不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/01/22
※2025/01/22 更新
マルウェア感染させると考えられるURLを検知（2025/01/22）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://abnomrmakio[.]cyou/api hxxps://solve[.]xtxy[.]org/awjsx[.]captcha hxxps://solve[.]pvsu[.]org/awjsx[.]captcha hxxps://amazon-ny-gifts[.]com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem[.]txt hxxps://safeguard-tg[.]com/iviewers[.]dll hxxps://safeguard-tg[.]com/verify[.]txt hxxps://woebengeoszis[.]click/api hxxps://handsbigywz[.]click/api hxxps://broadecatez[.]bond/api hxxps://rockemineu[.]bond/api hxxps://offsetyofcre[.]bond/api hxxps://uncoverreduop[.]cyou/api hxxps://basinstingger[.]cyou/api hxxps://excitingratty[.]click/api hxxps://mooncobudy[.]click/api hxxps://beevasyeip[.]bond/api hxxps://suggestyuoz[.]biz/api hxxps://budgetmart[.]shop/s6[.]mp4 hxxps://ecartdirect[.]shop/s6[.]mp4 hxxps://estorepro[.]shop/s61[.]mp4 hxxps://edirect[.]shop/s61[.]mp4 hxxps://budgetsphere[.]shop/s6[.]mp4 hxxps://ebuymore[.]shop/s61[.]mp4 hxxps://bigpick[.]shop/s6[.]mp4 hxxps://eoutletpro[.]shop/s61[.]mp4 hxxps://bargaincove[.]shop/s6[.]mp4 hxxps://emarketelite[.]shop/s61[.]mp4 hxxps://ebuyelite[.]shop/s6[.]mp4 hxxps://budgetvibe[.]shop/s6[.]mp4 hxxps://ebazaarelite[.]shop/s6[.]mp4 hxxps://buyloom[.]shop/s6[.]mp4 |
Lumma Stealer |
| URL | hxxps://185[.]219[.]81[.]132/1089481c07d09d21[.]php hxxps://185[.]219[.]81[.]135/7ea00b0801a6fd7e[.]php hxxps://185[.]219[.]81[.]135/c708352984fb7ac0[.]php hxxp://45[.]67[.]229[.]220/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://5[.]182[.]36[.]112/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/freebl3[.]dll hxxp://5[.]182[.]36[.]112/an7jd0qo6kt5bk5bq4er8fe1xp7hl2vk/msvcp140[.]dll hxxp://212[.]86[.]115[.]216/26ba0768f8501b95[.]php |
Stealc |
| URL | hxxp://212[.]22[.]82[.]118/fuck[.]x86 hxxp://154[.]216[.]19[.]189/cc9sh4 hxxp://154[.]216[.]19[.]189/cc9x86 hxxp://154[.]216[.]19[.]189/cc9arm6 hxxp://154[.]216[.]19[.]189/cc9mips hxxp://154[.]216[.]19[.]189/cc9i586 hxxp://154[.]216[.]19[.]189/cc9mpsl hxxp://154[.]216[.]19[.]189/cc9adc hxxp://154[.]216[.]19[.]189/cc9cco hxxp://154[.]216[.]19[.]189/cc9i686 hxxp://154[.]216[.]19[.]189/cc9ppc hxxp://154[.]216[.]19[.]189/cc9dss hxxp://154[.]216[.]19[.]189/cc9m68k hxxp://23[.]95[.]72[.]83/rebirth[.]i686 hxxp://23[.]95[.]72[.]83/rebirth[.]sh4 hxxp://212[.]224[.]86[.]22/s-h[.]4-[.]Sakura hxxp://212[.]224[.]86[.]22/a-r[.]m-5[.]Sakura hxxp://23[.]95[.]72[.]83/rebirth[.]arm4 hxxp://212[.]224[.]86[.]22/a-r[.]m-4[.]Sakura hxxp://212[.]224[.]86[.]22/a-r[.]m-6[.]Sakura hxxp://212[.]224[.]86[.]22/m-p[.]s-l[.]Sakura hxxp://23[.]95[.]72[.]83/rebirth[.]arm5 hxxp://212[.]224[.]86[.]22/x-8[.]6-[.]Sakura hxxp://23[.]95[.]72[.]83/rebirth[.]ppc hxxp://23[.]95[.]72[.]83/rebirth[.]mpsl hxxp://23[.]95[.]72[.]83/rebirth[.]mips hxxp://23[.]95[.]72[.]83/rebirth[.]x86 hxxp://212[.]224[.]86[.]22/m-6[.]8-k[.]Sakura hxxp://212[.]224[.]86[.]22/a-r[.]m-7[.]Sakura