不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2025/02/06
※2025/02/06 更新
マルウェア感染させると考えられるURLを検知（2025/02/06）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://gate[.]anonzone[.]com/api[.]php hxxp://107[.]175[.]229[.]132/EMMANBBIGGGGIII[.]txt hxxp://107[.]175[.]229[.]132/FROMGRFDROID[.]txt hxxp://107[.]175[.]229[.]132/MPDWforXLAconstraints[.]vbs hxxp://146[.]59[.]116[.]84/xampp/mpa/niceworkwithgreatjobgivenmebestthings[.]hta |
Agent Tesla |
| URL | hxxps://check[.]puvt[.]run/gkcxv[.]google hxxps://check[.]repw[.]run/gkcxv[.]google hxxp://80[.]64[.]30[.]238/evix[.]xll hxxps://check[.]pylo[.]site/gkcxv[.]google hxxps://check[.]jefx[.]shop/gkcxv[.]google hxxps://check[.]zyfu[.]site/gkcxv[.]google hxxps://check[.]wozy[.]site/gkcxv[.]google hxxps://check[.]hobx[.]run/gkcxv[.]google hxxps://check[.]xyms[.]run/gkcxv[.]google hxxps://check[.]guhv[.]run/gkcxv[.]google hxxps://check[.]gity[.]site/gkcxv[.]google hxxps://check[.]djtvx[.]online/gkcxv[.]google |
ClearFake |
| URL | hxxps://airtbn[.]shop/story[.]mp4 hxxps://fangyevasive[.]shop/api hxxps://dwriftycloud[.]pics/api hxxps://ugg[.]kliprisydie[.]shop/unforcing[.]xll hxxps://plafyfulsunbeam[.]boats/api hxxps://hopeefreamed[.]com/api hxxp://91[.]219[.]239[.]210/Twix[.]exe |
Lumma Stealer |
| URL | hxxps://185[.]215[.]113[.]16/Jo89Ku7d/Login[.]php hxxps://185[.]215[.]113[.]16/Fru7Nk9/Login[.]php |
Amadey |
| URL | hxxps://www[.]seventools[.]de/Selvtillidens[.]smi hxxps://www[.]seventools[.]de/wp-admin/images/Droyl[.]aaf hxxps://www[.]elefantenfutter[.]de/wp-includes/assets/KHSGR207[.]bin hxxp://103[.]72[.]56[.]30/PHANTOM/Ytous[.]dat hxxp://103[.]72[.]56[.]30/PHANTOM/Xawnb[.]mp3 hxxp://103[.]72[.]56[.]30/PHANTOM/1503 hxxp://103[.]72[.]56[.]30/botsai/Abcizdzuf[.]dat hxxp://103[.]72[.]56[.]30/PHANTOM/Lojvqds[.]mp3 hxxp://103[.]72[.]56[.]30/PHANTOM/Tnrjj[.]dat hxxp://103[.]72[.]56[.]30/botsai/Jadssyecx[.]dat hxxp://103[.]72[.]56[.]30/PHANTOM/Bhwznnxwrjj[.]vdf hxxp://103[.]72[.]56[.]30/PHANTOM/Quvlvdz[.]mp3 hxxp://103[.]72[.]56[.]30/PHANTOM/Mfgfpqodgni[.]mp3 hxxp://212[.]162[.]149[.]34/gpKVwjasqlZ121[.]bin hxxp://185[.]29[.]10[.]117/GYXBjrUUNQgwO252[.]bin hxxp://185[.]29[.]10[.]117/qQiZKSHWQTSVtZtVWRz56[.]bin |
CloudEyE |
| URL | hxxp://144[.]91[.]79[.]54/15012025/vEsSsE6ulpaD0I8LgRs0[.]txt hxxp://45[.]141[.]26[.]234/1[.]exe hxxps://blockchainsdev[.]net/cyber_security/XWORM[.]txt hxxp://87[.]120[.]120[.]56/crypt/Client[.]exe |
AsyncRAT |
| URL | hxxps://myfileview1[.]com/w2[.]vbs hxxps://myfileview1[.]com/pass[.]vbs hxxp://195[.]66[.]213[.]164:8002/Downloads/past[.]hta hxxp://185[.]29[.]10[.]30/xampp/kkns/seemybestpicturewithentiretime[.]txt hxxp://104[.]168[.]7[.]72/430/seethebestthingswithgreatnessgoodformybestie[.]txt hxxp://185[.]29[.]10[.]30/xampp/kkns/sheismybeautifulladywholovesme[.]gIF hxxp://104[.]168[.]7[.]72/430/goodgirlalwaysbeagoodgirlwithbetterpersongood[.]gIF hxxp://217[.]160[.]163[.]113/669/seethebestthingswithgoodandgreatnessthingsentiretimefor[.]gIF hxxp://185[.]29[.]10[.]30/455/seethebestthignsentiretimegivenmebest[.]txt hxxp://185[.]29[.]10[.]30/xampp/koc/verynicegirlfriendshegoodbeautiful[.]txt hxxp://104[.]168[.]7[.]72/430/nhu/sheisbestforbetterforgoodthingstogetbackbetterthingsforgood[.]hta hxxp://185[.]29[.]10[.]30/xampp/kkns/kkn/shemygoodgirlwholovesmebestthignstobegoodforrmes[.]hta hxxp://172[.]245[.]123[.]86/998/sema/besttogivebetterwayforbestthingsgoodformebestofnaturalthings[.]hta hxxp://185[.]29[.]10[.]30/455/createdbestthingswithbestgunbestofluckgivenmebest[.]gIF hxxp://185[.]29[.]10[.]30/455/aut/createdbestthingswithbestgunbestofluckgivenmebest[.]hta |
Remcos |
