不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様5社 -
2025/01/20
※2025/01/20 更新
マルウェア感染させると考えられるURLを検知（2025/01/20）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://193[.]143[.]1[.]66/nA0diE1/pecga[.]arc | Mirai |
| URL | hxxp://94[.]156[.]177[.]41/zang/five/fre[.]php hxxp://94[.]156[.]177[.]41/zang/five/PvqDq929BSx_A_D_M1n_a[.]php hxxps://94[.]156[.]177[.]41/alpha/five/PvqDq929BSx_A_D_M1n_a[.]php hxxps://94[.]156[.]177[.]41/zang/five/PvqDq929BSx_A_D_M1n_a[.]php |
LokiBot |
| URL | hxxp://198[.]251[.]82[.]160:2072/t/mips hxxp://198[.]251[.]82[.]160:2072/t/mipsel hxxp://198[.]251[.]82[.]160:2072/s/mips |
Kaiji |
| URL | hxxp://137[.]184[.]102[.]100/220/behappyforeverythingtogetback[.]txt hxxp://15[.]235[.]203[.]104/80/uhg/creatingthingswithgoodnews[.]hta hxxp://15[.]235[.]203[.]104/80/sheisbeautifulgirlforme[.]txt hxxp://137[.]184[.]102[.]100/220/suee/kissmewithlovesheisfineforme[.]hta hxxp://bitbucket[.]org/enerotwenty/notiicaciones/downloads/remcos_a2[.]exe hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/G1[.]txt hxxp://147[.]45[.]44[.]131/infopage/ybhp[.]exe hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/RK[.]txt |
Remcos |
| URL | hxxp://31[.]13[.]224[.]246/files/XC16EN[.]txt hxxp://85[.]31[.]47[.]24/files/dieciseis[.]txt hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/ENVS/DR[.]txt hxxp://147[.]45[.]44[.]131/infopage/vgsrqi[.]exe hxxp://147[.]45[.]44[.]131/infopage/ygrcs[.]exe hxxp://147[.]45[.]44[.]131/infopage/inhyr[.]exe hxxps://api[.]telegram[.]org/bot7632590974:AAH3TGb_QzmOcupCJLey_TtoLlCaX1M_Kvc/sendMessage |
AsyncRAT |
| URL | hxxp://93[.]177[.]102[.]208/Client-built[.]exe hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SH/QR[.]txt |
Quasar RAT |
| URL | hxxps://eretailzone[.]shop/s61[.]mp4 hxxps://admin[.]bookmanagereserve[.]com/hotel/MzjERiAN?hoteladmin/extranet_ng/manage/booking[.]html?lang=it&hotel_id=39126&ses=e2187502437ee06321e4713345b41e79&res_id=4963629642 hxxps://slopestarball[.]com/play[.]html hxxps://gardenfloristry[.]com/play[.]html hxxps://towercrash[.]com/play[.]html hxxps://anyigames[.]com/play[.]html hxxps://omnomruns[.]com/play[.]html hxxps://boldway[.]shop/re6-1[.]mp4 hxxps://eprimemart[.]shop/s61[.]mp4 hxxps://infamouszeia[.]shop/api hxxps://crowsudysto[.]shop/api hxxps://yokeseddat[.]shop/api hxxps://whitebeauti[.]shop/api hxxps://winnyhelplejsu[.]shop/api hxxps://wordemnyauop[.]shop/api hxxps://burnsubstract[.]shop/api hxxps://regetgoos[.]cyou/api hxxps://longingfluffyr[.]cyou/api hxxps://aquaticteachu[.]cyou/api hxxps://foreigoiru[.]cyou/api hxxps://lyingcollage[.]cyou/api hxxps://angerinfecute[.]cyou/api hxxps://n2[.]bathglorifycalculate[.]shop/ownsend[.]xll hxxps://edealselite[.]shop/s61[.]mp4 