不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様3社 -
2025/04/14
※2025/04/14 更新
マルウェア感染させると考えられるURLを検知（2025/04/14）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://u1[.]aqueductdonor[.]shop/09ghf7tdw7[.]aac hxxps://u1[.]aqueductdonor[.]shop/uvmmtktw6x[.]aac hxxps://check[.]cybaf[.]icu/gkcxv[.]google hxxps://u1[.]aqueductdonor[.]shop/c0k6ewvqwz[.]aac hxxps://check[.]munen[.]icu/gkcxv[.]google hxxps://check[.]vosyr[.]icu/gkcxv[.]google hxxps://u1[.]aqueductdonor[.]shop/ijoor1sva4[.]aac hxxps://check[.]kyzog[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/rrqssyuyij[.]aac hxxps://check[.]lysyz[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/pfhcyz8kie[.]aac hxxps://u1[.]entouragescuff[.]shop/csxgzv7hou[.]aac hxxps://u1[.]entouragescuff[.]shop/en4cr9ijea[.]aac hxxps://u1[.]entouragescuff[.]shop/b4jjy3whvr[.]aac hxxps://check[.]napef[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/ljrbovmg60[.]aac hxxps://u1[.]entouragescuff[.]shop/zyogxwrzb4[.]aac hxxps://check[.]qolun[.]icu/gkcxv[.]google hxxps://check[.]voded[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/yog9bych53[.]aac hxxps://check[.]mesen[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/ih0ip4ejpv[.]aac hxxps://check[.]sesaf[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/m4yc8nulpi[.]aac hxxps://check[.]gywic[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/sdtoie0m1i[.]aac hxxps://check[.]casog[.]icu/gkcxv[.]google hxxps://check[.]xasad[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/jpyiig40q0[.]aac hxxps://u1[.]entouragescuff[.]shop/amejn3ks0j[.]aac hxxps://check[.]tidag[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/dep76mnheh[.]aac hxxps://check[.]lezum[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/yb9slcwdj7[.]aac hxxps://u1[.]entouragescuff[.]shop/0mubxe50xx[.]aac hxxps://u1[.]entouragescuff[.]shop/6ipxcl1qqn[.]aac hxxps://u1[.]entouragescuff[.]shop/e8el7svy2b[.]aac hxxps://u1[.]entouragescuff[.]shop/6ifdwrkdu5[.]aac hxxps://check[.]xiwuc[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/8ussmfigbw[.]aac hxxps://u1[.]entouragescuff[.]shop/3ikv75idzj[.]aac hxxps://u1[.]entouragescuff[.]shop/wepd2gsk97[.]aac hxxps://u1[.]entouragescuff[.]shop/71b76q0q6n[.]aac hxxps://u1[.]entouragescuff[.]shop/tpy0ucj7p8[.]aac hxxps://check[.]zevyg[.]icu/gkcxv[.]google hxxps://u1[.]entouragescuff[.]shop/bcdmxo47tu[.]aac hxxps://u1[.]entouragescuff[.]shop/gcs5u41gaa[.]aac hxxps://check[.]vuces[.]icu/gkcxv[.]google hxxps://check[.]dymyf[.]icu/gkcxv[.]google hxxps://u1[.]quenchunpaired[.]shop/shs16aqgbp[.]aac hxxps://u1[.]quenchunpaired[.]shop/yks5i8l6hb[.]aac hxxps://check[.]cuxor[.]icu/gkcxv[.]google hxxps://check[.]mujan[.]icu/gkcxv[.]google hxxps://u1[.]quenchunpaired[.]shop/s25isrwowy[.]aac hxxps://check[.]guqev[.]icu/gkcxv[.]google hxxps://u1[.]quenchunpaired[.]shop/36lfqg2oyu[.]aac hxxps://check[.]wolum[.]icu/gkcxv[.]google hxxps://check[.]wetad[.]icu/gkcxv[.]google hxxps://u1[.]quenchunpaired[.]shop/0azx1gt172[.]aac hxxps://check[.]mopoj[.]icu/gkcxv[.]google hxxps://check[.]bugyx[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/3hmmzu3ewp[.]aac hxxps://u1[.]verdictaffidavit[.]shop/aq687wi295[.]aac hxxps://check[.]xufam[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/y7q4qhdbx3[.]aac hxxps://u1[.]verdictaffidavit[.]shop/oshg2be1lf[.]aac hxxps://u1[.]verdictaffidavit[.]shop/hnr64617fz[.]aac hxxps://u1[.]verdictaffidavit[.]shop/2jtvmhc15a[.]aac hxxps://check[.]xiwaj[.]icu/gkcxv[.]google hxxps://check[.]bugix[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/znra1yd5o6[.]aac hxxps://check[.]favop[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/8nv319jyu3[.]aac hxxps://u1[.]verdictaffidavit[.]shop/vgpjnxpgmy[.]aac hxxps://u1[.]verdictaffidavit[.]shop/xdic8dx92t[.]aac hxxps://check[.]huquw[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/3dpas6e223[.]aac hxxps://u1[.]verdictaffidavit[.]shop/d9muv8l66y[.]aac