不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様5社 -
2025/02/04
※2025/02/04 更新
マルウェア感染させると考えられるURLを検知（2025/02/04）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://solve[.]gesz[.]org/awjsx[.]captcha hxxps://solve[.]nohz[.]org/awjsx[.]captcha hxxps://solve[.]zexd[.]org/awjsx[.]captcha hxxps://solve[.]waqj[.]org/awjsx[.]captcha hxxps://solve[.]lnww[.]org/awjsx[.]captcha hxxps://solve[.]qlpb[.]org/awjsx[.]captcha?u=$%7Busr_id%7D hxxps://solve[.]reqy[.]bet/awjsx[.]captcha hxxps://solve[.]qlpb[.]org/awjsx[.]captcha hxxps://solve[.]vyzu[.]bet/awjsx[.]captcha |
ClearFake |
| URL | hxxps://myfileview1[.]com/today[.]vbs hxxps://myfileview1[.]com/team[.]vbs hxxp://myfileview1[.]com:8002/Downloads/deal[.]pdf[.]lnk hxxp://myfileview1[.]com:8002/Downloads/past[.]hta hxxp://myfileview1[.]com:8002/Downloads/pass[.]hta hxxp://myfileview1[.]com:8002/Downloads/melt[.]hta hxxp://myfileview1[.]com:8002/Downloads/Form[.]pdf[.]lnk hxxp://myfileview1[.]com:8002/Downloads/pass[.]pdf[.]lnk hxxp://myfileview1[.]com:8002/Downloads/today[.]hta hxxp://myfileview1[.]com:8002/Downloads/deal[.]hta hxxp://195[.]66[.]213[.]164:8002/Downloads/today[.]hta hxxp://195[.]66[.]213[.]164:8002/Downloads/deal[.]hta hxxp://195[.]66[.]213[.]164:8002/Downloads/melt[.]hta |
Remcos |
| URL | hxxp://213[.]226[.]123[.]14/jd93d22Cb1/Plugins/clip64[.]dll hxxp://62[.]204[.]41[.]91/8kcnjd3da3/Plugins/cred[.]dll hxxp://213[.]226[.]123[.]14/jd93d22Cb1/Plugins/cred[.]dll hxxp://62[.]204[.]41[.]104/7gjD0Vs3d/Plugins/cred[.]dll hxxp://45[.]9[.]74[.]80/0bjdn2Z/Plugins/cred[.]dll hxxp://212[.]118[.]43[.]106/dF30Hn4m/Plugins/cred[.]dll |
Amadey |
| URL | hxxp://5[.]252[.]74[.]51/Client-built[.]exe | Quasar RAT |
| URL | hxxp://185[.]237[.]15[.]131/bins[.]sh hxxp://103[.]130[.]214[.]198/jackmyarmv5 hxxp://103[.]130[.]214[.]198/jackmysparc hxxp://103[.]130[.]214[.]198/jackmypowerpc hxxp://103[.]130[.]214[.]198/jackmyi686 hxxp://103[.]130[.]214[.]198/jackmymips hxxp://103[.]130[.]214[.]198/jackmym86k hxxp://103[.]130[.]214[.]198/jackmysh4 hxxp://103[.]130[.]214[.]198/jackmyarmv4 hxxp://103[.]130[.]214[.]198/jackmyarmv6 hxxp://103[.]130[.]214[.]198/jackmymipsel hxxp://103[.]130[.]214[.]198/jackmyi586 hxxp://94[.]156[.]167[.]35/splmips hxxp://147[.]45[.]78[.]4/rebirth[.]m68 hxxp://45[.]13[.]151[.]59/Ayedz[.]ppc hxxp://185[.]95[.]159[.]40/rebirth[.]sh4 hxxp://45[.]13[.]151[.]59/Ayedz[.]m68k hxxp://45[.]13[.]151[.]59/sh hxxp://185[.]95[.]159[.]40/rebirth[.]arm6 hxxp://185[.]95[.]159[.]40/rebirth[.]i686 hxxp://147[.]45[.]78[.]4/rebirth[.]sh4 hxxp://45[.]13[.]151[.]59/Ayedz[.]Armv61 