hxxps://twigbestug[.]shop/api hxxps://comptetscant[.]shop/api hxxp://185[.]196[.]8[.]34/home/Stage hxxps://dirol-netrol[.]com/poimi/toto[.]txt hxxps://ment-sema[.]com/dobrom[.]zip hxxp://147[.]45[.]44[.]131/infopage/egqvq2qgh[.]bat hxxp://193[.]150[.]70[.]25/rewaxr[.]ps1 hxxp://147[.]45[.]44[.]131/infopage/qweiu[.]exe hxxp://147[.]45[.]44[.]131/infopage/tvsjy[.]exe hxxp://185[.]215[.]113[.]16/inc/6969[.]exe hxxp://185[.]215[.]113[.]16/inc/gold123444[.]exe hxxp://185[.]215[.]113[.]16/inc/legs[.]exe hxxp://147[.]45[.]44[.]131/infopage/hgfpj[.]exe hxxp://147[.]45[.]44[.]131/infopage/ilk[.]exe hxxp://147[.]45[.]44[.]131/infopage/inbg[.]exe hxxp://147[.]45[.]44[.]131/infopage/oung[.]exe hxxps://testylaughge[.]top/api hxxps://jokeprvffat[.]cyou/api hxxps://handlequarte[.]shop/api hxxps://geesecreat[.]shop/api hxxps://crookemakesif[.]cyou/api hxxps://inflameopooi[.]shop/api hxxps://craveinjuur[.]shop/api hxxps://wrensavoruziu[.]cyou/api hxxps://bikedtwittg[.]shop/api hxxp://147[.]45[.]44[.]131/infopage/ybfh[.]ps1 hxxps://hhhh[.]klipcewucyu[.]shop/Handler[.]db hxxps://hhhh[.]klipcewucyu[.]shop/MasterGameList[.]xml hxxps://confidespill[.]top/api hxxps://vladimir-ulyanov[.]com/api hxxps://post-to-me[.]com/api hxxps://jammy-crusher[.]bond/api hxxps://gabrize[.]shop/ru1-1[.]mp4 hxxps://deedcompetlk[.]cyou/api hxxps://stewkickyuope[.]shop/api hxxps://skistarteriz[.]bond/api hxxps://yndo-pepper[.]bond/api hxxps://joinresperct[.]shop/api hxxps://imperialmaru[.]shop/api hxxps://coattoystreet[.]shop/api hxxps://kidimprinyj[.]shop/api hxxps://weardawwerz[.]shop/api hxxps://permussiduebuz[.]shop/api hxxps://voyageprivato[.]bond/api hxxps://writerendangez[.]click/api hxxps://smootycomper[.]click/api hxxps://givecuubys[.]click/api hxxps://imitiatcarvvh[.]shop/api hxxps://steepfright[.]shop/api hxxps://bellgoodysu[.]cyou/api hxxps://purringsawwyuz[.]cyou/api hxxps://aggresiwevommen[.]cyou/api hxxps://clammyrobiny[.]cyou/api hxxps://glibvisitiru[.]click/api hxxps://ssx[.]is/s/gor[.]msix hxxps://trickyobseel[.]shop/api hxxps://steelysacckz[.]shop/api hxxps://mshyhennyk[.]cyou/api hxxps://quitgirlek[.]shop/api hxxps://curved-goose[.]cyou/api hxxps://futfilcreat[.]cyou/api hxxps://avoidspaderik[.]shop/api |
Lumma Stealer |
| URL | hxxp://104[.]248[.]170[.]245/fido9000/rev_https[.]exe hxxp://104[.]248[.]170[.]245:4443/P7laKcf0kPFweHF5K5E0Ww03y5LzBO7WsDVTtZfLtvfV681wtb39z-vJ2ELIkH5Q671hb_J9SxazPVKcA_YbVx7c7fMNQxqvoOXg-TM0F4O0ttCR |
Metasploit |
