不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/07/30
※2025/07/30 更新
マルウェア感染させると考えられるURLを検知（2025/07/30）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://raw[.]githubusercontent[.]com/erenaltunkeserr/XX/refs/heads/main/Microsoft[.]exe hxxp://176[.]46[.]158[.]8/files/7677226784/w4k69PJ[.]exe |
AsyncRAT |
| URL | hxxps://www[.]ruwa[.]fedor-turin[.]ru/login hxxps://bittsgly[.]my/atop/api hxxps://dravq[.]asia/wixj/api hxxp://176[.]46[.]158[.]8/files/7251572078/nmsqF1N[.]exe hxxps://nucleji[.]my/ituw/api hxxps://carpatxd[.]lat/atiw hxxps://plnnozg[.]pics/giru hxxps://podhxwf[.]lat/tiuy hxxps://tefere[.]lol/zam/api hxxps://xrayz[.]run/tnqb hxxps://urginll[.]digital/ajh hxxps://hobbcxez[.]top/zmna hxxps://songs[.]pics/tuwy hxxps://orderfg[.]top/agmt hxxps://artifizz[.]top/xpas hxxps://illusgw[.]top/qwid hxxps://chrowhv[.]click/xowq |
Lumma Stealer |
| URL | hxxp://196[.]251[.]73[.]115/wget[.]sh hxxp://206[.]123[.]145[.]28/poopsl hxxp://206[.]123[.]145[.]28/a64 hxxp://158[.]51[.]126[.]131/t/armv4l hxxp://158[.]51[.]126[.]131/t/armv7l hxxp://206[.]123[.]145[.]28/v7 hxxp://196[.]251[.]73[.]115/c[.]sh hxxp://206[.]123[.]145[.]28/hgr hxxp://158[.]51[.]126[.]131/pox hxxp://158[.]51[.]126[.]131/utt hxxp://103[.]176[.]20[.]59/toto hxxp://158[.]51[.]126[.]131/t/armv5l hxxp://158[.]51[.]126[.]131/t/tscript hxxp://158[.]51[.]126[.]131/t/powerpc hxxp://158[.]51[.]126[.]131/t/csky hxxp://158[.]51[.]126[.]131/k/mips hxxp://158[.]51[.]126[.]131/k/mipsel |
Bashlite |
| URL | hxxps://monclerjackets[.]top/tweet/view_l[.]js hxxps://monclerjackets[.]top/tweet/index[.]php hxxps://rentalvideoconference[.]com/ClipSender[.]zip?fi=14 hxxps://arearugs[.]top/flink/tag[.]js hxxps://arearugs[.]top/flink/index[.]php hxxps://guosong[.]top/flow/taglink[.]js hxxps://guosong[.]top/flow/buffer[.]js hxxps://arearugs[.]top/flink/buffer[.]js hxxps://seputartuban[.]com/1[.]js hxxps://seputartuban[.]com/bute[.]zip |
NetSupportManager RAT |
| URL | hxxp://176[.]46[.]158[.]8/files/7256252040/NPpYzjt[.]exe | Ghost RAT |
| URL | hxxp://176[.]46[.]158[.]8/files/7425234736/40Hv3by[.]exe hxxps://www[.]sodiumlaurethsulfatedesyroyer[.]com/zxhjdbzvhsdbsudbfasuodefasuegbafsdvzsdufvsudZBSUDFBGZSKDBFVZKDFJBGSDKJFVZDFHSDFBGZSHGB/dsjfhsbrabubjbyvjybsrubgsivsrfhsvrgsrhgstrhysrjygvjdhfs/DTHXDFSD[.]exe hxxp://176[.]46[.]158[.]8/files/6394836594/wpPwESV[.]exe |
Quasar RAT |
| URL | hxxps://api[.]telegram[.]org/bot7837000006:AAHyJbgfSTQbnW-DSd4mQn_DuoZt6pYMmEE/sendMessage?chat_id=7026707396 | Snake Keylogger |
| URL | hxxp://176[.]46[.]158[.]8/files/2043702969/OLkGMsG[.]exe hxxp://45[.]150[.]34[.]142/Sqltest/Temp42Game/PipeFlowerCdn/Requestupdate5/gametoVoiddb/php/2db/1db/1bigload/securegeo/videoimage/baseProcessorEternal/videotopythonapiPublic[.]php |
DCRat |
| URL | hxxps://m[.]groiz[.]com/viewDashboard | FAKEUPDATES |
| URL | hxxp://inoveex[.]com/files/Delay_Impact_Statement_07[.]2025[.]pdf[.]lnk hxxp://inoveex[.]com/file/setup7492[.]pdf hxxp://89[.]185[.]80[.]131:8080/files/Delay_Impact_Statement_07[.]2025[.]pdf[.]lnk |
MetaStealer |
| URL | hxxp://94[.]156[.]232[.]85/Documents/customer-receipt[.]lnk | PureLogs Stealer |
| URL | hxxp://8[.]130[.]9[.]18:4444/02[.]08[.]2022[.]exe hxxp://143[.]92[.]39[.]50:8880/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://ron[.]swpriest[.]com/gree/readme[.]txt hxxp://ron[.]swpriest[.]com/gree/NOVA[.]exe |
MASS Logger |
| URL | hxxps://github[.]com/DexXC/XC/raw/refs/heads/main/svchost[.]exe hxxps://github[.]com/DexXC/XC/raw/refs/heads/main/svchost(4)[.]exe |
XWorm |
| URL | hxxps://github[.]com/DexXC/XC/raw/refs/heads/main/New[.]exe | Coinminer |
| URL | hxxps://github[.]com/DexXC/XC/raw/refs/heads/main/RtkAudUService[.]exe | NjRAT |
| URL | hxxp://193[.]5[.]65[.]111/Documents/NDA%20Sign[.]lnk | QakBot |