| URL | hxxp://www[.]yrshire[.]xyz/k15k/ hxxp://185[.]29[.]10[.]30/xampp/fbo/sheisagoodgirlwholovesmybestiregood[.]gIF hxxp://185[.]29[.]10[.]30/xampp/fbo/seemybestieperformancegood[.]txt hxxps://vivamente[.]shop/z22v/ hxxps://cheapwil[.]shop/ekxu/ hxxps://condition[.]studio/fo9s/ hxxps://freshrizon[.]life/ds8w/ hxxps://garfo[.]xyz/gsph/ hxxps://kpilal[.]info/nais/ hxxps://shibbets[.]xyz/ynbe/ hxxps://actpisalnplay[.]cyou/vywx/ hxxps://bitcoinvendor[.]xyz/mnh7/ hxxps://blockchainuniverse[.]xyz/qr9s/ hxxp://www[.]xxtoexy001[.]sbs/g43m/ hxxp://www[.]ytmp3[.]town/g43m/ hxxp://www[.]yugen4dno1[.]art/g43m/ hxxp://www[.]zycr[.]shop/g43m/ hxxp://www[.]rumseysabinsargos[.]cloud/g43m/ hxxp://www[.]senior-living-17169[.]bond/g43m/ hxxp://www[.]sipoja[.]shop/g43m/ hxxp://www[.]smarminds[.]xyz/g43m/ hxxp://www[.]spotifyi[.]vip/g43m/ hxxp://www[.]staplerl[.]shop/g43m/ hxxp://www[.]swirlstakedtawkee[.]cloud/g43m/ hxxp://www[.]t7wghnrpj3c6m[.]buzz/g43m/ hxxp://www[.]vxgjhgbx[.]top/g43m/ hxxp://www[.]whisps[.]cloud/g43m/ hxxp://www[.]wq9915[.]cyou/g43m/ hxxp://www[.]wvyzvej7f[.]xyz/g43m/ hxxp://www[.]loanplan[.]xyz/g43m/ hxxp://www[.]make-money-online-55635[.]bond/g43m/ hxxp://www[.]mlrgarments[.]net/g43m/ hxxp://www[.]msdvo45e[.]top/g43m/ hxxp://www[.]news-xzurufo[.]xyz/g43m/ hxxp://www[.]oncasino[.]xyz/g43m/ hxxp://www[.]online-advertising-96729[.]bond/g43m/ hxxp://www[.]osipovs[.]digital/g43m/ hxxp://www[.]pasanghoki3[.]homes/g43m/ hxxp://www[.]pgflow[.]cloud/g43m/ hxxp://www[.]qpb5vwhgmlfapfka[.]cyou/g43m/ hxxp://www[.]roamer[.]social/g43m/ hxxp://www[.]home-remodeling-54747[.]bond/g43m/ hxxp://www[.]hwamk91b7bgpkjob[.]xyz/g43m/ hxxp://www[.]influencer-marketing-24346[.]bond/g43m/ hxxp://www[.]j0g8d[.]skin/g43m/ hxxp://www[.]jiuse1889[.]xyz/g43m/ hxxp://www[.]junepages[.]online/g43m/ hxxp://www[.]kronoseletronicos[.]online/g43m/ hxxp://www[.]kruzhka-tut[.]online/g43m/ hxxp://www[.]lawnwonder[.]store/g43m/ hxxp://www[.]liberateyoursoul[.]net/g43m/ hxxp://www[.]dnregistry[.]net/g43m/ hxxp://www[.]eepthought[.]social/g43m/ hxxp://www[.]engagementrings-ar-271129[.]today/g43m/ hxxp://www[.]esperanza[.]live/g43m/ hxxp://www[.]euweb[.]shop/g43m/ hxxp://www[.]exusintelligence[.]xyz/g43m/ hxxp://www[.]fyw[.]info/g43m/ hxxp://www[.]glovesforboxes[.]shop/g43m/ hxxp://www[.]gmn089[.]top/g43m/ hxxp://www[.]growing[.]digital/g43m/ hxxp://www[.]heavydutyweld[.]shop/g43m/ hxxp://www[.]hjrdz[.]xyz/g43m/ hxxp://www[.]alistika[.]info/g43m/ hxxp://www[.]alooytv17[.]shop/g43m/ hxxp://www[.]astral[.]directory/g43m/ hxxp://www[.]auslift[.]equipment/g43m/ hxxp://www[.]bakalaomemeapps[.]xyz/g43m/ hxxp://www[.]bujangjp-gtm[.]xyz/g43m/ hxxp://www[.]chicprotect[.]shop/g43m/ hxxp://www[.]comitatogroscavallo[.]info/g43m/ hxxp://www[.]contract-jobs-82251[.]bond/g43m/ hxxp://www[.]cpt1025[.]top/g43m/ hxxp://www[.]dental-implants-26269[.]bond/g43m/ hxxp://www[.]71401[.]shop/g43m/ hxxp://www[.]8328[.]shop/g43m/ hxxp://www[.]917183[.]club/g43m/ hxxp://www[.]939951[.]xyz/g43m/ |
Formbook |
| URL | hxxps://zero-cdn[.]click/download/LoginZeroX2V82[.]exe | Cobalt Strike |
| URL | hxxp://84[.]234[.]19[.]36/updater[.]exe hxxp://upload[.]vina-host[.]com/get/bPoyf5baUz/host[.]exe hxxp://89[.]23[.]99[.]249/TeamBuild/BT[.]exe hxxp://91[.]202[.]233[.]169/Tak/Reg/Marz/SGRH/QJ[.]txt |
Quasar RAT |
| URL | hxxp://185[.]215[.]113[.]115/68b591d6548ec281/softokn3[.]dll? hxxp://94[.]142[.]138[.]133/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll |
Stealc |
| URL | hxxp://upload[.]venomtools[.]in/build[.]exe hxxps://bitbucket[.]org/stools/files/downloads/Muikfjd[.]exe hxxps://bitbucket[.]org/stools/files/downloads/ffcr[.]exe |
RedLine Stealer |
| URL | hxxp://81[.]177[.]215[.]49/R3SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxp://81[.]177[.]215[.]49/R2SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxp://89[.]23[.]99[.]249/TeamBuild/ST[.]exe hxxp://81[.]177[.]215[.]61/R4SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxp://81[.]177[.]215[.]49/R1SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxp://89[.]23[.]103[.]39/1[.]exe hxxp://81[.]177[.]215[.]61/R1SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxp://81[.]177[.]215[.]49/R4SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxp://81[.]177[.]215[.]61/R3SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxp://89[.]23[.]103[.]39/2[.]exe hxxp://89[.]23[.]103[.]39/4[.]exe hxxp://81[.]177[.]215[.]61/R2SupportSolutionsFramework-13[.]0[.]1[.]131[.]exe hxxps://138[.]124[.]53[.]206:2718/0513d6f0ae961d/AVSX hxxps://138[.]124[.]53[.]206:2718/0513d6f0ae961d/AVS hxxp://89[.]23[.]103[.]39/3[.]exe hxxp://sadonsgithub[.]site/files/install[.]exe |
