBkt1kfgnnTRSttNIPYiY/sendMessage?chat_id=5600682828 hxxps://api[.]telegram[.]org/bot7249279970:AAEcJhrnjOjEPF0_qNK65RAY0sYYfNqc0Sg/sendMessage?chat_id=7365454061 hxxps://api[.]telegram[.]org/bot8124248958:AAHHSH6MqAJrQq3xcmINDov2O7_xgCmxgPE/sendMessage?chat_id=5808310347 hxxps://api[.]telegram[.]org/bot7838541807:AAEJadvLoc1DBjJfseqmrMSpZAXwRkaHwwk/sendMessage?chat_id=7488699642 hxxps://api[.]telegram[.]org/bot6956304715:AAGEsKc2_BChUeZlL8X0MH3xZIsug2zAAIA/sendMessage?chat_id=6939220311 hxxps://api[.]telegram[.]org/bot7634300667:AAElS97UnedbkmPEFHxIY0TyKl484PsrjZY/sendMessage?chat_id=2135869667 hxxps://api[.]telegram[.]org/bot7500935106:AAHefL_Tof6QlJbfgUl9eKB1_ggGz2K7LgY/sendMessage?chat_id=1018401531 hxxps://api[.]telegram[.]org/bot7880085226:AAFn59bjY_5aEtKKH3yN4wktDN454dzF1lM/sendMessage?chat_id=6055880871 |
Snake Keylogger |
| URL | hxxp://ls14[.]icu/HK341/index[.]php hxxp://51[.]15[.]142[.]235/1/3D890117-1CEB-4558-BA94-0C64E21A9504/index[.]php hxxp://parcelinn[.]com/wp-content/images/index[.]php |
Azorult |
| URL | hxxps://aviorlee[.]co[.]il/DB_store/[.]gom/webpanel/Panel/login[.]php | Gomorrah stealer |
| URL | hxxp://cipherbase[.]net:8080/api/document[.]ocx hxxp://cipherbase[.]net:8080/api/58100[.]ocx hxxp://cipherbase[.]net:8080/api/ActivePod[.]ocx hxxp://cipherbase[.]net:8080/api/IMG_051[.]lnk hxxp://cipherbase[.]net:8080/api/ieuinit[.]inf hxxp://cipherbase[.]net:8080/api/CQHUDGUXELZLTKMGD7F2[.]txt hxxp://195[.]85[.]115[.]147:8080/api/ActivePod[.]ocx hxxp://195[.]85[.]115[.]147:8080/api/58100[.]ocx hxxp://195[.]85[.]115[.]147:8080/api/document[.]ocx hxxp://195[.]85[.]115[.]147:8080/api/IMG_051[.]lnk hxxp://195[.]85[.]115[.]147:8080/api/ieuinit[.]inf hxxp://195[.]85[.]115[.]147:8080/api/CQHUDGUXELZLTKMGD7F2[.]txt hxxp://65[.]20[.]99[.]10:8080/api/XS[.]lnk hxxp://waveax[.]net:8080/api/XS[.]lnk |
VenomLNK |
| URL | hxxp://198[.]251[.]82[.]160:20722/b/mipsel hxxp://198[.]251[.]82[.]160:20722/b/mips hxxp://bookkeeping[.]wannanxi[.]com/ds[.]sh |
Kaiji |
| URL | hxxp://66[.]63[.]187[.]250/frek/gem1[.]exe hxxp://31[.]41[.]244[.]11/files/BoZar45/random[.]exe hxxp://31[.]41[.]244[.]11/files/GoodTimes306/random[.]exe hxxp://31[.]41[.]244[.]11/files/martin1/random[.]exe hxxp://45[.]93[.]20[.]67/utkin[.]exe hxxp://45[.]93[.]20[.]67/elm[.]exe hxxp://45[.]93[.]20[.]67/kanew[.]exe hxxp://31[.]41[.]244[.]11/files/kitty/random[.]exe hxxp://45[.]93[.]20[.]67/hdont[.]exe hxxp://45[.]93[.]20[.]67/markiz[.]exe hxxp://62[.]60[.]226[.]62/auth/login hxxp://mail[.]simon[.]sttdiakonos[.]ac[.]id/zcry/gem1[.]exe hxxps://mail[.]simon[.]sttdiakonos[.]ac[.]id/zcry/gem1[.]exe hxxp://kasihcommunityschool[.]sch[.]id/zcry/gem1[.]exe hxxps://kasihcommunityschool[.]sch[.]id/zcry/gem1[.]exe hxxp://66[.]63[.]187[.]250/zcry/gem1[.]exe hxxps://66[.]63[.]187[.]250/zcry/gem1[.]exe hxxp://66[.]63[.]187[.]250/zmk/gem1[.]exe |
Meduza Stealer |
| URL | hxxps://solve[.]bogx[.]org/awjsx[.]captcha hxxps://d1[.]exploredairyaptitude[.]shop/sh[.]bin hxxps://solve[.]porw[.]org/awjsx[.]captcha |
ClearFake |
| URL | hxxps://benalibabayulan[.]com/MTU0ZWU0MWZhOTdj/ hxxps://alibabaninciftligi61[.]com/MTU0ZWU0MWZhOTdj/ hxxps://maselamb251[.]com/MTU0ZWU0MWZhOTdj/ hxxps://alibabanininegi51[.]com/MTU0ZWU0MWZhOTdj/ hxxps://ciallgafaab251[.]com/MTU0ZWU0MWZhOTdj/ hxxps://pbvtckjkrtht[.]top/YTZhZjliODdlYTI4/ |
Coper |
| URL | hxxp://154[.]213[.]187[.]118/ppc | MooBot |
| URL | hxxp://172[.]36[.]0[.]102:53937/Mozi[.]m hxxp://175[.]148[.]157[.]145:47965/Mozi[.]m hxxp://103[.]200[.]85[.]238:59852/Mozi[.]m |
Mozi |
| URL | hxxp://historyfiles[.]ru/sk[.]exe | Feodo |
| URL | hxxp://185[.]215[.]113[.]16/inc/johnmartin[.]exe | PrivateLoader |
| URL | hxxp://teletop[.]top/viopmanxpro | Raccoon |
| URL | hxxp://103[.]41[.]204[.]104/k[.]php?a=arm hxxp://103[.]41[.]204[.]104/k[.]php?a=mips |
Prometei |
| URL | hxxp://185[.]215[.]113[.]16/inc/minimal[.]exe | Sliver |
| URL | hxxp://us7[.]info/host/install[.]msi hxxp://31[.]192[.]232[.]22/host/install[.]msi |
MetaStealer |
| URL | hxxps://staticmaxepress[.]com/updater2[.]php | Satacom |
| URL | hxxp://home[.]twelve12vs[.]top/AvWHJxAVCxPehbRictmJ173 | CryptBot |
| URL | hxxps://us[.]hackazon[.]org/files/3cdf3e5b17585e5ecb3a3c06a0c1bec24ddd5235/putty2[.]exe | Brute Ratel C4 |
| URL | hxxp://84[.]38[.]133[.]115/cPngyyBIWfTd99[.]bin | CloudEyE |
| URL | hxxps://94[.]156[.]177[.]41/mars/five/PvqDq929BSx_A_D_M1n_a[.]php | LokiBot |
