不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/12/04
※2025/12/04 更新
マルウェア感染させると考えられるURLを検知（2025/12/04）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://pw0kt[.]de5criptun1ver[.]ru/8oreur2l hxxps://7jb[.]de5criptun1ver[.]ru/68gotv9g hxxps://amber[.]de5criptun1ver[.]ru/es8m01n0 hxxps://qz6tf[.]pi1er5pat[.]ru/0tu64ff8 hxxps://qz6tf[.]pi1er5pat[.]ru/uf641sm8 hxxps://beta[.]pi1er5pat[.]ru/s57iuo5a hxxps://beta[.]pi1er5pat[.]ru/pbg6l9lw hxxps://in7o[.]pi1er5pat[.]ru/uajjcvw2 hxxps://in7o[.]pi1er5pat[.]ru/t5bsgn4l hxxps://cil3[.]lifet1met0rt[.]ru/h3njqth3 hxxps://bright[.]p7ecunder8[.]ru/84w6bin0 hxxps://bright[.]p7ecunder8[.]ru/8f5hu2i5 hxxps://pixel[.]p7ecunder8[.]ru/ihbje8oy hxxps://pixel[.]p7ecunder8[.]ru/mu1d5p1v hxxps://3x7[.]p7ecunder8[.]ru/eyx5ln05 hxxps://a64[.]f1auntre6[.]ru/ywninvi0 hxxps://a64[.]f1auntre6[.]ru/tmujlnk1 hxxps://cpy[.]f1auntre6[.]ru/p640bmgk hxxps://cpy[.]f1auntre6[.]ru/db095fcq hxxps://9dv8[.]f1auntre6[.]ru/3y81ecw9 hxxps://pql[.]pu5herw0man[.]ru/5xyms8d0 hxxps://gp[.]pu5herw0man[.]ru/i0j1zh7h hxxps://gp[.]pu5herw0man[.]ru/tesoia77 hxxps://uno[.]dicti0nvica1[.]ru/q7nc25ht hxxps://2i[.]dicti0nvica1[.]ru/hmmofuix hxxps://2i[.]dicti0nvica1[.]ru/8gdtd40c hxxps://fuxb[.]dicti0nvica1[.]ru/dc3jqdgv hxxps://7anki[.]p7ecunder8[.]ru/4u6nr5mq hxxps://shadow[.]adv0cal1egat[.]ru/21x3zapf hxxps://shadow[.]adv0cal1egat[.]ru/fnjlpxoi hxxps://qkp[.]adv0cal1egat[.]ru/y02dijo7 hxxps://qyjs[.]c2rndiv1ne[.]ru/0fdpnn1a hxxps://6far5[.]c2rndiv1ne[.]ru/fjoeiwfx hxxps://coast[.]c2rndiv1ne[.]ru/qknaymkg hxxps://gd5do[.]b2rvshap0v[.]ru/h265svgl hxxps://4ycip[.]b2rvshap0v[.]ru/tfpr12jb hxxps://secure[.]b2rvshap0v[.]ru/ohbkprpc hxxps://check[.]a1banfact0ry[.]net/Danielle hxxps://3gaz[.]ap2rthyub2n[.]ru/ytmz1afu hxxps://6cyd[.]ap2rthyub2n[.]ru/zve1a8ji hxxps://guard[.]ap2rthyub2n[.]ru/ufqe48ae hxxps://guard[.]ap2rthyub2n[.]ru/zjmhjvic hxxps://4j[.]sl0bozh5treak[.]ru/zapp6nfv hxxps://ctfi[.]sl0bozh5treak[.]ru/wlgsq5h5 hxxps://flame[.]adv0cal1egat[.]ru/6phrxkje hxxps://flame[.]adv0cal1egat[.]ru/9a7qs5s3 hxxps://596y[.]bul1upd2ted[.]ru/qrt6938y hxxps://qppe[.]bul1upd2ted[.]ru/kqx2wwkj hxxps://ewp3[.]bul1upd2ted[.]ru/8aff2y8r hxxps://clear[.]kira5l2nd[.]ru/d25xresy hxxps://clear[.]kira5l2nd[.]ru/lmlcmmlc hxxps://bold[.]kira5l2nd[.]ru/v40hkxrh hxxps://bold[.]kira5l2nd[.]ru/qve1oyz7 hxxps://mnt[.]kira5l2nd[.]ru/3jkcoi17 hxxps://h2t[.]kira5l2nd[.]ru/cmq3l5io hxxps://xe[.]ap2rthyub2n[.]ru/kmlqj36z hxxps://xe[.]ap2rthyub2n[.]ru/hfb14zse hxxps://ur[.]b1eedu4yuk[.]ru/9a5p9k77 hxxps://p2[.]b1eedu4yuk[.]ru/8ochmyo3 hxxps://i4qt[.]b1eedu4yuk[.]ru/o5ekse1m hxxps://i2t0[.]b1eedu4yuk[.]ru/z4db26n7 