不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/01/21
※2025/01/21 更新
マルウェア感染させると考えられるURLを検知（2025/01/21）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://tualcaldia[.]com/headerpresent[.]mp4 hxxp://45[.]143[.]200[.]244/Documents/4500005767-INVOICE[.]pdf[.]lnk hxxp://62[.]60[.]226[.]64/public_files/dbpmfno[.]txt hxxps://cheerfuldelights[.]shop/s5[.]eml hxxp://62[.]60[.]226[.]64/public_files/FdnfAkd[.]txt hxxps://crystaltreasures[.]shop/get-going-forward[.]html hxxp://inforta[.]org/677f7cc1f8daa9ec66ec2bdb hxxps://kangshart[.]shop/loading-take-time-pathv1[.]html hxxps://gustavu[.]shop/path0forwarding-stepv2[.]html hxxp://trafonyx[.]com/675ad6f75bb4cd3916e7cad5 hxxps://cowertbabei[.]bond/api hxxps://learnyprocce[.]bond/api hxxps://celeryddepende[.]shop/api hxxps://shapeguidecaz[.]shop/api hxxps://abaft-taboo[.]bond/api hxxps://conquemappe[.]bond/api hxxps://noxiuos-utopi[.]bond/api hxxps://joyoushammen[.]cyou/api hxxps://keenrustiz[.]cyou/api hxxps://mushyomittel[.]cyou/api hxxps://politicafausx[.]shop/api hxxps://gustavu[.]shop/riii2[.]mp4 hxxps://tg-safeguard[.]com/Telegram[.]exe hxxps://rewardtide[.]shop/api hxxps://rollaritheju[.]shop/api hxxps://rainy-lamep[.]bond/api hxxps://moonehobno[.]bond/api hxxps://reliedevopoi[.]bond/api hxxps://carfeuspitt[.]bond/api hxxps://elfinyamen[.]bond/api hxxps://swallowsowwe[.]cyou/api hxxps://encirelk[.]cyou/api |
Lumma Stealer |
| URL | hxxps://solve[.]hhxe[.]org/awjsx[.]captcha | ClearFake |
| URL | hxxp://154[.]213[.]192[.]22/networkrip[.]sh hxxp://37[.]114[.]46[.]58/skid[.]mips hxxp://37[.]114[.]46[.]58/skid[.]sparc hxxp://37[.]114[.]46[.]58/skid[.]arm6 hxxp://37[.]114[.]46[.]58/skid[.]x86 hxxp://37[.]114[.]46[.]58/skid[.]arm5 hxxp://37[.]114[.]46[.]58/skid[.]ppc hxxp://37[.]114[.]46[.]58/skid[.]arm4 hxxp://94[.]154[.]35[.]238/armv4l hxxp://94[.]154[.]35[.]238/i686 hxxp://94[.]154[.]35[.]238/armv7l hxxp://94[.]154[.]35[.]238/sh4 hxxp://94[.]154[.]35[.]238/armv5l hxxp://94[.]154[.]35[.]238/armv6l hxxp://94[.]154[.]35[.]238/i586 hxxp://94[.]154[.]35[.]238/ppc hxxp://assuresform[.]com/bins/splmpsl hxxp://assuresform[.]com/bins/zermpsl hxxp://assuresform[.]com/bins/jklsh4 hxxp://assuresform[.]com/bins/zermips hxxp://assuresform[.]com/bins/nabsh4 hxxp://assuresform[.]com/bins/sh4 hxxp://assuresform[.]com/bins/splsh4 hxxp://assuresform[.]com/bins/splmips hxxp://assuresform[.]com/bins/jklmips hxxp://amende-stationnement-suivis[.]com/bins/splmips hxxp://amende-stationnement-suivis[.]com/bins/jklsh4 hxxp://amende-stationnement-suivis[.]com/bins/splsh4 hxxp://amende-stationnement-suivis[.]com/bins/zersh4 hxxp://amende-stationnement-suivis[.]com/bins/jklmips hxxp://amende-stationnement-suivis[.]com/bins/zermips hxxp://amende-stationnement-suivis[.]com/bins/sh4 hxxp://amende-stationnement-suivis[.]com/bins/jklmpsl hxxp://amende-stationnement-suivis[.]com/bins/nabsh4 hxxp://amende-stationnement-suivis[.]com/bins/splmpsl hxxp://assuresform[.]com/bins/zersh4 hxxp://amende-stationnement-suivis[.]com/bins/zermpsl |
Bashlite |
| URL | hxxp://147[.]45[.]44[.]131/infopage/nge7[.]exe hxxp://147[.]45[.]44[.]131/infopage/bve[.]exe |
Vidar |
| URL | hxxps://admarkam1[.]com/ZjQ2Njg0MWJjNGE0/ hxxps://pildirmarkam[.]com/ZjQ2Njg0MWJjNGE0/ |
Coper |
| URL | hxxp://45[.]131[.]215[.]139/c262c2557c712ca5/sqlite3[.]dll hxxp://45[.]131[.]215[.]139/c262c2557c712ca5/msvcp140[.]dll hxxp://45[.]131[.]215[.]139/c262c2557c712ca5/nss3[.]dll hxxp://45[.]131[.]215[.]139/c262c2557c712ca5/vcruntime140[.]dll hxxp://45[.]131[.]215[.]139/c262c2557c712ca5/softokn3[.]dll hxxp://45[.]131[.]215[.]139/c262c2557c712ca5/mozglue[.]dll hxxp://45[.]131[.]215[.]139/c262c2557c712ca5/freebl3[.]dll hxxp://45[.]67[.]229[.]220/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://45[.]67[.]229[.]220/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://5[.]252[.]22[.]66/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/sqlite3[.]dll