hxxps://u1[.]verdictaffidavit[.]shop/raklsinepw[.]aac hxxps://u1[.]verdictaffidavit[.]shop/hyinssxrym[.]aac hxxps://u1[.]verdictaffidavit[.]shop/cekkv9169e[.]aac hxxps://u1[.]verdictaffidavit[.]shop/sxgeaa0tde[.]aac hxxps://u1[.]verdictaffidavit[.]shop/bz47d2z9c3[.]aac hxxps://check[.]vefim[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/ibgiov6zvo[.]aac hxxps://check[.]pawol[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/lzoqsyrqui[.]aac hxxps://u1[.]verdictaffidavit[.]shop/1t3iad8525[.]aac hxxps://u1[.]verdictaffidavit[.]shop/trghe0fbz4[.]aac hxxps://u1[.]verdictaffidavit[.]shop/spkng0yf9t[.]aac hxxps://check[.]dehoz[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/w19wmy0tvg[.]aac hxxps://u1[.]verdictaffidavit[.]shop/7kpjaeldbr[.]aac hxxps://u1[.]verdictaffidavit[.]shop/f2pg1xugcl[.]aac hxxps://check[.]firoc[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/wfx7j6x1sz[.]aac hxxps://u1[.]verdictaffidavit[.]shop/tbdspc6yy4[.]aac hxxps://check[.]qowot[.]icu/gkcxv[.]google hxxps://check[.]jexem[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/sv737s9e8u[.]aac hxxps://u1[.]verdictaffidavit[.]shop/5bo54vqq00[.]aac hxxps://u1[.]verdictaffidavit[.]shop/dtj4f85b97[.]aac hxxps://u1[.]verdictaffidavit[.]shop/5suq8vxfb1[.]aac hxxps://u1[.]verdictaffidavit[.]shop/fmlx51h9y2[.]aac hxxps://check[.]cuved[.]icu/gkcxv[.]google hxxps://check[.]pifos[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/0y8harm3t2[.]aac hxxps://u1[.]verdictaffidavit[.]shop/9g7aresfga[.]aac hxxps://u1[.]verdictaffidavit[.]shop/2l5sfeeleo[.]aac hxxps://u1[.]verdictaffidavit[.]shop/sdd4edwva3[.]aac hxxps://u1[.]verdictaffidavit[.]shop/44836jigyv[.]aac hxxps://u1[.]verdictaffidavit[.]shop/vngmy5ormy[.]aac hxxps://u1[.]verdictaffidavit[.]shop/gjxvlgyisy[.]aac hxxps://u1[.]verdictaffidavit[.]shop/w12nfs7qzc[.]aac hxxps://check[.]revuq[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/b2u9pog1xx[.]aac hxxps://u1[.]verdictaffidavit[.]shop/tycpg8rjap[.]aac hxxps://check[.]xulap[.]icu/gkcxv[.]google hxxps://check[.]wysaf[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/4da8bt5n2w[.]aac hxxps://check[.]sipit[.]icu/gkcxv[.]google hxxps://u1[.]verdictaffidavit[.]shop/kw1e0vqnj5[.]aac hxxps://check[.]mavew[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/vej7zrygno[.]aac hxxps://check[.]pedyg[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/54on8ok1z1[.]aac hxxps://check[.]bogig[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/h8yqhzo83g[.]aac hxxps://u1[.]curtainfrown[.]shop/hxx2dm4oju[.]aac hxxps://check[.]dypit[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/52pl6sf9ko[.]aac hxxps://check[.]wyham[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/l5bnf6na1k[.]aac hxxps://check[.]talup[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/pcbx3nnn20[.]aac hxxps://check[.]qutyd[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/z6s3avfrha[.]aac hxxps://check[.]sifum[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/2a1ia3265d[.]aac hxxps://u1[.]curtainfrown[.]shop/u4bcp8hztl[.]aac hxxps://u1[.]curtainfrown[.]shop/jvi5u4akij[.]aac hxxps://check[.]debul[.]icu/gkcxv[.]google hxxps://u1[.]curtainfrown[.]shop/b29lwk3yfv[.]aac hxxps://u1[.]curtainfrown[.]shop/j8ypxs0zfx[.]aac hxxps://u1[.]curtainfrown[.]shop/ssb3xsifzk[.]aac hxxps://u1[.]curtainfrown[.]shop/p6g9w9cfqt[.]aac |
ClearFake |
| URL | hxxp://176[.]65[.]144[.]35/gtop[.]sh hxxp://156[.]229[.]233[.]188/Please-Subscribe-To-My-YT-Channel-VegaSec/1isequal9[.]x86_64 hxxp://156[.]229[.]233[.]188/1isequal9[.]x86_64 hxxp://82[.]152[.]90[.]146/a-r[.]m-4[.]Sakura |
Bashlite |