hxxps://i2t0[.]b1eedu4yuk[.]ru/wj7ehx28 hxxps://66nx[.]bep0ver7y[.]ru/niwqthia hxxps://m3edx[.]bep0ver7y[.]ru/bvs1rgue hxxps://xi[.]bep0ver7y[.]ru/c1tk9h3e hxxps://ao2[.]bul1upd2ted[.]ru/bdg2a9ik hxxps://ao2[.]bul1upd2ted[.]ru/xjo87lzp hxxps://kbrx[.]lu8eti5chkom[.]ru/q5e8zug4 hxxps://kbrx[.]lu8eti5chkom[.]ru/e4oz7s14 hxxps://wf[.]lu8eti5chkom[.]ru/yv2huiia hxxps://aq[.]c1ubmel0dic[.]ru/yk5c6cxs hxxps://aq[.]c1ubmel0dic[.]ru/l6i902w2 hxxps://4p2h[.]c1ubmel0dic[.]ru/ba2flnhv hxxps://47[.]c1ubmel0dic[.]ru/76qsbriw hxxps://631cf[.]ant1d5ulphur[.]ru/wmwpytls hxxps://llosj[.]ant1d5ulphur[.]ru/9sjh6a5j hxxps://1y6v[.]ant1d5ulphur[.]ru/t01yp9lf hxxps://vzfk0[.]ant1d5ulphur[.]ru/zt8vbtym hxxps://e1[.]0prichpe7ch[.]ru/wzvq894m hxxps://delta[.]lo0kferti1[.]ru/i7q3tf06 hxxps://delta[.]lo0kferti1[.]ru/qhvrlj4t hxxps://4dh11[.]lo0kferti1[.]ru/fqdfui05 hxxps://4dh11[.]lo0kferti1[.]ru/7gwo92e0 hxxps://0yna[.]lo0kferti1[.]ru/z614zn58 hxxps://86[.]lo0kferti1[.]ru/doax2br5 hxxps://tw926[.]lu8eti5chkom[.]ru/xyu9rids hxxps://sa[.]lu8eti5chkom[.]ru/f6yv9539 hxxps://e9[.]f1y5agacious[.]ru/wueohtqo hxxps://soft[.]f1y5agacious[.]ru/iy9ig3hd hxxps://bgh8[.]1ndu5trinsh[.]ru/e6w2dq9h hxxps://gma[.]1ndu5trinsh[.]ru/s93ffdrl hxxps://6nb[.]1ndu5trinsh[.]ru/up3g5fk7 hxxps://n9[.]0prichpe7ch[.]ru/y4mfuk46 hxxps://qqes[.]0prichpe7ch[.]ru/cpnxztt1 hxxps://24[.]0prichpe7ch[.]ru/l5aujpok hxxps://1yoye[.]chimef2ce1e[.]ru/0h88gn8m hxxps://28xt8[.]id1otre5ist[.]ru/aqxe2jkp hxxps://28xt8[.]id1otre5ist[.]ru/tnci025a hxxps://mint[.]id1otre5ist[.]ru/rcfjdsry hxxps://aehz[.]id1otre5ist[.]ru/61vvknz0 hxxps://aehz[.]id1otre5ist[.]ru/7y750zu9 hxxps://j0[.]f1y5agacious[.]ru/mq8cyovo hxxps://4rx0l[.]skyhollow[.]ru/6l8j6n3c hxxps://fox[.]skyhollow[.]ru/plfl7r51 hxxps://forest[.]skyhollow[.]ru/fa1zythx hxxps://k8yq6[.]ch2pernev0d[.]ru/4ld32nrg hxxps://trace[.]ch2pernev0d[.]ru/z5l8ovou hxxps://trace[.]ch2pernev0d[.]ru/eech8akm hxxps://gate[.]ch2pernev0d[.]ru/k8qpk1nf hxxps://gate[.]ch2pernev0d[.]ru/3bnp5bkn hxxps://r6tb5[.]chimef2ce1e[.]ru/ms64mpq2 hxxps://anr8p[.]windc0ve[.]ru/6u9n5t09 hxxps://td2qd[.]windc0ve[.]ru/d1lxxqzw hxxps://td2qd[.]windc0ve[.]ru/8jqcxke0 hxxps://sz0[.]windc0ve[.]ru/7jhtfz8u hxxps://4f[.]softshadow[.]ru/6zqotx2b hxxps://4f[.]softshadow[.]ru/6yjvxed8 hxxps://k0h[.]softshadow[.]ru/mg12tt4j hxxps://k0h[.]softshadow[.]ru/n031lul0 hxxps://sunrise[.]softshadow[.]ru/jsjz5os4 hxxps://kfhdx[.]f1recliff[.]ru/ffuyfjxh hxxps://field[.]l1ghtforest[.]ru/tn6lz8dz hxxps://valley[.]l1ghtforest[.]ru/daw2licd hxxps://valley[.]l1ghtforest[.]ru/9ka0u4ax hxxps://m22u9[.]l1ghtforest[.]ru/7vns5rsl hxxps://m22u9[.]l1ghtforest[.]ru/jkmmmpe7 hxxps://flame[.]l1ghtforest[.]ru/dcdny228 