Rhadamanthys |
| URL | hxxps://api[.]telegram[.]org/bot7514829743:AAHBKXOQ_sdDhuTQKjbsk_JAc6kOKn-lozA/sendMessage?chat_id=6557702940 hxxps://api[.]telegram[.]org/bot7719158406:AAGxGMuZ_5NEFP89HZrIghiOEjJFOaEE7ds/sendMessage?chat_id=1018401531 hxxps://api[.]telegram[.]org/bot8152393919:AAFcv9D2OhgJkwW5R_jm9t4Pm6asb_5vQdk/sendMessage?chat_id=1437092720 |
Snake Keylogger |
| URL | hxxp://87[.]120[.]115[.]240/Downloads/img_9758-1-1200x800[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/sertifikat-kkr[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/020[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/040[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/op-01[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/landscapes-12[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/resumen-ejecutivo-encuesta-nacional-de-percepcion-social_web[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/camscanner-09-28-2023-16[.]37_1[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/2-contaminacion-residuos-solidos-estudiante[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/ims-cable-vulcanizer[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/she-fed-him-viagra-then-tied-him-to-the-bed[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/soos-si-reclamantul2[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/4-2[.]png[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/vibration-controller[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/img_1972-2-1[.]jpeg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/ba_programme_outcome[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/p2[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/d_997640-mlu50293089781_062022-o-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/cirese-cherry-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/31-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/building[.]2[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/l0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/landscapes-13[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/accounting-finance-[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/circular-of-bihar-state-senior-women-2024-25[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/sertifikat-akreditasi-sitek[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/365-2[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/op-05[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/capture4-1[.]png[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/hype-1y4-scaled[.]jpeg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/7-7[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/booty-band-workout[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/2020-06-10_09h36_21[.]gif[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/p5[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/14-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/9-3[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/op-03[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1h8a2914-1200x750-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/g0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/op-02[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/jonesetal2009_wengen[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/what-is-science-based-reputation-management[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/endofsummer-080[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/vii-tfo-reino-de-aragon-sala[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/6-17[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/50-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1h8a2910-1200x750-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/ihc-pamphlet-1[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1-2[.]png[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