| URL | hxxps://linksoflondononsale[.]top/analyze/index[.]php hxxps://sales2016[.]top/analyze/index[.]php hxxps://sales2016[.]top/analyze/loop[.]js hxxps://alhasba[.]com/analyze/loop[.]js hxxps://alhasba[.]com/analyze/index[.]php hxxps://bstionline[.]com/analyze/loop[.]js hxxps://vog168[.]top/pictures/index[.]php hxxps://bstionline[.]com/analyze/index[.]php hxxps://vog168[.]top/pictures/analytics[.]js hxxps://linksoflondononsale[.]top/analyze/loop[.]js hxxps://lycosex[.]top/prime/index[.]php hxxps://lycosex[.]top/prime/loop[.]js hxxps://rajjas[.]com/4e6y[.]js hxxps://rajjas[.]com/js[.]php hxxps://cloud[.]emeraldpinesenterprises[.]com/profileLayout hxxps://mail[.]pacifictaxcounsel[.]com/profileLayout hxxps://waxworkx[.]com/4e7u[.]js hxxps://waxworkx[.]com/js[.]php hxxps://izone[.]digital/lime/loop[.]js hxxps://izone[.]digital/lime/index[.]php hxxps://izone[.]digital/lime/vid[.]php hxxps://krediteonlinevergleichen[.]top/lime/woot[.]zip hxxps://cpanel[.]gemstonebookkeepingservices[.]com/profileLayout hxxps://refanprediction[.]shop/prime/loop[.]js hxxps://refanprediction[.]shop/prime/index[.]php hxxps://zakachka[.]top/prime/loop[.]js hxxps://zakachka[.]top/prime/index[.]php hxxps://refanprediction[.]shop/prime/vid[.]php |
FAKEUPDATES |
| URL | hxxps://egifts[.]quest/ibla[.]ogg hxxps://r2[.]tugrambling[.]shop/b924a41af76c71b90e0b7f6ccb3ec7ceb6a2e0a7cb87d671[.]dif[.]potm hxxps://cartyard[.]shop/nc2[.]bin hxxps://naturelovetop[.]top/api hxxps://fsceeptersong[.]digital/iyhj hxxps://tsoursopsf[.]run/gsoiao hxxps://stardashn[.]shop/Gaiozn hxxps://jnavstarx[.]shop/FoaJSi hxxps://jumpstarbt[.]live/trop hxxps://uchangeaie[.]top/geps hxxps://u1[.]aqueductdonor[.]shop/6i1bzm0xqa[.]aac hxxps://tjeasyupgw[.]live/eosz hxxps://qxcelmodo[.]run/nahd hxxps://renewxc[.]live/klagz hxxps://astrowev[.]today/GOkaOx hxxps://3oreheatq[.]live/gsopp hxxps://adaptwrx[.]digital/poqr hxxps://0liftally[.]top/xasj hxxps://zealjkh[.]digital/qpte hxxps://wchangeaie[.]top/geps hxxps://dynamiczl[.]live/tgre hxxps://baliftally[.]top/xasj hxxps://1lliftally[.]top/xasj hxxps://gclarmodq[.]top/qoxo hxxps://mzestmodp[.]top/zeda hxxps://lxcelmodo[.]run/nahd hxxps://-upmodini[.]digital/gokk hxxps://-soursopsf[.]run/gsoiao hxxps://ueasyupgw[.]live/eosz hxxps://szestmodp[.]top/zeda hxxps://oeasyupgw[.]live/eosz hxxps://ojrxsafer[.]top/shpaoz hxxps://hxcelmodo[.]run/nahd hxxps://elvernwood[.]digital/gids hxxps://dclarmodq[.]top/qoxo hxxps://mliftally[.]top/xasj hxxps://tliftally[.]top/xasj hxxps://wclarmodq[.]top/qoxo hxxps://uu5salaccgfa[.]top/gsooz hxxps://axzestmodp[.]top/zeda hxxps://gyxcelmodo[.]run/nahd hxxps://modproz[.]run/opqz hxxps://u1[.]entouragescuff[.]shop/35bf3fcr80[.]aac hxxps://d1[.]dyfot[.]fun/d6d0c07fe5ee8c61f23e1cf95c5035fc hxxps://ffurthert[.]run/azpp hxxps://astroset[.]top/GLasojz hxxps://u1[.]entouragescuff[.]shop/s0si8s0ryw[.]aac hxxps://jzestmodp[.]top/zeda hxxps://yclarmodq[.]top/qoxo hxxps://ixcelmodo[.]run/nahd hxxps://u1[.]quenchunpaired[.]shop/j4vs9gkur6[.]aac hxxps://u1[.]quenchunpaired[.]shop/0zrh4rz6vs[.]aac hxxps://u1[.]quenchunpaired[.]shop/bmbh68dhvi[.]aac hxxps://5easyupgw[.]live/eosz hxxps://osalaccgfa[.]top/gsooz hxxps://xeasyupgw[.]live/eosz hxxps://gchangeaie[.]top/geps hxxps://highcouncipl[.]live/sooz hxxps://8upmodini[.]digital/gokk hxxps://weasyupgw[.]live/eosz hxxps://vqaliantheart[.]live/oniz hxxps://txcelmodo[.]run/nahd hxxps://qzestmodp[.]top/zeda hxxps://6liftally[.]top/xasj hxxps://enhancrea[.]digital/opzs hxxps://7zestmodp[.]top/zeda hxxps://wvqaliantheart[.]live/oniz hxxps://tangledxwood[.]digital/gpep hxxps://pssoursopsf[.]run/gsoiao hxxps://minstrelwpay[.]digital/gudd hxxps://waquesolp[.]run/agosoz hxxps://v0nighetwhisper[.]top/lekd hxxps://owlflright[.]digital/qopy hxxps://nighetwhisper[.]top/lekd hxxps://lonfgshadow[.]live/xawi hxxps://jawdedmirror[.]run/ewqd hxxps://beowlflright[.]digital/qopy hxxps://aquesolp[.]run/agosoz hxxps://xxcelmodo[.]run/nahd hxxps://cchangeaie[.]top/geps hxxps://onproenhann[.]digital/thnb hxxps://6[.]easyupgw[.]live/eosz hxxps://imjrxsafer[.]top/shpaoz hxxps://maidenbfair[.]run/auqwi hxxps://rvsalaccgfa[.]top/gsooz hxxps://blacksmithz[.]run/yhfh hxxps://s3liftally[.]top/xasj