hxxps://cliff[.]sunr1dge[.]ru/qmyik2jw hxxps://cliff[.]sunr1dge[.]ru/yfuwpyhx hxxps://xgp[.]sunr1dge[.]ru/m6ttaamx hxxps://myst[.]sunr1dge[.]ru/0kso1olp hxxps://myst[.]sunr1dge[.]ru/ptb2pyrd hxxps://f96[.]f1recliff[.]ru/d2y9rluu hxxps://f96[.]f1recliff[.]ru/k7kzbdlq hxxps://crest[.]f1recliff[.]ru/bhqg3myk hxxps://2y5a[.]f1recliff[.]ru/whtnjnm8 hxxps://2y5a[.]f1recliff[.]ru/bxqm646l hxxps://uun3l[.]br1ghtlake[.]ru/offgm8u5 hxxps://3vc[.]c0uperu8nia[.]ru/yan0ra4s hxxps://valley[.]r2dire5our[.]ru/5chyswlb |
ClearFake |
| URL | hxxps://profyfk[.]click/api hxxps://mattykp[.]click/api hxxps://handpaw[.]click/api |
Lumma Stealer |
| URL | hxxp://158[.]94[.]210[.]88//Yboats[.]arm | Bashlite |
| URL | hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/128%E7%86%8A%E7%BE%8E%E8%8C%B9-%E6%97%A0/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/AV[.]lnk hxxp://123[.]161[.]178[.]209:2121/Video[.]scr hxxp://123[.]161[.]178[.]209:2121/Photo[.]scr hxxp://123[.]161[.]178[.]209:2121/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/20231222%E5%BD%B1%E6%8A%80/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20231208_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/128%E7%86%8A%E7%BE%8E%E8%8C%B9-%E6%97%A0/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20231222%E5%BD%B1%E6%8A%80/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E7%85%A7%E6%98%8E%E4%BA%8C%E7%8F%AD/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20231215_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20231215_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/128%E7%86%8A%E7%BE%8E%E8%8C%B9-%E6%97%A0/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E7%85%A7%E6%98%8E%E4%BA%8C%E7%8F%AD/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20231208_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/119%E9%A9%AC%E9%9B%AF%E5%A9%B7-%E6%97%A0/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20231215_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/128%E7%86%8A%E7%BE%8E%E8%8C%B9-%E6%97%A0/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E7%85%A7%E6%98%8E%E4%BA%8C%E7%8F%AD/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20231215_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/20231208_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/20231222%E5%BD%B1%E6%8A%80/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/119%E9%A9%AC%E9%9B%AF%E5%A9%B7-%E6%97%A0/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20231215_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20231208_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/128%E7%86%8A%E7%BE%8E%E8%8C%B9-%E6%97%A0/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/info[.]zip hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/Photo[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/119%E9%A9%AC%E9%9B%AF%E5%A9%B7-%E6%97%A0/AV[.]lnk hxxp://123[.]161[.]178[.]209:2121/Photo[.]lnk hxxp://123[.]161[.]178[.]209:2121/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/128%E7%86%8A%E7%BE%8E%E8%8C%B9-%E6%97%A0/AV[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/128%E7%86%8A%E7%BE%8E%E8%8C%B9-%E6%97%A0/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E7%85%A7%E6%98%8E%E4%BA%8C%E7%8F%AD/AV[.]lnk hxxp://58[.]22[.]95[.]171:6868/20231208_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/Photo[.]scr hxxp://123[.]161[.]178[.]209:2121/AV[.]lnk hxxp://58[.]22[.]95[.]171:6868/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/119%E9%A9%AC%E9%9B%AF%E5%A9%B7-%E6%97%A0/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/119%E9%A9%AC%E9%9B%AF%E5%A9%B7-%E6%97%A0/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/119%E9%A9%AC%E9%9B%AF%E5%A9%B7-%E6%97%A0/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E7%85%A7%E6%98%8E%E4%BA%8C%E7%8F%AD/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/Photo[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/119%E9%A9%AC%E9%9B%AF%E5%A9%B7-%E6%97%A0/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/AV[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD/Video[.]lnk hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/%E7%85%A7%E6%98%8E%E4%BA%8C%E7%8F%AD/Video[.]scr hxxp://58[.]22[.]95[.]171:6868/20231215_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20231222%E5%BD%B1%E6%8A%80/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20231208_%E5%BD%B1%E8%A7%86%E6%8A%80%E6%9C%AF%E7%8F%AD_%E6%91%84%E5%BD%B1%E6%8A%80%E6%9C%AF%E4%BD%9C%E4%B8%9A/AV[.]scr hxxp://58[.]22[.]95[.]171:6868/20240103%E8%8B%B1%E8%AF%AD%E5%90%AC%E8%AF%B4%E6%9C%9F%E6%9C%AB%E5%BD%95%E9%9F%B3/AV[.]scr hxxp://216[.]126[.]239[.]11/alfa[.]exe hxxp://164[.]92[.]129[.]208/temp/LosslessCut[.]exe hxxp://178[.]16[.]55[.]189/files/8026740242/ehCfUjR[.]exe hxxp://178[.]16[.]55[.]189/files/8026740242/hn5OzuX[.]exe hxxp://178[.]16[.]55[.]189/files/8026740242/YixA6qn[.]exe hxxp://178[.]16[.]55[.]189/files/8026740242/2qGgvQJ[.]exe |
Coinminer |
| URL | hxxp://178[.]16[.]55[.]189/files/7570088383/CmHHtOg[.]exe hxxp://178[.]16[.]55[.]189/files/8378395755/R0HKAkY[.]exe hxxp://178[.]16[.]55[.]189/files/380743829/Va4iu4b[.]exe |
Vidar |
| URL | hxxps://hellocs[.]top/static/file/HelloCS2[.]12%EF%BC%88%E8%87%AA%E5%8A%A8%E6%9B%B4%E6%96%B0%E6%9C%89%E5%B9%BF%E5%91%8A%EF%BC%89[.]apk hxxps://hellocs[.]top/static/file/HelloCS2[.]12%E5%AE%89%E5%8D%939%E5%8E%BB%E4%BA%91%E6%89%8B%E6%9C%BA%E9%99%90%E5%88%B6%E7%89%88[.]apk |