| URL | hxxps://176[.]123[.]5[.]92/39f75e7c42187827/sqlite3[.]dll hxxp://5[.]42[.]66[.]25/287dbd4538093b9e/sqlite3[.]dll hxxps://91[.]107[.]224[.]54/4184da83d7329318/sqlite3[.]dll hxxp://66[.]63[.]187[.]214/263ff79562167f22/nss3[.]dll hxxp://66[.]63[.]187[.]214/263ff79562167f22/vcruntime140[.]dll hxxp://66[.]63[.]187[.]214/263ff79562167f22/softokn3[.]dll hxxp://66[.]63[.]187[.]214/263ff79562167f22/msvcp140[.]dll hxxp://66[.]63[.]187[.]214/263ff79562167f22/freebl3[.]dll hxxp://66[.]63[.]187[.]214/263ff79562167f22/sqlite3[.]dll hxxp://66[.]63[.]187[.]214/263ff79562167f22/mozglue[.]dll hxxps://162[.]55[.]215[.]42/00ed239db35c969b/sqlite3[.]dll hxxp://141[.]98[.]6[.]54/4359869ad40fabf5/sqlite3[.]dll hxxps://176[.]124[.]198[.]17/1da263bff25c8346[.]php hxxp://5[.]188[.]86[.]231/0b6451de14750b6f[.]php hxxp://45[.]91[.]201[.]142/e344542ca4922af9[.]php |
Stealc |
| URL | hxxp://185[.]81[.]68[.]147/svc[.]exe hxxp://185[.]81[.]68[.]147/igfx[.]exe hxxps://79[.]137[.]203[.]19/7hgd5fx4/index[.]php hxxp://185[.]196[.]8[.]37/Gd85kkjf/Plugins/clip64[.]dll hxxp://92[.]255[.]57[.]155/yXNwKVfkS28Y/Plugins/clip64[.]dll hxxp://185[.]196[.]8[.]37/Gd85kkjf/Plugins/cred64[.]dll hxxp://92[.]255[.]57[.]155/yXNwKVfkS28Y/Plugins/cred64[.]dll hxxp://185[.]196[.]8[.]37/Gd85kkjf/Plugins/clip[.]dll hxxp://92[.]255[.]57[.]155/yXNwKVfkS28Y/Plugins/clip[.]dll hxxp://185[.]196[.]8[.]37/Gd85kkjf/Plugins/cred[.]dll hxxp://92[.]255[.]57[.]155/yXNwKVfkS28Y/Plugins/cred[.]dll hxxp://185[.]196[.]8[.]37/Gd85kkjf/index[.]php |
Amadey |
| URL | hxxp://172[.]245[.]119[.]74/500/csso[.]exe hxxp://172[.]245[.]119[.]74/xampp/kk/sheismybestgirlforentiretimegivenmebestthingsforever[.]hta |
SmokeLoader |
| URL | hxxp://124[.]221[.]5[.]207:1444/eYTK hxxp://103[.]234[.]72[.]165:31211/02[.]08[.]2022[.]exe hxxp://110[.]42[.]41[.]180:44444/02[.]08[.]2022[.]exe hxxp://23[.]27[.]48[.]4:8080/02[.]08[.]2022[.]exe hxxp://101[.]133[.]238[.]18:30001/02[.]08[.]2022[.]exe hxxp://47[.]109[.]178[.]54:2222/02[.]08[.]2022[.]exe hxxp://14[.]29[.]160[.]181:10080/02[.]08[.]2022[.]exe hxxp://182[.]92[.]236[.]252/02[.]08[.]2022[.]exe hxxp://8[.]140[.]242[.]49:7778/02[.]08[.]2022[.]exe hxxp://123[.]60[.]52[.]128:43334/02[.]08[.]2022[.]exe hxxp://38[.]54[.]57[.]42:28080/02[.]08[.]2022[.]exe hxxp://166[.]108[.]199[.]202:888/02[.]08[.]2022[.]exe hxxp://112[.]21[.]124[.]242:7777/02[.]08[.]2022[.]exe hxxp://8[.]143[.]2[.]128:65005/02[.]08[.]2022[.]exe hxxp://64[.]225[.]61[.]173/02[.]08[.]2022[.]exe hxxp://194[.]182[.]167[.]117/02[.]08[.]2022[.]exe hxxp://111[.]229[.]65[.]26/02[.]08[.]2022[.]exe hxxp://3[.]232[.]168[.]159/02[.]08[.]2022[.]exe hxxp://opal[.]wtf/bm6X |
Cobalt Strike |
| URL | hxxp://185[.]177[.]239[.]237/2/Process/Basetemporary/76Js/Poll3External6/2/process3/async/4/Wpprocesslow/sqlLowvoiddbPython/8Downloads/6downloads2/TophpHttp/Line_protectWppubliccdn[.]php hxxp://mak1nt0sh[.]ru/providervideolinePollserverdefaultgenerator[.]php hxxp://284386cm[.]renyash[.]ru/Secureprocesslocal[.]php hxxp://185[.]246[.]65[.]175/d5b9b560[.]php hxxps://greenindustry[.]pl/Needle_Setup[.]exe hxxp://452399cm[.]renyash[.]ru/_bigloadsqlbaseUniversalUploads[.]php hxxp://eternitysystems[.]online/L1nc0In[.]php |