hxxps://3xcelmodo[.]run/nahd hxxps://qupmodini[.]digital/gokk hxxps://olsalaccgfa[.]top/gsooz hxxps://lpzestmodp[.]top/zeda hxxps://rupmodini[.]digital/gokk hxxps://bxcelmodo[.]run/nahd hxxps://heasyupgw[.]live/eosz hxxps://3zestmodp[.]top/zeda hxxps://cxcelmodo[.]run/nahd hxxps://yeasyupgw[.]live/eosz hxxps://ieasyupgw[.]live/eosz hxxps://-zestmodp[.]top/zeda hxxps://2easyupgw[.]live/eosz hxxps://quantyu[.]bet/AOSkwi hxxps://fsalaccgfa[.]top/gsooz hxxps://bitbucket[.]org/fedormaximofgfdvdc/saxxxax/downloads/bgbgggggggggg[.]exe hxxps://bitbucket[.]org/fedormaximofgfdvdc/saxxxax/downloads/bfffffdgsdgfsdvfsdfvrvsdfv[.]exe hxxps://bitbucket[.]org/fedormaximofgfdvdc/saxxxax/downloads/ccccccccccccccssssssss[.]exe hxxps://bitbucket[.]org/fedormaximofgfdvdc/saxxxax/downloads/xsxsxscsc[.]exe hxxp://www[.]ihre-rechnung[.]online/Documents/Gutschein20[.]pdf[.]lnk hxxps://revitmodh[.]run/pzaw hxxps://dsoursopsf[.]run/gsoiao hxxps://rliftally[.]top/xasj hxxps://bsalaccgfa[.]top/gsooz hxxps://acceconz[.]run/oxap hxxps://2bzestmodp[.]top/zeda hxxps://jesxterplay[.]run/tuyhd hxxps://siwlverhelm[.]live/tuidp hxxps://maliftally[.]top/xasj hxxps://bxattlepath[.]digital/ogda hxxps://ichangeaie[.]top/geps hxxps://0yowlflright[.]digital/qopy hxxps://winetersgard[.]digital/agbb hxxps://3changeaie[.]top/geps hxxps://5zestmodp[.]top/zeda hxxps://hjesxterplay[.]run/tuyhd hxxps://xbxattlepath[.]digital/ogda hxxps://8liftally[.]top/xasj |
Lumma Stealer |
| URL | hxxps://adguard[.]digital/exprgt[.]exe hxxps://ravenfootballclub[.]com/wp-content/crypted[.]exe hxxps://raw[.]githubusercontent[.]com/kluquert/deripas/refs/heads/main/geaswAa[.]exe |
Vidar |
| URL | hxxps://korinpc[.]com/diagnostics[.]php | Satacom |
| URL | hxxps://myprivatedrives[.]com/ticket_line/openai[.]php | Spyder Patchwork |
| URL | hxxp://91[.]92[.]46[.]133/8f11bd01520293d6[.]php hxxps://65[.]21[.]187[.]53/sqlite3[.]dll |
Stealc |
| URL | hxxp://185[.]7[.]214[.]181/nh[.]exe hxxp://185[.]7[.]214[.]181/w[.]exe hxxp://77[.]223[.]119[.]85/tb[.]exe hxxp://77[.]223[.]119[.]85/rxm[.]exe |
DCRat |
| URL | hxxp://185[.]29[.]8[.]54/GGQTm109[.]bin hxxp://185[.]29[.]9[.]54/bQvZIeyC241[.]bin hxxp://194[.]156[.]79[.]186/SJwiYN23[.]bin hxxp://194[.]156[.]79[.]186/YuOYhx138[.]bin hxxp://185[.]29[.]8[.]53/oXwOOtJJxxs164[.]bin hxxp://185[.]29[.]8[.]53/bDhZf80[.]bin |
CloudEyE |
| URL | hxxps://rofleratom[.]com/test/ hxxps://www[.]wearerescue[.]com/wp-content/plugins/resads/mfls[.]php?id=qwSPUwLH23Twhnr6FMpI |
Latrodectus |
| URL | hxxp://176[.]65[.]144[.]205/sc/implant[.]exe hxxp://signin[.]clouddomainservice[.]com/help[.]exe hxxp://45[.]79[.]43[.]128/DanielScottLicense[.]jpg[.]exe hxxp://45[.]79[.]43[.]128/help[.]exe hxxp://45[.]79[.]43[.]128/runner[.]exe hxxp://45[.]79[.]43[.]128/a[.]txt hxxp://signin[.]clouddomainservice[.]com/a[.]txt |
Sliver |
| URL | hxxp://aaa[.]dsaj2a[.]org/config[.]rar | XOR DDoS |
| URL | hxxp://89[.]23[.]107[.]219/info1[.]exe | SmokeLoader |
| URL | hxxp://176[.]65[.]142[.]23/ftp/files/Branch_Setup[.]exe hxxp://195[.]3[.]223[.]110/BhYsOmsu139[.]bin hxxps://lumiraseo[.]com/download/installer[.]exe hxxps://lumiraseo[.]com/download/payload[.]exe hxxps://raw[.]githubusercontent[.]com/rizzler2311/sadasdada/refs/heads/main/s[.]exe hxxps://raw[.]githubusercontent[.]com/EXOPLT/test/refs/heads/main/1[.]exe hxxps://saddlebrown-hyena-989303[.]com/xworm[.]txt |
AsyncRAT |
| URL | hxxp://dndmelectrical[.]co[.]za/tt/tt[.]exe hxxp://172[.]245[.]208[.]21/xampp/gwm/wecashourdrgoodnewthingsgoodbusinessrealse[.]hta hxxp://176[.]65[.]142[.]190/host/BAGG[.]ps1 hxxp://172[.]245[.]208[.]21/342/csrss[.]exe hxxp://176[.]65[.]142[.]190/host/SIRRDEE[.]ps1 hxxps://raw[.]githubusercontent[.]com/RAHMOUNBEN/LC/refs/heads/main/XClient[.]exe hxxps://raw[.]githubusercontent[.]com/JustJZero/ahh/refs/heads/main/Cloudy[.]exe |
Formbook |
| URL | hxxps://h1[.]rectalcrumb[.]shop/hostmon[.]bin hxxps://documents[.]cavradocuments[.]top/quiet/VZSIAQFD[.]msi |