STRRAT |
| URL | hxxps://sfmonte[.]com/pol/uuu[.]php hxxps://sfmonte[.]com/bbb/rss[.]js hxxps://orangepinepo[.]com/pol/uuu[.]php hxxps://orangepinepo[.]com/pol/ccc[.]js hxxps://linleac[.]com/bbb/rww[.]php hxxps://linleac[.]com/bbb/rss[.]js hxxps://ibundles[.]org/dWX[.]dof |
NetSupportManager RAT |
| URL | hxxps://injectroblox[.]ru/Krnl[.]Lua[.]Script[.]Injector[.]v1[.]3[.]4[.]zip | SmartLoader |
| URL | hxxp://178[.]16[.]55[.]189/files/1401316133/J8wPIbX[.]exe hxxp://91[.]92[.]240[.]104:7777/apexfurllc[.]top/showmoni/Encrypted_Script[.]ps1 |
Remcos |
| URL | hxxps://api[.]telegram[.]org/bot8337455886:AAH4ZMO_2wbfqRKQbBYv_43pcs2KGtGsiw0/sendMessage?chat_id=6555217018 hxxps://api[.]telegram[.]org/bot8549194728:AAGciHkuUr3cekF5DLs2cmZcR-CbwnBAuq0/sendMessage?chat_id=7536086895 |
Stealerium |
| URL | hxxps://dsourceva[.]com/7h7h[.]js hxxps://dsourceva[.]com/js[.]php hxxp://65[.]38[.]120[.]109/m |
KongTuke |
| URL | hxxp://178[.]16[.]55[.]189/files/8516164774/2j9sAWt[.]exe hxxp://95[.]181[.]173[.]156/ce369e7324834845[.]php hxxp://196[.]251[.]107[.]94:5553/f3d5a80d27c049f2ba17d69b09c13bd5_build[.]exe hxxp://178[.]17[.]59[.]148/4a1b933c03e9461a[.]php |
Stealc |
| URL | hxxps://it-aufklaerung[.]de/wp-admin/network/[.]wp-robots/bb/Lotus%20Lines%20Bill%20Of%20Lading%20-%20CNSZX02081777[.]rar | Agent Tesla |
| URL | hxxp://www[.]mobimpex[.]ro/Fecund[.]lpk hxxp://www[.]mobimpex[.]ro/HRCxPYwfcShe8[.]bin hxxp://161[.]248[.]178[.]249/NUQbDSY6[.]bin |
CloudEyE |
| URL | hxxp://91[.]219[.]23[.]37/6pcC7wQmpNB9icAWs hxxp://62[.]133[.]60[.]113/qjC72noZ5UmrokCA/app_permission[.]md hxxp://62[.]133[.]60[.]113/qjC72noZ5UmrokCA/NvDriverDiagnostics[.]md hxxp://62[.]133[.]60[.]113/qjC72noZ5UmrokCA/crashreporter[.]md |
ACR Stealer |
| URL | hxxp://178[.]16[.]55[.]189/files/454503574/6UxkEvY[.]exe hxxp://178[.]16[.]55[.]189/files/454503574/drGRpRy[.]exe |
DCRat |
| URL | hxxp://47[.]100[.]183[.]39:8080/02[.]08[.]2022[.]exe hxxp://38[.]165[.]33[.]58:8443/02[.]08[.]2022[.]exe hxxp://38[.]190[.]198[.]35/02[.]08[.]2022[.]exe hxxp://156[.]225[.]19[.]17:4396/02[.]08[.]2022[.]exe hxxp://3[.]37[.]87[.]106:8888/02[.]08[.]2022[.]exe hxxp://120[.]48[.]43[.]140:8080/02[.]08[.]2022[.]exe hxxp://8[.]155[.]161[.]181:8113/02[.]08[.]2022[.]exe hxxp://125[.]40[.]44[.]177:54002/02[.]08[.]2022[.]exe hxxp://163[.]47[.]9[.]13:1337/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxps://api[.]telegram[.]org/bot8562741434:AAF0OG4rSXiRk5QCCpJ_8Ut4xwM5-26RKe4/sendMessage?chat_id=6132426229 | Snake Keylogger |
| URL | hxxp://62[.]60[.]226[.]159/xx[.]exe | Amadey |