/entrance2[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/30-resistance-tube-exercises[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/zero_anilina02[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/f0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/img_1019-533x800[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/6-9[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/i0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1604486659_iem_alpertoprak_gorsel[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/23-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/2020-06-10_09h37_40[.]gif[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1h8a2900-1200x750-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/sertifikat-sitek[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/167545531598bcbc70d327c232c4cdbe8e0767426c[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/semarang-charter-february-3-2024-uin-wali-songo[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/p4[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/m0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/j0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/whatsapp-image-2022-10-18-at-10[.]15[.]00[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/32-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/3-2[.]png[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/rope-light[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/030[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/34-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/img_4561-1200x800[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/universo-retratado-5[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/emotional-intelligence-for-sales-success-lessons5[.]docx[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/3-9[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/imgm7461-1024x683[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1h8a2917-1200x750-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/15-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/dhu-hfw1800thpi428[.]png[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/bwk-tbs-602-b-e1535602482598[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/2020-06-10_09h40_43[.]gif[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/circular-of-bihar-state-rapid-blitz-2024-25[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/op-04[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/e0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/sk-dan-sertifikat-akreditasi-ajk[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/21-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/countertops20182[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/2020-06-10_09h39_53[.]gif[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/asus-zenbook-14x-oled-q420va-300x300-1[.]png[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/23twinbedsfan[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1[.]-loi-n2525252525252525252525252525252525252525252525252525252525252525c22525252525252525252525252525252525252525252525252525252525252525b0-99-010-du-17-avril-1999-regissant-les-activites-du-secteur-petrolier-aval[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/system_alarmowy_z_barierami_podczerwieni_optex[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/sertifikat-ajk[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/h0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/l5015b[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/sertifikat-akreditasi-prodi-kkr[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/pza3_cambiar-tama252525252525252525252525252525252525252525252525252525252525252525c3252525252525252525252525252525252525252525252525252525252525252525b1o-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/k0[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/1h8a2912-1200x750-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/p6[