HijackLoader |
| URL | hxxp://103[.]194[.]104[.]197/qbcore[.]dll | ValleyRAT |
| URL | hxxp://213[.]209[.]150[.]18/M7XQmz2DgtiyE3f[.]exe | LokiBot |
| URL | hxxp://104[.]168[.]7[.]18/xampp/mch/mc/hhu[.]hta hxxp://176[.]65[.]142[.]190/host/KEND[.]ps1 hxxp://188[.]127[.]231[.]170/450/gon/uresultsgivemebestthingsentiretimegiventookbeack______uresultsgivemebestthingsentiretimegiventookbeack_________uresultsgivemebestthingsentiretimegiventookbeack[.]doc hxxps://huadongrubbercable[.]com/customer-order/r[.]txt hxxps://bitbucket[.]org/fedormaximofgfdvdc/saxxxax/downloads/filee[.]exe hxxps://saddlebrown-hyena-989303[.]com/ConvertedFile[.]txt hxxp://74[.]208[.]132[.]59/xampp/kbn/niceskillfornewdevvelopmentsforheregiven[.]txt |
Remcos |
| URL | hxxp://156[.]229[.]233[.]88/tftp hxxp://156[.]229[.]233[.]88/cron hxxp://156[.]229[.]233[.]88/wget hxxp://156[.]229[.]233[.]88/apache2 hxxp://156[.]229[.]233[.]88/openssh hxxp://156[.]229[.]233[.]88/sh hxxp://156[.]229[.]233[.]88/ftp hxxp://156[.]229[.]233[.]88/sshd hxxp://156[.]229[.]233[.]88/ntpd hxxp://156[.]229[.]233[.]88/n hxxp://87[.]121[.]84[.]211/n hxxp://87[.]121[.]84[.]211/pftp hxxp://87[.]121[.]84[.]211/apache2 hxxp://87[.]121[.]84[.]211/openssh hxxp://87[.]121[.]84[.]211/sh hxxp://87[.]121[.]84[.]211/wget hxxp://87[.]121[.]84[.]211/ntpd hxxp://87[.]121[.]84[.]211/sshd hxxp://87[.]121[.]84[.]211/ftp hxxp://87[.]121[.]84[.]211/cron hxxp://87[.]121[.]84[.]211/tftp hxxp://87[.]121[.]84[.]211/%20 |
Tsunami |
| URL | hxxp://87[.]121[.]84[.]209/shell | ConnectBack |
| URL | hxxps://www[.]eaznetagencies[.]co[.]ke/output[.]txt hxxps://www[.]eaznetagencies[.]co[.]ke/readme[.]txt hxxps://huadongrubbercable[.]com/vickk/r[.]txt hxxps://huadongrubbercable[.]com/customer-order/friday/r[.]txt hxxp://5[.]230[.]36[.]105/output/output[.]txt |
DBatLoader |
| URL | hxxp://196[.]251[.]70[.]88/InquiryList[.]txt hxxp://196[.]251[.]70[.]88/Zgoapd[.]wav |
DarkVision RAT |
| URL | hxxp://107[.]174[.]202[.]139/img/new_image[.]jpg hxxp://172[.]245[.]208[.]13/wex/taskhostw[.]exe hxxp://176[.]65[.]142[.]190/BLACKYY/newbag[.]ps1 hxxp://176[.]65[.]142[.]190/BLACKYY/FAV[.]ps1 hxxp://176[.]65[.]142[.]190/host/bag[.]ps1 hxxp://198[.]23[.]227[.]148/78/goodbusinessideasoneheretogiveubest[.]txt hxxp://176[.]65[.]142[.]190/host/NEWFILEEE[.]ps1 |
Agent Tesla |
| URL | hxxps://github[.]com/citraadvertising/X/raw/refs/heads/main/meter[.]exe | Meterpreter |
| URL | hxxps://github[.]com/RQ3Xd/1/raw/refs/heads/main/Quas13k[.]exe hxxps://github[.]com/RQ3Xd/1/raw/refs/heads/main/quas[.]dll hxxps://raw[.]githubusercontent[.]com/RQ3Xd/1/refs/heads/main/Quas13k[.]exe hxxps://raw[.]githubusercontent[.]com/xeroxzb/weqeq/main/thin[.]exe hxxps://raw[.]githubusercontent[.]com/XeroxzB/weqeq/main/asdasdasdasdasd[.]exe hxxp://upload[.]vina-host[.]com/get/3v3HcQGV0n/Client[.]exe hxxp://upload[.]vina-host[.]com/get/N6o9kvJuAq/Client[.]exe |
Quasar RAT |
| URL | hxxps://github[.]com/RQ3Xd/1/raw/refs/heads/main/c2new[.]exe | Coinminer |
| URL | hxxp://172[.]245[.]208[.]13/wex/wnsc[.]exe | DarkTortilla |
| URL | hxxps://documents[.]cavradocuments[.]top/5342c7fthng245t74jgv7c5432fv9j74253/heki[.]msi | Rhadamanthys |
| URL | hxxps://api[.]telegram[.]org/bot7364470606:AAEcz2z8Dv2QVAXOs9nVEg5EakMwUvY5Ssw/sendMessage?chat_id=7969902771 hxxps://api[.]telegram[.]org/bot7016021549:AAFFED6mrzzYMktPd78AMWdi_nAN7SC1JJY/sendMessage?chat_id=1018401531 |
Snake Keylogger |
| URL | hxxp://61[.]3[.]137[.]100:44479/Mozi[.]m hxxp://14[.]102[.]189[.]30:58105/Mozi[.]m hxxp://61[.]54[.]253[.]90:35217/Mozi[.]m hxxp://61[.]53[.]150[.]175:46959/Mozi[.]m hxxp://117[.]209[.]21[.]131:56248/Mozi[.]m |
Mozi |
| URL | hxxps://raw[.]githubusercontent[.]com/kibnakamoto/mimikatz/main/mimikatz[.]exe hxxp://st4b4n[.]fr/mimikatz[.]exe hxxps://167[.]250[.]49[.]155/bin/mimikatz[.]exe hxxp://212[.]227[.]245[.]12/mimikatz[.]exe hxxp://73[.]213[.]108[.]128:8081/mimi64[.]exe |
MimiKatz |
