不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様4社 -
2025/01/16
※2025/01/16 更新
マルウェア感染させると考えられるURLを検知（2025/01/16）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://103[.]41[.]204[.]104/k[.]php?a=x86_64 | Prometei |
| URL | hxxps://api[.]telegram[.]org/bot5168654140:AAE_I-CRa2apQXXWxhBTEaeIEr1Ln5pw69s/sendMessage?chat_id=1469907967 hxxps://api[.]telegram[.]org/bot8181099166:AAHWiTz10g_-_BPRNk3yroxe3fl_IXTpU7s/sendMessage?chat_id=6250686237 |
DarkCloud |
| URL | hxxp://185[.]163[.]204[.]98/pLQvfD4d5/Plugins/clip64[.]dll hxxp://185[.]163[.]204[.]98/pLQvfD4d5/Plugins/cred64[.]dll |
Amadey |
| URL | hxxp://198[.]50[.]242[.]157/FXServer[.]exe hxxp://crestereamuschilor[.]ro/cloudimage[.]txt |
Remcos |
| URL | hxxp://upload[.]vina-host[.]com/get/edI4wqIhYr/rektupp[.]exe | Quasar RAT |
| URL | hxxp://185[.]215[.]113[.]39/files/6076573200/2LXHr7B[.]exe | RedLine Stealer |
| URL | hxxps://slippyhost[.]cfd/api hxxps://dainfiffxy[.]shop/api hxxps://giftermelde[.]cfd/api hxxps://jumplilltk[.]cfd/api hxxp://formoreup[.]xyz/675accab9dc953769e8622fb hxxp://topspent[.]xyz/677e1aa102c4de8f78eaa3b3 hxxp://dealzforu[.]pro/6767b3ffc925390379d215c4 hxxps://u1[.]grapplereturnunstamped[.]shop/sh_UJAF3[.]mp3 hxxps://unwrittenuzy[.]shop/api |
Lumma Stealer |
| URL | hxxps://captcha[.]nxgengames[.]com/printer_driver[.]exe | Unidentified 001 |
| URL | hxxp://45[.]155[.]249[.]215/xxx[.]zip hxxp://185[.]157[.]213[.]71/fakeurl[.]htm |
NetSupportManager RAT |
| URL | hxxps://maxcgi[.]com/25e[.]js hxxps://maxcgi[.]com/js[.]php |
FAKEUPDATES |
| URL | hxxp://www[.]radantobin[.]photography/g49t/ hxxp://www[.]hbvc[.]xyz/a01d/ hxxp://www[.]ustonehuman[.]info/a01d/ |
Formbook |
| URL | hxxps://195[.]3[.]223[.]126:4287/9d0dc091285eb9fbf2e/o8f3c8oj[.]8rdif | Rhadamanthys |
| URL | hxxps://107[.]180[.]89[.]159/wp-content/uploads/wpr-addons/forms/code1[.]png hxxp://85[.]31[.]47[.]201/c hxxp://sck-dns[.]cc/c |
Coinminer |
| URL | hxxps://solve[.]lzmb[.]org/awjsx[.]captcha | ClearFake |
| URL | hxxps://weixe[.]ir/txt/NJilhB1xaRKltAX[.]exe | LokiBot |
| URL | hxxp://212[.]162[.]149[.]165/venRSMHViyO78[.]bin | CloudEyE |
| URL | hxxp://62[.]122[.]184[.]98/1/2[.]png | AsyncRAT |
| URL | hxxp://b2csa[.]icu/PL341/index[.]php | Azorult |
| URL | hxxp://72[.]5[.]43[.]46:8080/MUDDY_TEXTURE[.]exe | Sliver |
| URL | hxxp://103[.]117[.]120[.]68:13000/02[.]08[.]2022[.]exe hxxp://101[.]35[.]235[.]124:4444/02[.]08[.]2022[.]exe hxxp://118[.]178[.]235[.]206:8888/02[.]08[.]2022[.]exe hxxp://47[.]109[.]90[.]134:88/02[.]08[.]2022[.]exe hxxp://47[.]128[.]167[.]72:81/02[.]08[.]2022[.]exe hxxp://139[.]162[.]204[.]37/02[.]08[.]2022[.]exe hxxp://162[.]244[.]24[.]30/02[.]08[.]2022[.]exe hxxp://54[.]83[.]104[.]93:1433/02[.]08[.]2022[.]exe hxxp://8[.]153[.]97[.]202:88/02[.]08[.]2022[.]exe hxxp://62[.]60[.]229[.]89:1201/02[.]08[.]2022[.]exe hxxp://45[.]205[.]28[.]16:8090/02[.]08[.]2022[.]exe hxxp://20[.]189[.]117[.]246:1132/02[.]08[.]2022[.]exe hxxp://156[.]238[.]227[.]41/02[.]08[.]2022[.]exe hxxp://101[.]133[.]238[.]18:9002/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://89[.]197[.]154[.]116/ciscotest[.]exe | Meterpreter |
