不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/04/08
※2025/04/08 更新
マルウェア感染させると考えられるURLを検知（2025/04/08）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://u1[.]strongboxjarring[.]shop/ckutad14g6[.]aac hxxps://u1[.]strongboxjarring[.]shop/lxxh4ecgb7[.]aac hxxps://u1[.]strongboxjarring[.]shop/kycmihgv75[.]aac hxxps://u1[.]strongboxjarring[.]shop/50oxdxfv1l[.]aac hxxps://u1[.]strongboxjarring[.]shop/2m8mx6g4cc[.]aac hxxps://u1[.]strongboxjarring[.]shop/wnt3srkapu[.]aac hxxps://u1[.]strongboxjarring[.]shop/67bicgfjwx[.]aac hxxps://u1[.]strongboxjarring[.]shop/1mhyrvwem1[.]aac hxxps://u1[.]strongboxjarring[.]shop/cjyvy6os3j[.]aac hxxps://u1[.]strongboxjarring[.]shop/73ion4c7ff[.]aac hxxps://u1[.]strongboxjarring[.]shop/ygnsm634wk[.]aac hxxps://u1[.]strongboxjarring[.]shop/pp5rzmdvgd[.]aac hxxps://u1[.]strongboxjarring[.]shop/v5714t6b2e[.]aac hxxps://u1[.]strongboxjarring[.]shop/zvm750t9ip[.]aac hxxps://u1[.]strongboxjarring[.]shop/65fdqvbrr6[.]aac hxxps://u1[.]strongboxjarring[.]shop/saubck698c[.]aac hxxps://u1[.]strongboxjarring[.]shop/g729ac7qoi[.]aac hxxps://u1[.]strongboxjarring[.]shop/3ffa9jort4[.]aac hxxps://u1[.]strongboxjarring[.]shop/59wozrevzt[.]aac hxxps://u1[.]strongboxjarring[.]shop/jratfyiz1j[.]aac hxxps://u1[.]strongboxjarring[.]shop/nwe2dgnhsj[.]aac hxxps://u1[.]strongboxjarring[.]shop/e9t5r8cksw[.]aac hxxps://u1[.]strongboxjarring[.]shop/u9yj2p0xea[.]aac hxxps://u1[.]strongboxjarring[.]shop/v1voxyuh7a[.]aac |
ClearFake |
| URL | hxxps://eficadgdl[.]com/well/Omitted-Credentials_encrypted_6A17930[.]bin hxxp://www[.]prorites[.]com/wp-content/dsdb28de-kw0ch1msvi-003/ hxxps://www[.]silvesterinmailand[.]com/wp-content/uploads/ibvgux-yg4-03475/ hxxp://homemyland[.]net/tmp/wUHdeBS/ hxxps://www[.]celbra[.]com[.]br/old/wp-content/uploads/2019/mbwl6-lwu0psmcb-523/ hxxp://prihlaska[.]sagitta[.]cz/wp-content/uploads/WwcQXtRta/ hxxps://protectivecoatings[.]ro/Kaeder[.]chm hxxp://135[.]148[.]3[.]78/cfr/gwIIb31[.]bin hxxp://195[.]3[.]223[.]110/aMTFzt31[.]bin hxxp://172[.]93[.]217[.]118/vLmPyvU185[.]bin hxxp://kwonganhoney[.]com[.]au/2g/StONIiffblKmh166[.]bin hxxp://kwonganhoney[.]com[.]au/2g/Oxyrhynch[.]qxd |
CloudEyE |
| URL | hxxps://api[.]telegram[.]org/bot8162223389:AAH2RDiU3vMZB9ziQM2XzQn3SGkNjgVLkm4/sendMessage?chat_id=1018401531 hxxps://api[.]telegram[.]org/bot8059833264:AAHZGg4S0q1--n4mQbEzPQWC33XrIb7ei08/sendMessage?chat_id=6989593343 hxxps://api[.]telegram[.]org/bot8016404655:AAEsTfOcR-DjhV53FmbGXK9eLPYnncPBO-w/sendMessage?chat_id=7551782158 |
Snake Keylogger |
| URL | hxxp://117[.]217[.]128[.]103:50261/Mozi[.]m | Mozi |
| URL | hxxps://codeload[.]github[.]com/tirtekeka/rat-client/zip/refs/heads/main hxxp://176[.]113[.]115[.]7/files/7872050143/KIAJ3jf[.]exe |
AsyncRAT |
| URL | hxxp://151[.]243[.]81[.]77/snype[.]mpsl hxxp://151[.]243[.]81[.]77/snype[.]arm5 hxxp://151[.]243[.]81[.]77/snype[.]arm4 hxxp://151[.]243[.]81[.]77/snype[.]mips hxxp://151[.]243[.]81[.]77/snype[.]x86 |
Bashlite |
| URL | hxxps://lapsack[.]com/3q7q[.]js hxxps://lapsack[.]com/js[.]php |
FAKEUPDATES |
| URL | hxxps://cf[.]jolttapestry[.]fun/7456f63a46cc318334a70159aa3c4291 | Rhadamanthys |
| URL | hxxps://shiftmodh[.]run/doxz hxxps://mfurthert[.]run/azpp hxxps://irambutanvcx[.]run/adioz hxxps://kjpuerrogfh[.]live/iqwez hxxps://ltargett[.]top/dsANGt hxxps://fresheslam[.]run/qywix hxxps://enhancety[.]digital/kedi hxxps://zgplantainklj[.]run/opafg hxxps://opimendu[.]digital/poqwe hxxps://modtunes[.]live/gooz hxxps://qtargett[.]top/dsANGt hxxps://breedom[.]shop/fleeonepoint[.]ogg hxxps://nadvennture[.]top/GKsiio hxxps://uywmedici[.]top/noagis hxxps://fescapadue[.]live/SPzkwq hxxps://4rhxhube[.]run/pogrs hxxps://2ywmedici[.]top/noagis hxxps://furthert[.]run/azpp hxxps://reformzv[.]digital/guud hxxps://apuerrogfh[.]live/iqwez hxxps://vquavabvc[.]top/iuzhd hxxps://0targett[.]top/dsANGt hxxps://easyfwdr[.]digital/azxs hxxps://jjrxsafer[.]top/shpaoz hxxps://upuerrogfh[.]live/iqwez hxxps://palsmedq[.]run/agozn hxxps://-metalsyo[.]digital/opsa hxxps://xplantainklj[.]run/opafg hxxps://travelilx[.]top/GSKAiz |
Lumma Stealer |
| URL | hxxp://176[.]113[.]115[.]7/files/7306704070/WmP4vZj[.]exe | Coinminer |
| URL | hxxp://www[.]mobileautosalon[.]com/Downloads/Requerimento[.]lnk hxxp://www[.]gateway[.]funnelconsultants[.]com/Downloads/Requerimento[.]lnk hxxp://maxdarrah[.]com/Downloads/Requerimento[.]lnk hxxp://www[.]superxsuper[.]com/Downloads/Requerimento[.]lnk hxxp://bezpecnost-csob[.]cz[.]kjfdraws[.]com/Downloads/Requerimento[.]lnk |
Emmenhtal |
| URL | hxxp://176[.]65[.]142[.]190/BLACKYY/kkk[.]ps1 | Remcos |
| URL | hxxp://176[.]65[.]142[.]190/Blackyy/NEWFILE[.]ps1 hxxp://176[.]65[.]142[.]190/BLACKYY/SIRDEE[.]ps1 hxxp://176[.]65[.]142[.]190/Blackyy/Fasvorite[.]ps1 |
Agent Tesla |