| URL | hxxp://172[.]245[.]208[.]13/wex/mghc[.]js hxxp://172[.]245[.]208[.]13/wex/wp[.]js hxxp://172[.]245[.]208[.]13/wex/wpp[.]js |
WSHRAT |
| URL | hxxp://file[.]weinitest[.]top:8880/linux_arm6 hxxp://23[.]146[.]40[.]48:808/linux_mips64el_softfloat hxxp://23[.]146[.]40[.]48:808/linux_mipsel_softfloat hxxp://23[.]146[.]40[.]48:808/2/linux_arm6 hxxp://23[.]146[.]40[.]48:808/linux_mips hxxp://23[.]146[.]40[.]48:808/2/linux_mips64 hxxp://file[.]weinitest[.]top:8880/linux_mips64el hxxp://23[.]146[.]40[.]48:808/2/linux_mipsel hxxp://23[.]146[.]40[.]48:808/linux_arm6 hxxp://23[.]146[.]40[.]48:808/linux_mips64el hxxp://23[.]146[.]40[.]48:808/linux_arm5 hxxp://file[.]weinitest[.]top:8880/linux_mipsel hxxp://23[.]146[.]40[.]48:808/2/linux_mips64el hxxp://file[.]weinitest[.]top:8880/linux_arm64 hxxp://file[.]weinitest[.]top:8880/linux_386 hxxp://file[.]weinitest[.]top:8880/linux_arm7 hxxp://file[.]weinitest[.]top:8880/linux_mips hxxp://file[.]weinitest[.]top:8880/linux_arm5 hxxp://file[.]weinitest[.]top:8880/2/linux_arm7 hxxp://file[.]weinitest[.]top:8880/2/linux_amd64 hxxp://file[.]weinitest[.]top:8880/linux_mips64el_softfloat hxxp://file[.]weinitest[.]top:8880/linux_mips64 hxxp://file[.]weinitest[.]top:8880/2/linux_aarch64 hxxp://file[.]weinitest[.]top:8880/2/linux_mips64el hxxp://23[.]146[.]40[.]48:808/linux_mips64_softfloat hxxp://file[.]weinitest[.]top:8880/linux_mips_softfloat hxxp://file[.]weinitest[.]top:8880/2/linux_mips64 hxxp://23[.]146[.]40[.]48:808/2/linux_arm7 hxxp://23[.]146[.]40[.]48:808/2/linux_arm5 hxxp://23[.]146[.]40[.]48:808/linux_arm64 hxxp://23[.]146[.]40[.]48:808/linux_mipsel hxxp://23[.]146[.]40[.]48:808/linux_amd64 hxxp://23[.]146[.]40[.]48:808/linux_ppc64el hxxp://23[.]146[.]40[.]48:808/2/linux_mips hxxp://23[.]146[.]40[.]48:808/linux_mips_softfloat hxxp://23[.]146[.]40[.]48:808/linux_mips64 hxxp://23[.]146[.]40[.]48:808/linux_arm7 hxxp://23[.]146[.]40[.]48:808/linux_ppc64 hxxp://23[.]146[.]40[.]48:808/2/linux_aarch64 hxxp://23[.]146[.]40[.]48:808/linux_386 hxxp://23[.]146[.]40[.]48:808/2/linux_amd64 |
Kaiji |
| URL | hxxp://cpcontacts[.]borubon-online[.]com/Downloads/Presentation hxxp://webdisk[.]singlelights[.]com/Downloads/Presentation hxxp://mail[.]7ntneg[.]com/Downloads/Presentation hxxp://www[.]singlelights[.]com/Downloads/Presentation hxxp://webdisk[.]esigndocu[.]ru/Downloads/Presentation hxxp://www[.]upt-in[.]com/Downloads/Presentation hxxp://pzjop[.]allaeima[.]com/Downloads/Presentation hxxp://mail[.]mercuirusint[.]com/Downloads/Presentation hxxp://4q[.]esigndocu[.]ru/Downloads/Presentation hxxp://www[.]gypsenma[.]com/Downloads/Presentation hxxp://mail[.]workspacedoc[.]com/Downloads/Presentation hxxp://www[.]aldnaube[.]com/Downloads/Presentation hxxp://harbor[.]lclouds[.]info/Downloads/Presentation hxxp://www[.]adobedownloader[.]info/Downloads/Presentation hxxp://www[.]omnl-uk[.]com/Downloads/Presentation hxxp://www[.]rovilane[.]ru/Downloads/Presentation hxxp://dfq[.]aldanbue[.]com/Downloads/Presentation hxxp://www[.]3e-eu[.]com/Downloads/Presentation hxxp://mail[.]safetymarine[.]cloud/Downloads/Presentation hxxp://www[.]sadnvik[.]com/Downloads/Presentation hxxp://www[.]deousemet[.]com/Downloads/Presentation hxxp://cpcontacts[.]rctelecon[.]info/Downloads/Presentation hxxp://www[.]wallsecuredfiles[.]info/Downloads/Presentation hxxp://cpanel[.]aldanbue[.]com/Downloads/Presentation hxxp://cpcalendars[.]singlelights[.]com/Downloads/Presentation hxxp://mail[.]diplomatresrot[.]com/Downloads/Presentation hxxp://mail[.]aldanbue[.]com/Downloads/Presentation hxxp://mail[.]ockisise[.]com/Downloads/Presentation hxxp://cpanel[.]singlelights[.]com/Downloads/Presentation hxxp://amanwhoneededgrace[.]com/Downloads/Presentation hxxp://jzfp[.]alva-technology[.]com/Downloads/Presentation hxxp://cpanel[.]borubon-online[.]com/Downloads/Presentation hxxp://cpanel[.]upt-in[.]com/Downloads/Presentation hxxp://cpcontacts[.]aaoun[.]com/Downloads/Presentation