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/explora_me2525252525252525252525252525252525252525252525cc252525252525252525252525252525252525252525252581todo-cienti2525252525252525252525252525252525252525252525cc252525252525252525252525252525252525252525252581fico_mv[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/20-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/p1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/bag2_cambiar-tama252525252525252525252525252525252525252525252525252525252525252525c3252525252525252525252525252525252525252525252525252525252525252525b1o-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/pza4_cambiar-tama252525252525252525252525252525252525252525252525252525252525252525c3252525252525252525252525252525252525252525252525252525252525252525b1o-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/0a[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/wood-3[.]png[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/poli_6-1[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/business-management[.]pdf[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/bag1_cambiar-tama252525252525252525252525252525252525252525252525252525252525252525c3252525252525252525252525252525252525252525252525252525252525252525b1o-scaled[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/universo-retratado-4[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/chill-cashew-1024x768[.]jpg[.]lnk hxxp://87[.]120[.]115[.]240/Downloads/fire-following-terrorism-a-suggested-approach-to-estimate-the-loss-potential[.]pdf[.]lnk |
QakBot |
| URL | hxxp://198[.]23[.]187[.]150/127/cann[.]exe hxxp://198[.]23[.]187[.]150/xampp/zina/seemybestthingswithmygreatnesswithgoodthingswith[.]hta hxxp://94[.]156[.]177[.]155/ukraine/svc1[.]exe |
SmokeLoader |
| URL | hxxp://ns2[.]base01[.]info:8080/face/setupqw[.]msi hxxp://base01[.]info:8080/face/setupqw[.]msi hxxp://ns1[.]base01[.]info:8080/face/setupqw[.]msi hxxp://147[.]45[.]37[.]142:8080/face/setupqw[.]msi hxxp://data03[.]info:8080/boot/setupxe[.]msi hxxp://31[.]192[.]232[.]156:8080/boot/setupxe[.]msi hxxp://31[.]192[.]232[.]156:8080/Document-022025-110337[.]pdf[.]lnk hxxp://data03[.]info:8080/Document-022025-110337[.]pdf[.]lnk hxxp://secureviewmode[.]com:8080/fils/setupse[.]msi hxxp://secureviewmode[.]cloud:8080/doc/Form%20I-25[.]pdf[.]lnk hxxp://94[.]156[.]189[.]105:8080/fils/setupse[.]msi hxxp://secureviewmode[.]cloud:8080/fils/setupse[.]msi hxxp://94[.]156[.]189[.]105:8080/doc/Form%20I-25[.]pdf[.]lnk hxxp://secureviewmode[.]com:8080/doc/Form%20I-25[.]pdf[.]lnk hxxp://payber[.]store:8080/fils/out[.]exe hxxp://91[.]92[.]136[.]9:8080/fils/out[.]exe hxxp://payber[.]store/fils/out[.]exe hxxp://payber[.]store:8080/docs/Document[.]lnk hxxp://91[.]92[.]136[.]9:8080/docs/Document[.]lnk hxxp://payber[.]store/docs/Document[.]lnk |
MetaStealer |
| URL | hxxps://viagrapillerpris[.]top/work/original[.]js hxxps://viagrapillerpris[.]top/work/index[.]php hxxps://viagrapillerpris[.]top/work/files[.]php hxxps://lifewis[.]com/js[.]php hxxps://vdrdid[.]shop/work/original[.]js hxxps://vdrdid[.]shop/work/index[.]php hxxps://vdrdid[.]shop/work/file[.]php hxxps://lakestreetsolar[.]com/1[.]zip hxxps://lifewis[.]com/3w1q[.]js hxxp://hkdecchgkhgleal[.]top/1[.]php |
FAKEUPDATES |
| URL | hxxp://91[.]202[.]4[.]96/LED/PDF | Emmenhtal |
| URL | hxxp://irubix[.]ir/wp-content/images/fre[.]php hxxp://37[.]220[.]0[.]54/1448/logs/fre[.]php |
LokiBot |
| URL | hxxp://147[.]45[.]44[.]209/din[.]exe | Vidar |
| URL | hxxp://91[.]214[.]78[.]88/vmSecureServertrafficWptemp[.]php | DCRat |
| URL | hxxp://45[.]90[.]12[.]129/Simps/ur0a[.]sh | Bashlite |
| URL | hxxp://103[.]192[.]179[.]32/linux_mips64 hxxp://103[.]192[.]179[.]32/linux_amd64 hxxp://103[.]192[.]179[.]32/linux_mips64el hxxp://103[.]192[.]179[.]32/linux_arm5 hxxp://103[.]192[.]179[.]32/linux_mips hxxp://103[.]192[.]179[.]32/linux_mipsel hxxp://103[.]192[.]179[.]32/linux_386 hxxp://103[.]192[.]179[.]32/linux_arm7 hxxp://103[.]192[.]179[.]32/linux_arm6 hxxp://103[.]192[.]179[.]32/linux_aarch64 |
Kaiji |