hxxp://45[.]67[.]229[.]220/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://5[.]252[.]22[.]66/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/mozglue[.]dll hxxp://45[.]67[.]229[.]220/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://77[.]91[.]102[.]115/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://5[.]252[.]22[.]66/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://45[.]67[.]229[.]220/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://45[.]67[.]229[.]220/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://45[.]144[.]29[.]243/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/softokn3[.]dll hxxp://45[.]144[.]29[.]243/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/freebl3[.]dll hxxp://45[.]144[.]29[.]243/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/sqlite3[.]dll hxxp://45[.]144[.]29[.]243/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/nss3[.]dll hxxp://45[.]144[.]29[.]243/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/vcruntime140[.]dll hxxp://45[.]144[.]29[.]243/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://45[.]144[.]29[.]243/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/msvcp140[.]dll hxxp://5[.]252[.]22[.]66/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/vcruntime140[.]dll |
Stealc |
| URL | hxxp://141[.]11[.]109[.]176/Client-built[.]exe | Quasar RAT |
| URL | hxxp://207[.]231[.]111[.]48/333[.]exe hxxp://92[.]255[.]57[.]155/1/34[.]png |
AsyncRAT |
| URL | hxxp://lindenappliances[.]co[.]za/somma[.]txt | Formbook |
| URL | hxxps://corepatchcraft[.]com/kernel2[.]aspx hxxps://corepatchcraft[.]com/updates/system-components/2025-release/updates_api[.]php |
Matanbuchus |
| URL | hxxp://212[.]162[.]149[.]165/bOhSlNMMU124[.]bin | CloudEyE |
| URL | hxxp://185[.]29[.]9[.]20/XSmSVsNqEw76[.]bin | Agent Tesla |
| URL | hxxps://www[.]4sync[.]com/web/directDownload/RfKXtnpx/tBq1mUpE[.]0f7b42006a01b710c36b4834fcfc09ce hxxps://www[.]4sync[.]com/web/directDownload/6WBUoB-1/tBq1mUpE[.]9e936c5644cd85fde181a0d56a675e5f hxxps://www[.]4sync[.]com/web/directDownload/qa0isb1w/tBq1mUpE[.]c692919c333d8a3702c13e2526de4fc7 hxxps://www[.]4sync[.]com/web/directDownload/3dcnYe2o/tBq1mUpE[.]c0c14597bde3069f97cf2007952f0e5f hxxps://www[.]4sync[.]com/web/directDownload/YLYI7Glr/tBq1mUpE[.]4b2c9d1f241fc41f8c44b896e9e35b67 hxxps://www[.]4sync[.]com/web/directDownload/rgOUtEoN/tBq1mUpE[.]3bcb20600e0e95f20109d2d927188594 hxxps://bitbucket[.]org/raiffisen/ua/downloads/Payment_326[.]rar hxxps://bitbucket[.]org/raiffisen/ua/downloads/Payment_35[.]rar hxxps://bitbucket[.]org/raiffisen/ua/downloads/Payment_497[.]rar hxxp://147[.]45[.]44[.]200/z[.]zip?mt=6006 |
NetSupportManager RAT |
| URL | hxxp://safenetwork[.]cyou/23c9478tybv/7g89yct34q[.]zip hxxp://safenetwork[.]cyou/23c9478tybv/ty3v58g796[.]zip hxxps://safenetwork[.]cyou/23c9478tybv/7g89yct34q[.]zip hxxps://safenetwork[.]cyou/23c9478tybv/ty3v58g796[.]zip hxxps://truecoders[.]cyou/y[.]txt hxxps://sergiolamoski[.]com/8283748234/8294382934892-20-1-25_2[.]zip hxxps://sergiolamoski[.]com/a[.]txt |
HijackLoader |
| URL | hxxp://192[.]210[.]215[.]7/xampp/kkb/kk/nicegirlkissedmewithloverissingmegoodgreatthings[.]hta | Remcos |
| URL | hxxp://traktortany[.]org/c | TrickMo |
| URL | hxxps://dsdpx[.]top/work/original[.]js hxxps://dsdpx[.]top/work/index[.]php hxxps://dsdpx[.]top/work/help[.]php hxxps://mffaccessories[.]com/file[.]zip |
FAKEUPDATES |
| URL | hxxp://31[.]177[.]110[.]99/AWLYURLX[.]exe hxxp://31[.]177[.]110[.]99/antibot[.]hta[.]mp4 hxxp://31[.]177[.]110[.]99/verification[.]hta[.]mp4 |
DanaBot |
| URL | hxxps://84[.]15[.]43[.]52:8078/sshd | SSHDoor |
| URL | hxxps://cld[.]pt/dl/download/d551d44f-78de-44dc-a537-f373b53bfa32/daveztotal[.]zip | Grandoreiro |
| URL | hxxps://verif-anti-bot[.]com/Capcha[.]html | Amadey |
| URL | hxxp://81[.]161[.]229[.]110/htdocs/xmzgzwlkoaynncy[.]exe hxxp://81[.]161[.]229[.]110/htdocs/ncwtdprdytqedkj[.]exe |
MASS Logger |
| URL | hxxp://59[.]184[.]248[.]201:44147/Mozi[.]m | Mozi |