hxxp://mail[.]rovilane[.]ru/Downloads/Presentation hxxp://cpanel[.]omnl-uk[.]com/Downloads/Presentation hxxp://9cu[.]firexaue[.]com/Downloads/Presentation hxxp://cpcontacts[.]aldanbue[.]com/Downloads/Presentation hxxp://mail[.]jegast[.]com/Downloads/Presentation hxxp://mail[.]projectzdocu[.]co/Downloads/Presentation hxxp://cpcalendars[.]upt-in[.]com/Downloads/Presentation hxxp://5d[.]ewsaustraila[.]com/Downloads/Presentation hxxp://cpanel[.]edocusign[.]ru/Downloads/Presentation hxxp://cpcontacts[.]mercuirusint[.]com/Downloads/Presentation hxxp://mail[.]teknomedcines[.]live/Downloads/Presentation hxxp://www[.]goldbalt[.]com/Downloads/Presentation hxxp://www[.]asnako[.]com/Downloads/Presentation hxxp://cpanel[.]ockisise[.]com/Downloads/Presentation hxxp://www[.]whiting-tuner[.]com/Downloads/Presentation hxxp://mail[.]gypsenma[.]com/Downloads/Presentation hxxp://cpanel[.]ewsaustraila[.]com/Downloads/Presentation hxxp://mail[.]accessdnsl[.]com/Downloads/Presentation hxxp://mail[.]sadnvik[.]com/Downloads/Presentation hxxp://cpcontacts[.]ockisise[.]com/Downloads/Presentation hxxp://www[.]ockisise[.]com/Downloads/Presentation hxxp://www[.]crsetchic[.]com/Downloads/Presentation hxxp://qxi[.]matenom[.]com/Downloads/Presentation hxxp://mail[.]lenffer-de[.]com/Downloads/Presentation hxxp://www[.]lclouds[.]info/Downloads/Presentation hxxp://mail[.]cts-nordcis[.]com/Downloads/Presentation hxxp://webmail[.]aldanbue[.]com/Downloads/Presentation hxxp://mail[.]3e-eu[.]com/Downloads/Presentation hxxp://cpcalendars[.]cutterenergysolutions[.]info/Downloads/Presentation hxxp://xoo[.]mondial-ae[.]com/Downloads/Presentation hxxp://cpanel[.]lclouds[.]info/Downloads/Presentation hxxp://cpanel[.]enfamxb[.]com/Downloads/Presentation hxxp://cpcalendars[.]enfamxb[.]com/Downloads/Presentation hxxp://mail[.]dariymaster[.]com/Downloads/Presentation hxxp://r3xl[.]cutterenergysolutions[.]info/Downloads/Presentation hxxp://jrax[.]nvdcsadmin[.]org/Downloads/Presentation hxxp://ivrfo[.]sadnvik[.]com/Downloads/Presentation hxxp://cpanel[.]esigndocu[.]ru/Downloads/Presentation hxxp://pram[.]esigndocu[.]ru/Downloads/Presentation |
Emmenhtal |
| URL | hxxp://mail[.]workspacedoc[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]upt-in[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://webdisk[.]singlelights[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]rovilane[.]ru/Downloads/Cbqjobosim-Signed[.]exe hxxp://dfq[.]aldanbue[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]jegast[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]singlelights[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://harbor[.]lclouds[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]omnl-uk[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]projectzdocu[.]co/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]gypsenma[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]7ntneg[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]diplomatresrot[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://webdisk[.]esigndocu[.]ru/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcontacts[.]rctelecon[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]adobedownloader[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://4q[.]esigndocu[.]ru/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]aldnaube[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]wallsecuredfiles[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]mercuirusint[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]aldanbue[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]sadnvik[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://9cu[.]firexaue[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]borubon-online[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://amanwhoneededgrace[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]aldanbue[