hxxp://185[.]95[.]159[.]40/rebirth[.]m68 hxxp://147[.]45[.]78[.]4/rebirth[.]i686 hxxp://185[.]95[.]159[.]40/rebirth[.]arm4 hxxp://146[.]19[.]24[.]68/hidakibest[.]x86 hxxp://185[.]95[.]159[.]40/rebirth[.]ppc hxxp://185[.]95[.]159[.]40/rebirth[.]mpsl hxxp://185[.]95[.]159[.]40/rebirth[.]spc hxxp://45[.]13[.]151[.]59/Ayedz[.]x86 hxxp://147[.]45[.]78[.]4/rebirth[.]ppc hxxp://147[.]45[.]78[.]4/rebirth[.]x86 hxxp://147[.]45[.]78[.]4/rebirth[.]spc hxxp://185[.]95[.]159[.]40/rebirth[.]arm4t hxxp://45[.]13[.]151[.]59/Ayedz[.]mips hxxp://94[.]156[.]167[.]35/splmpsl hxxp://45[.]13[.]151[.]59/apache2 hxxp://146[.]19[.]24[.]68/hidakibest[.]arm6 hxxp://147[.]45[.]78[.]4/rebirth[.]arm5 hxxp://147[.]45[.]78[.]4/rebirth[.]arm4t hxxp://147[.]45[.]78[.]4/rebirth[.]arm4 hxxp://94[.]156[.]167[.]35/mips hxxp://94[.]156[.]167[.]35/mpsl hxxp://147[.]45[.]78[.]4/rebirth[.]mpsl hxxp://147[.]45[.]78[.]4/rebirth[.]mips hxxp://147[.]45[.]78[.]4/rebirth[.]arm6 hxxp://185[.]95[.]159[.]40/rebirth[.]mips hxxp://45[.]13[.]151[.]59/Ayedz[.]sh4 hxxp://185[.]95[.]159[.]40/rebirth[.]x86 hxxp://185[.]95[.]159[.]40/rebirth[.]arm5 hxxp://146[.]19[.]24[.]68/hidakibest[.]arm4 hxxp://146[.]19[.]24[.]68/hidakibest[.]mpsl hxxp://94[.]156[.]167[.]35/nabsh4 hxxp://45[.]13[.]151[.]59/Ayedz[.]i686 hxxp://45[.]13[.]151[.]59/Ayedz[.]mipsel hxxp://45[.]13[.]151[.]59/Ayedz[.]i586 hxxp://146[.]19[.]24[.]68/hidakibest[.]ppc hxxp://146[.]19[.]24[.]68/hidakibest[.]mips hxxp://103[.]130[.]214[.]198/jackmyx86 hxxp://pbs-acheminement[.]com/mips hxxp://pbs-acheminement[.]com/splmips hxxp://pbs-acheminement[.]com/nabsh4 hxxp://pbs-acheminement[.]com/mpsl |
Bashlite |
| URL | hxxps://natureinspirged[.]top/api hxxps://impossiblekdo[.]click/api hxxps://ballekshoerz[.]digital/api hxxps://compettevaoucs[.]digital/api hxxps://globalcuisinerecipes[.]biz/api hxxps://docshare[.]sbs/templates/imagesoftware/mediathek/Nicebackgroundmovelivecolors[.]mp4[.]mp4 |
Lumma Stealer |
| URL | hxxps://parcelinn[.]com/wp-content/images/panel/admin[.]php hxxp://kb1u[.]icu/GI341/index[.]php |
Azorult |
| URL | hxxp://87[.]120[.]120[.]56/crypt/IK[.]ps1 hxxp://www[.]est-sellers[.]net/i62s/ hxxp://www[.]rmaossoares[.]shop/i62s/ hxxp://www[.]lotbonus[.]xyz/i62s/ hxxp://www[.]udoudou[.]fun/i62s/ hxxp://www[.]nkomega[.]shop/i62s/ hxxp://www[.]dbgtv[.]info/i62s/ hxxp://www[.]owardhammerpleasure35[.]sbs/i62s/ hxxp://www[.]iirv[.]bid/i62s/ hxxp://www[.]rosperityconsultinggroup[.]net/i62s/ hxxp://www[.]rediksi-lexitoto[.]art/i62s/ hxxp://www[.]v02[.]net/i62s/ hxxp://www[.]ind-singles3[.]live/i62s/ hxxp://www[.]65six6[.]shop/i62s/ hxxp://www[.]imelightbeauty[.]store/i62s/ hxxp://www[.]5469[.]vip/i62s/ hxxp://www[.]utomation-tools-31065[.]bond/i62s/ hxxp://www[.]lassical[.]fun/i62s/ hxxp://www[.]oridion[.]net/i62s/ hxxp://www[.]ir49[.]buzz/i62s/ hxxp://www[.]irrwrsr[.]icu/i62s/ hxxp://www[.]aco4dkuy[.]online/i62s/ hxxp://www[.]owden[.]zone/i62s/ hxxp://www[.]ytsxv[.]xyz/i62s/ hxxp://www[.]pps-88306[.]bond/i62s/ hxxp://www[.]urnuiet[.]biz/i62s/ hxxp://www[.]lute[.]xyz/i62s/ hxxp://www[.]kds[.]store/i62s/ hxxp://www[.]nstaplan[.]xyz/i62s/ hxxp://www[.]orezenpulse[.]ltd/i62s/ hxxp://www[.]elfast-cruisetours[.]today/i62s/ hxxp://www[.]kohtom486[.]vip/i62s/ hxxp://www[.]iliarslot77[.]club/i62s/ hxxp://www[.]eusx[.]xyz/i62s/ hxxp://www[.]astebud[.]xyz/i62s/ hxxp://www[.]imaopro[.]shop/i62s/ hxxp://www[.]icovideo[.]motorcycles/i62s/ hxxp://www[.]hees[.]xyz/i62s/ hxxp://www[.]uajialihan[.]net/i62s/ hxxp://www[.]mbags[.]online/i62s/ hxxp://www[.]megavine[.]shop/i62s/ hxxp://www[.]hatsea[.]net/i62s/ hxxp://www[.]nvestore[.]xyz/i62s/ hxxp://www[.]pasupplies[.]online/i62s/ hxxp://www[.]i-analyst[.]online/i62s/ hxxp://www[.]olos[.]fun/i62s/ hxxp://www[.]mmfedex[.]online/i62s/ hxxp://www[.]utterinstallationmiamifl[.]net/i62s/ hxxp://www[.]ontenhiburan[.]lat/i62s/ hxxp://www[.]lataoplomo[.]shop/i62s/ hxxp://www[.]lexbreus[.]art/i62s/ hxxp://www[.]nline-gaming-32533[.]bond/i62s/ hxxp://www[.]znetio[.]info/i62s/ hxxp://www[.]hosaround[.]net/i62s/ hxxp://www[.]ecurity-apps-53798[.]bond/i62s/ hxxp://www[.]treamtiendat[.]xyz/i62s/ hxxp://www[.]ngomoney[.]online/i62s/ hxxp://www[.]wig[.]xyz/i62s/ hxxp://www[.]ills-au[.]today/i62s/ hxxp://www[.]arehouse-inventory-97550[.]bond/i62s/ hxxp://www[.]uamentesaudavel[.]shop/i62s/ hxxp://www[.]nio[.]xyz/i62s/ hxxp://www[.]rginine12[.]live/i62s/ hxxp://www[.]ourmet94goodies[.]shop/i62s/ hxxp://www[.]dveo[.]xyz/i62s/ hxxp://www[.]epp[.]xyz/i62s/ |
Formbook |
| URL | hxxps://api[.]telegram[.]org/bot6107929879:AAHV6JwXs7rcYzMGLe3_opR5_gdKAC16Ye4/sendMessage?chat_id=6311012313 | DarkCloud |
| URL | hxxp://8[.]219[.]212[.]202:60134/linux | P2Pinfect |
| URL | hxxp://74[.]50[.]80[.]166/ppc | MooBot |
| URL | hxxps://vbcsd[.]top/work/index[.]php hxxps://vbcsd[.]top/work/original[.]js hxxps://idioinc[.]com/js[.]php hxxps://idioinc[.]com/5t4a[.]js hxxps://vbcsd[.]top/work/upl[.]php hxxps://www[.]neoarchiinc[.]com/update[.]zip |
FAKEUPDATES |
| URL | hxxp://113[.]30[.]168[.]221:48205/Mozi[.]m | Mozi |
| URL | hxxp://185[.]147[.]125[.]135/download/python-3[.]120[.]5-amd64[.]exe | PureCrypter |