DCRat |
| URL | hxxp://chellebelledesigns[.]com/ponyb/gate[.]php hxxp://1800callabe[.]com/ponyb/gate[.]php hxxp://1866callabe[.]com/ponyb/gate[.]php hxxp://abemoussa[.]com/ponyb/gate[.]php hxxp://abemoussa[.]com/forum/viewtopic[.]php hxxp://abemuggs[.]com/forum/viewtopic[.]php hxxp://abes[.]co/forum/viewtopic[.]php hxxp://abes[.]net/forum/viewtopic[.]php hxxp://bebecaracas[.]com/Rxu4Wzo[.]exe hxxp://keralahouseboatstourpackages[.]com/FXx[.]exe hxxp://ranchoencantado[.]la/EKUCJS[.]exe hxxp://shockalocka[.]com/x8t41AU[.]exe hxxp://thehomesaversdirect[.]com/9n9j6Mx[.]exe hxxp://www[.]arrow2000[.]ca/RiQw07Xs[.]exe hxxp://abstain[.]org[.]uk/2NkRox[.]exe |
Pony |
| URL | hxxp://www[.]outandaboutatlanta[.]net/m25n/ hxxp://www[.]sonixingenuine[.]shop/8g6k/ hxxp://www[.]vh5g[.]sbs/5sb9/ hxxp://www[.]augier2619[.]top/t56x/ hxxp://www[.]topcaffe[.]shop/2nok/ hxxp://www[.]benettoniran[.]shop/g59t/ hxxp://www[.]leqko[.]club/6bxb/ hxxp://www[.]cassino[.]legal/555c/ hxxp://www[.]voicecraft[.]pro/ezzc/ hxxp://www[.]j53m3ks3[.]top/g91b/ hxxp://www[.]aoivej[.]info/tw6w/ |
Formbook |
| URL | hxxps://saytunka[.]com/3e2w[.]js hxxps://saytunka[.]com/js[.]php hxxp://feheecfmkmhfiij[.]top/1[.]php hxxps://kuishang[.]top/work/original[.]js hxxps://kuishang[.]top/work/index[.]php hxxps://mffaccessories[.]com/files[.]zip hxxps://kuishang[.]top/work/help[.]php hxxps://waimaotuiguang[.]top/work/help[.]php hxxps://waimaotuiguang[.]top/work/index[.]php hxxps://waimaotuiguang[.]top/work/original[.]js hxxp://fnnkcnemajnnaja[.]top/1[.]php |
FAKEUPDATES |
| URL | hxxp://62[.]60[.]226[.]64/file/8734_5737[.]exe | PrivateLoader |
| URL | hxxps://weixe[.]ir/txt/NEWORDER[.]exe hxxp://81[.]161[.]229[.]110/htdocs/edypozzgzwkfdsk[.]exe hxxp://109[.]206[.]241[.]81/htdocs/fjwajwqdpesfktf[.]exe hxxp://37[.]139[.]129[.]142/htdocs/nnccyqnzfjhwokk[.]exe |
MASS Logger |
| URL | hxxps://72[.]167[.]39[.]236/firma/QGFQTHIU[.]exe hxxps://72[.]167[.]39[.]236/firma/Invoice15067[.]pdf hxxps://tualcaldia[.]com/firma/QGFQTHIU[.]exe hxxps://tualcaldia[.]com/firma/Invoice15067[.]pdf hxxps://72[.]167[.]39[.]236/firma/default[.]mp4 hxxps://byteshift[.]cyou/g978cfybw2nhn45/w8g7b54ytf[.]zip hxxp://byteshift[.]cyou/g978cfybw2nhn45/cg869th7[.]zip hxxps://codeblaze[.]cyou/y[.]txt hxxps://securesolutions[.]cyou/9237465/v572t4y9h[.]zip hxxp://securesolutions[.]cyou/9237465/v572t4y9h[.]zip hxxp://securesolutions[.]cyou/9237465/5fyt429736h[.]zip hxxps://securesolutions[.]cyou/9237465/5fyt429736h[.]zip hxxps://techexperts[.]cyou/y[.]txt hxxps://cdn-general[.]cyou/1-723628312/34598938459-19-1-25_3[.]zip hxxps://cdn-general[.]cyou/o[.]txt |
