不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2025/06/25
※2025/06/25 更新
マルウェア感染させると考えられるURLを検知（2025/06/25）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://141[.]98[.]6[.]56/api/YTAsODYsODIsOWQsYTEsODgsOTAsOTUsNjUsN2Qs hxxp://77[.]105[.]164[.]178/api/YTAsODYsODIsOWQsYTEsODgsOTAsOTUsNjUsN2Qs hxxp://95[.]164[.]53[.]45/api/YTAsODYsODIsOWQsYTEsODgsOTAsOTUsNjUsN2Qs |
SmartLoader |
| URL | hxxp://195[.]82[.]146[.]92/23be681439654a60[.]php hxxp://45[.]141[.]233[.]187/274573807382bb15[.]php |
Stealc |
| URL | hxxp://185[.]157[.]213[.]40/ver/0622/dat1/Dtbeuj[.]pdf | PureCrypter |
| URL | hxxps://leatherbook[.]org/SR0ymlWkoOcyiZuXCrFr3HWgupYiPaMXa-GLcDabjeW hxxps://jswebcloud[.]com/sync[.]adv[.]min[.]js hxxps://folders[.]emeraldpinesolutions[.]com/viewDashboard |
FAKEUPDATES |
| URL | hxxps://devindicator[.]dev/webgl[.]wav hxxps://swedrent[.]com/js[.]php hxxps://swedrent[.]com/3c7b[.]js |
KongTuke |
| URL | hxxp://147[.]124[.]212[.]84/host/devilL[.]ps1 hxxp://147[.]124[.]212[.]84/host/devil[.]ps1 hxxp://62[.]60[.]208[.]170/90/wegivenbestopportuniteytoprovideusnothing[.]hta hxxp://103[.]83[.]87[.]68/xampp/cg/wp4096799-lost-in-space-wallpapers[.]jpg hxxp://149[.]154[.]158[.]50/xampp/cb/wp4096799-lost-in-space-wallpapers[.]jpg hxxp://149[.]154[.]158[.]50/80/greatdaysgivenmebetterthingstowalkniceforme[.]hta hxxp://149[.]154[.]158[.]50/200/givenbestgiftforeverybodypersonforbetterthingstodo[.]hta hxxp://149[.]154[.]158[.]50/90/givenmebestthingswithgreatthings[.]hta hxxp://149[.]154[.]158[.]50/100/sweetnessgoodforbetterplacewithgreatnessforme[.]hta |
Remcos |
| URL | hxxps://api[.]telegram[.]org/bot7553756477:AAEJRDCZrF55wgYQ-4cK-cvXQztk-pQTicg/sendMessage?chat_id=7564846096 hxxps://api[.]telegram[.]org/bot7787382336:AAHodj7sAaGlS14X0cfcS0UM0xTJ1hePHIU/sendMessage?chat_id=7660849299 |
Snake Keylogger |
| URL | hxxp://176[.]96[.]131[.]92/gnet[.]sh | Bashlite |
| URL | hxxps://theipgenerators[.]com/uploads/uptownwealth[.]jpg hxxps://novodominio01[.]com[.]br/Upcrypter/01/MeusArquivos01[.]txt hxxp://novodominio01[.]com[.]br/Upcrypter/01/MeusArquivos03[.]txt hxxp://novodominio01[.]com[.]br/Upcrypter/01/MeusArquivos02[.]txt hxxps://cdn[.]tagbox[.]io/assets/68548eff54ec480011257cb7/191b078a-4e57-4302-a2a0-c69c456c2a67---wp4096799-lost-in-space-wallpapers[.]jpg |
XWorm |
| URL | hxxps://3[.]253[.]0[.]41/evil[.]hta | Metasploit |
| URL | hxxps://evricourier-notice[.]top/api | Lumma Stealer |
| URL | hxxp://46[.]183[.]223[.]21/oIDIbsU64[.]bin hxxp://46[.]183[.]223[.]21/VVbPPNjtgSWnkCnsXwvK21[.]bin |
CloudEyE |
| URL | hxxp://107[.]174[.]127[.]172:8080/02[.]08[.]2022[.]exe hxxp://20[.]89[.]73[.]220/02[.]08[.]2022[.]exe hxxp://156[.]227[.]233[.]153:4433/02[.]08[.]2022[.]exe hxxp://185[.]208[.]158[.]168:8443/02[.]08[.]2022[.]exe hxxp://113[.]45[.]148[.]46/02[.]08[.]2022[.]exe hxxp://115[.]190[.]74[.]103:9333/02[.]08[.]2022[.]exe hxxp://47[.]102[.]209[.]177:33221/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://158[.]51[.]126[.]131/xm[.]sh hxxp://158[.]51[.]126[.]131/meta[.]sh |
Coinminer |
| URL | hxxp://193[.]34[.]77[.]218/125/wensivragoodformebestthingsforbetter[.]hta | Formbook |