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]3e-eu[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]omnl-uk[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://pzjop[.]allaeima[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcontacts[.]aldanbue[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]singlelights[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcontacts[.]borubon-online[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcalendars[.]singlelights[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://jzfp[.]alva-technology[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]upt-in[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]rovilane[.]ru/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcontacts[.]aaoun[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]ockisise[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]deousemet[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]safetymarine[.]cloud/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcalendars[.]upt-in[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcontacts[.]ockisise[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]lclouds[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]goldbalt[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]whiting-tuner[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcontacts[.]mercuirusint[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]sadnvik[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcalendars[.]cutterenergysolutions[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]asnako[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]teknomedcines[.]live/Downloads/Cbqjobosim-Signed[.]exe hxxp://pram[.]esigndocu[.]ru/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]gypsenma[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpcalendars[.]enfamxb[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://ivrfo[.]sadnvik[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]accessdnsl[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://qxi[.]matenom[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]3e-eu[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://r3xl[.]cutterenergysolutions[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]ockisise[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://www[.]crsetchic[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]ockisise[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]ewsaustraila[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://5d[.]ewsaustraila[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]cts-nordcis[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]lclouds[.]info/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]esigndocu[.]ru/Downloads/Cbqjobosim-Signed[.]exe hxxp://xoo[.]mondial-ae[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]edocusign[.]ru/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]dariymaster[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://webmail[.]aldanbue[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://cpanel[.]enfamxb[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://mail[.]lenffer-de[.]com/Downloads/Cbqjobosim-Signed[.]exe hxxp://jrax[.]nvdcsadmin[.]org/Downloads/Cbqjobosim-Signed[.]exe hxxp://193[.]233[.]48[.]64/Downloads/Cbqjobosim-Signed[.]exe |
Ghost RAT |
| URL | hxxps://www[.]kmyjh[.]top/002[.]apk hxxps://www[.]kmyjh[.]top/005[.]apk hxxps://www[.]kmyjh[.]top/004[.]apk hxxps://www[.]kmyjh[.]top/003[.]apk hxxps://kmyjh[.]top/app-release[.]apk |
SpyNote |
| URL | hxxp://104[.]168[.]7[.]18/321/smss[.]exe hxxp://104[.]168[.]7[.]18/323/smss[.]exe hxxps://104[.]168[.]7[.]18/323/smss[.]exe hxxp://104[.]168[.]7[.]18/xampp/ungo/ung/shegivenmekissinglips[.]hta hxxp://104[.]168[.]7[.]18/xampp/mse/ms/newgreatthingswithniceworkonthem[.]hta |
MASS Logger |
| URL | hxxps://lumiraseo[.]com/download/main[.]bat | XWorm |