HijackLoader |
| URL | hxxps://amazonenviro[.]com/admin/245_Ubxtqicivhl hxxps://amazonenviro[.]com/admin/245_Nsltarpncon |
DBatLoader |
| URL | hxxp://low0hit[.]com/front[.]php hxxp://flash3hit[.]com/front[.]php |
Satacom |
| URL | hxxp://147[.]45[.]44[.]131/infopage/uitvsa[.]exe hxxp://147[.]45[.]44[.]131/infopage/uitvd[.]exe hxxp://89[.]23[.]96[.]207/FIRSTPROLIVNEW[.]txt |
DanaBot |
| URL | hxxps://cscrm-hiring[.]com/cs-applicant-crm-installer[.]zip | XMRig |
| URL | hxxps://kiymamakinesi345[.]com/NWNiNWRmMmZjZTdl/ hxxps://kendimarkam[.]com/MWRlOTUyYjExM2Ew/ hxxps://kandercibebeler24[.]xyz/Y2VkNDY3OTIxNjc0/ |
Coper |
| URL | hxxp://83[.]222[.]191[.]91:8080/oops/Photo[.]scr hxxp://83[.]222[.]191[.]91/oops/Photo[.]scr |
Coinminer |
| URL | hxxp://83[.]222[.]191[.]91/oops/loki[.]sh4 hxxp://83[.]222[.]191[.]91:8080/oops/loki[.]sh4 hxxp://83[.]222[.]191[.]91/oops/dbg[.]x86 hxxp://83[.]222[.]191[.]91:8080/oops/dbg[.]x86 hxxp://154[.]213[.]192[.]22/networkrip[.]arm5 hxxp://154[.]213[.]192[.]22/networkrip[.]x86 hxxp://154[.]213[.]192[.]22/networkrip[.]sparc hxxp://154[.]213[.]192[.]22/networkrip[.]arm6 hxxp://154[.]213[.]192[.]22/networkrip[.]mpsl hxxp://154[.]213[.]192[.]22/networkrip[.]ppc hxxp://154[.]213[.]192[.]22/networkrip[.]arm4 hxxp://154[.]213[.]192[.]22/networkrip[.]armv7l hxxp://154[.]213[.]192[.]22/networkrip[.]mips |
Bashlite |
| URL | hxxps://file[.]plusgbwhats[.]app/whatsapp-gold/WhatsApp_Gold_V11[.]80[.]apk | Triada |
| URL | hxxps://solve[.]nkve[.]org/awjsx[.]captcha | ClearFake |
| URL | hxxp://81[.]19[.]135[.]54/joinsystem | AMOS |
| URL | hxxps://dogs-airdp[.]com/no_dropper[.]apk hxxps://trust-walles[.]com/no_dropper[.]apk hxxps://www[.]v2-rubby[.]com/dropper[.]apk hxxps://bgptools-wildcard-confirmed[.]phavtom-v3[.]com/dropper[.]apk hxxps://mktgads[.]com/no_dropper[.]apk hxxps://bgptools-wildcard-confirmed[.]phavtom-v3[.]com/no_dropper[.]apk hxxps://io-suite-web[.]com/no_dropper[.]apk hxxps://update-chronne[.]com/dropper[.]apk |
SpyNote |
| URL | hxxp://93[.]123[.]109[.]39/coinbase[.]exe hxxp://93[.]123[.]109[.]39/Client[.]exe |
Venom RAT |
| URL | hxxp://87[.]120[.]113[.]91/chrome[.]exe | PureCrypter |
| URL | hxxps://pitchseed[.]com/tmp/dtnnbtndj1-uhmy8s5e-29082/ hxxps://www[.]mamajscakes[.]com/ytoawkr/gclxi-04u8tr-022249/ hxxp://jacobsondevelopers[.]com/wp-content/m9yufwg62-ivbak8-8431/ hxxp://www[.]shakeraleighbeauty[.]com/subscription/9qtkw7-57djmwa46x-074306828/ hxxp://zabesholidays[.]me/api[.]mud/oyokx-xih3-8811/ |
Emotet |
| URL | hxxp://5[.]8[.]18[.]7/filezzz[.]php hxxp://5[.]8[.]18[.]7/filesst[.]php |
GootLoader |
| URL | hxxps://joopshoop[.]shop/riii1[.]mp4 | Emmenhtal |