hxxp://212[.]224[.]86[.]22/x-3[.]2-[.]Sakura hxxp://23[.]95[.]72[.]83/rebirth[.]arm4t hxxp://212[.]224[.]86[.]22/i-5[.]8-6[.]Sakura hxxp://23[.]95[.]72[.]83/rebirth[.]spc hxxp://212[.]224[.]86[.]22/p-p[.]c-[.]Sakura hxxp://23[.]95[.]72[.]83/rebirth[.]arm6 hxxp://23[.]95[.]72[.]83/rebirth[.]m68 hxxp://assuresform[.]com/gig[.]sh hxxp://154[.]216[.]19[.]189/bins[.]sh hxxp://15[.]235[.]149[.]61/logsbins[.]sh hxxp://assuresform[.]com/bins/t hxxp://amende-stationnement-suivis[.]com/bins/t hxxp://103[.]130[.]212[.]99/sh hxxp://103[.]130[.]212[.]99/t hxxp://185[.]142[.]53[.]43:8080/bee hxxp://45[.]128[.]233[.]72/mips hxxp://45[.]128[.]233[.]72/x86 |
Bashlite |
| URL | hxxp://173[.]225[.]99[.]156/xampp/uho/seemebestthingwiththemgivenbestthings[.]hta | AsyncRAT |
| URL | hxxp://192[.]210[.]215[.]7/xampp/kkb/nightgirlsareverybeautifuklforeverythings[.]txt hxxp://198[.]46[.]178[.]132/766/morecoveragewithmorethingshappened[.]txt hxxp://198[.]46[.]178[.]132/766/nicebabygirlformehavve[.]tIF hxxp://198[.]46[.]178[.]132/766/new/nicepersonentiretimeimeetwellwithhershebeautiful[.]hta |
Remcos |
| URL | hxxps://api[.]telegram[.]org/bot7810622048:AAGlXVtU9EeAX6sumC63y05EJISEAmugavs/sendMessage?chat_id=986310232 hxxps://oshi[.]at/VSwW |
Snake Keylogger |
| URL | hxxps://floratrans[.]live/495/pomoykaXL[.]exe hxxps://floratrans[.]live/495/didi[.]txt |
Rhadamanthys |
| URL | hxxps://u1[.]servicelandingkaraoke[.]shop/shell1[.]mp4 | ClearFake |
| URL | hxxp://198[.]251[.]82[.]160:2072/s/mipsel | Kaiji |
| URL | hxxp://45[.]178[.]250[.]194:10688/Mozi[.]m | Mozi |
| URL | hxxps://securenet[.]cyou/w[.]txt hxxp://safesolutions[.]cyou/c3t427y9b8/yv597840hwy785946gvh[.]zip hxxps://safesolutions[.]cyou/c3t427y9b8/yv597840hwy785946gvh[.]zip hxxp://safesolutions[.]cyou/v54238byu9/67g8c94t312[.]zip hxxps://safesolutions[.]cyou/v54238byu9/67g8c94t312[.]zip hxxps://generalskalsk[.]net/1-723628312/82734827348723-news3[.]zip |
HijackLoader |
| URL | hxxps://txhu[.]layout[.]oystergardens[.]us/editContent hxxps://zxcaem[.]com/6f1d[.]js hxxps://zxcaem[.]com/js[.]php hxxps://quickauto24[.]com/Core[.]zip hxxps://kuishupai[.]top/work/original[.]js hxxps://kuishupai[.]top/work/index[.]php hxxps://kuishupai[.]top/work/help[.]php |
FAKEUPDATES |
| URL | hxxp://45[.]200[.]149[.]104:5000/download/nova_kaycee[.]vbs hxxp://81[.]161[.]229[.]110/htdocs/syfozykfrwceqbe[.]exe |
MASS Logger |
| URL | hxxps://www[.]atc-secure[.]com/Rspot | Formbook |
| URL | hxxps://www[.]sodiumlaurethsulfatedesyroyer[.]com/dkfjnskjdbfgsjlfbsbhbkhgvvgcfcgvkhbjddsijlfdjlgjdthdfh/rteyerjyejaewrwrgeestusrufiuoogikgfgferthww/mbserver1[.]exe | DCRat |
| URL | hxxp://31[.]177[.]110[.]99/DMMCULNX[.]exe | DanaBot |
| URL | hxxps://gemini-desktop[.]com/xbe[.]vue hxxps://gemini-desktop[.]com/xz[.]vue hxxps://gemini-desktop[.]com/x7[.]vue hxxps://gemini-desktop[.]com/update[.]php |
NetSupportManager RAT |
| URL | hxxp://180[.]214[.]239[.]36:1992/Vre | Vjw0rm |
