不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2026/10/06
※2026/10/06 更新
マルウェア感染させると考えられるURLを検知（2026/10/06）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://122[.]170[.]8[.]40/Video[.]scr hxxp://121[.]184[.]128[.]134/01/info[.]zip |
Coinminer |
| URL | hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/crackexe[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/wanna[.]exe hxxp://fujeigroup[.]com:8888/web/img_010950[.]png hxxp://fujeigroup[.]com:8888/web/img_194859[.]png hxxp://wp[.]fujeigroup[.]com:8888/file/img_132450[.]png hxxps://github[.]com/HunterTeamC2/huynhtoanupload/raw/refs/heads/main/sirusrat[.]exe hxxps://github[.]com/server123-lab/Analyis-File-Malware-ThreardFox/raw/refs/heads/main/download2[.]exe hxxps://github[.]com/HunterTeamC2/huynhtoanupload/raw/refs/heads/main/mko1[.]exe |
AsyncRAT |
| URL | hxxp://46[.]19[.]140[.]40:8443/loader[.]exe hxxp://46[.]19[.]140[.]40:8443/SecurityHealthSys[.]exe |
Sliver |
| URL | hxxp://42[.]235[.]54[.]206:52623/Mozi[.]m hxxp://202[.]47[.]56[.]17:47866/Mozi[.]m hxxp://120[.]28[.]215[.]116:57223/Mozi[.]m hxxp://43[.]230[.]94[.]183:56898/Mozi[.]m hxxp://160[.]30[.]142[.]217:35935/Mozi[.]m hxxp://202[.]47[.]51[.]242:33649/Mozi[.]m hxxp://175[.]107[.]228[.]239:58192/Mozi[.]m hxxp://202[.]70[.]139[.]186:32913/Mozi[.]m hxxp://100[.]165[.]14[.]123:55983/Mozi[.]m hxxp://103[.]66[.]149[.]154:47461/Mozi[.]m hxxp://42[.]224[.]146[.]34:55637/Mozi[.]m |
Mozi |
| URL | hxxp://176[.]65[.]139[.]139/mips | Mirai |
| URL | hxxp://96[.]62[.]71[.]5:8091/bots/mb[.]arm64 | LiquorBot |
| URL | hxxp://96[.]62[.]71[.]5:8091/bots/dldr[.]aarch64 hxxp://96[.]62[.]71[.]5:8091/bots/dldr[.]386 hxxp://176[.]65[.]139[.]139/bins/xnxnxnxnxnxnxnxnarmv6lxnxn hxxp://176[.]65[.]139[.]139/bins/xnxnxnxnxnxnxnxni686xnxn hxxp://176[.]65[.]139[.]139/bins/xnxnxnxnxnxnxnxni586xnxn |
Bashlite |
| URL | hxxps://www[.]tmcksa[.]com/new1/secured_stub[.]ps1 hxxps://www[.]tmcksa[.]com/new/secured_stub[.]ps1 hxxps://new-orleans[.]pl/wp-includes/Text/bhxlvkt/erlodfc/stykqbz/puresecured_stub[.]ps1 hxxps://www[.]beinke-aufzuege[.]de/components/com_media/fkqabmp/ntxqre1/edfwcgi/pwsecured_stub[.]ps1 hxxps://summitcapitalpatners[.]info/img_040049[.]png hxxps://www[.]beinke-aufzuege[.]de/components/com_media/fkqabmp/ntxqre1/edfwcgi/mlsecured_stub[.]ps1 hxxps://www[.]tmcksa[.]com/news/secured_stub[.]ps1 |
Formbook |
| URL | hxxp://primeemberq[.]cfd/Subtrahuyr[.]pcx hxxp://primeemberq[.]cfd/afbryderen[.]pcz hxxps://gloryhaven[.]org/bvbhfhdfb/ozTdkGeYgnmG211[.]bin hxxps://greatwhite[.]me/tsl/Driftsregnskabets[.]lzh hxxps://greatwhite[.]me/tsl/ChaWrHpZGxZKotQO101[.]bin hxxp://185[.]29[.]10[.]68/oHoxjRlk180[.]bin hxxp://185[.]29[.]9[.]42/sinkedes[.]mdp hxxp://185[.]29[.]10[.]68/HXzLYcjRlH96[.]bin hxxp://185[.]29[.]9[.]42/Marsupialised[.]java hxxp://185[.]29[.]10[.]68/xdZGCANqNpylcDzT208[.]bin |
CloudEyE |
| URL | hxxp://172[.]245[.]155[.]97/33/GFG[.]hta hxxps://gloryhaven[.]org/bvbhfhdfb/obduktioners[.]lzh hxxps://razao[.]pt/GMV42B4J |
Remcos |
| URL | hxxps://fullhouse[.]ae/js/TRUE[.]zip hxxp://185[.]29[.]9[.]42/Retslokalet[.]lpk hxxp://23[.]132[.]164[.]15/FAST/stein[.]ps1 |
Agent Tesla |
| URL | hxxps://flocmaterials[.]shop/mrceofrnnd/secured_stub[.]ps1 hxxps://flocmaterials[.]shop/ceofrnd1/secured_stub[.]ps1 hxxps://flocmaterials[.]shop/myceo30/secured_stub[.]ps1 hxxps://flocmaterials[.]shop/ceofrnd29/secured_stub[.]ps1 hxxps://flocmaterials[.]shop/nzeceo/secured_stub[.]ps1 |
Snake Keylogger |
| URL | hxxp://94[.]154[.]32[.]130/b7823990/secured_stub[.]ps1 | MASS Logger |
| URL | hxxps://uu[.]v2raynapps[.]com[.]cn/UU_aNCcWz7[.]zip | ValleyRAT |
| URL | hxxps://cdn[.]quickdelivr[.]com/mpackage[.]js | IClickFix |
| URL | hxxp://arqtsop[.]shop:9932/users hxxp://teculse[.]click:9210/tags |
Remus |
| URL | hxxps://0345ff3a-89ea-4b42-48a38a3b396d[.]foxdale[.]cc/install[.]ps1 hxxps://94ddb3c2-52d7-43cb-a5f6-666966a1c7cf[.]foxdale[.]cc/cinstall[.]ps1 hxxps://brambly[.]world/cinstall[.]ps1 |
ClearFake |
| URL | hxxp://91[.]92[.]34[.]63:8888/quickb[.]msi | NetSupportManager RAT |
| URL | hxxps://64[.]89[.]161[.]65/sostener[.]vbs hxxps://64[.]89[.]161[.]65/svchost[.]vbs hxxp://64[.]89[.]161[.]65/sostener1[.]vbs hxxp://64[.]89[.]161[.]65/svchost[.]vbs hxxp://64[.]89[.]161[.]65/proceso[.]vbs |
XWorm |
| URL | hxxps://ohhhhhmoney[.]com/fF2 | HijackLoader |
