不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/01/27
※2023/01/27 更新
マルウェア感染させると考えられるURLを検知（2023/01/27）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://146[.]70[.]145[.]168/33/vbc[.]exe hxxp://198[.]46[.]174[.]165/231/vbc[.]exe |
Agent Tesla |
| URL | hxxp://77[.]73[.]133[.]72/8bmdh3Slb2/Plugins/cred[.]dll hxxp://cienciano[.]com/race[.]exe |
Amadey |
| URL | hxxp://193[.]42[.]33[.]14/a-r[.]m-4[.]ISIS hxxp://193[.]42[.]33[.]14/a-r[.]m-5[.]ISIS hxxp://193[.]42[.]33[.]14/a-r[.]m-6[.]ISIS hxxp://193[.]42[.]33[.]14/a-r[.]m-7[.]ISIS hxxp://193[.]42[.]33[.]14/i-5[.]8-6[.]ISIS hxxp://193[.]42[.]33[.]14/m-i[.]p-s[.]ISIS hxxp://193[.]42[.]33[.]14/m-p[.]s-l[.]ISIS hxxp://193[.]42[.]33[.]14/p-p[.]c-[.]ISIS hxxp://193[.]42[.]33[.]14/s-h[.]4-[.]ISIS hxxp://193[.]42[.]33[.]14/x-3[.]2-[.]ISIS hxxp://193[.]42[.]33[.]14/x-8[.]6-[.]ISIS |
Bashlite |
| URL | hxxp://154[.]204[.]43[.]31/ga[.]js hxxp://162[.]19[.]155[.]49/pixel hxxp://192[.]52[.]167[.]24:8443/en_US/all[.]js hxxp://195[.]189[.]96[.]249/dpixel hxxp://20[.]225[.]139[.]12/load hxxp://20[.]67[.]44[.]243/__utm[.]gif hxxp://3[.]29[.]24[.]212:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://3[.]29[.]24[.]212:8081/jquery-3[.]3[.]1[.]min[.]js hxxp://3[.]92[.]113[.]197:8082/maps/overlaybfpr hxxp://3[.]92[.]113[.]197:8084/maps/overlaybfpr hxxp://31[.]44[.]184[.]232/load hxxp://43[.]139[.]146[.]60:2222/g[.]pixel hxxp://5[.]8[.]18[.]112/cm hxxp://51[.]254[.]53[.]1/design/query/9X5M3SOE0F hxxp://51[.]83[.]249[.]117/Calculate/examples/EAR93XJHI8 hxxp://88[.]214[.]27[.]53:50010/activity hxxp://91[.]240[.]118[.]209:1025/ptj hxxps://1[.]15[.]141[.]252/dpixel hxxps://103[.]139[.]2[.]185:8000/match hxxps://108[.]62[.]118[.]114/make/v3[.]54/UF59OFOW3OXS hxxps://139[.]162[.]199[.]96/dot[.]gif hxxps://154[.]204[.]43[.]31/visit[.]js hxxps://154[.]26[.]192[.]35/push hxxps://162[.]19[.]155[.]49/__utm[.]gif hxxps://195[.]189[.]96[.]249/pixel[.]gif hxxps://23[.]227[.]193[.]33/load hxxps://82[.]157[.]182[.]245:8088/cx hxxps://mcfupdateonline[.]cloud/fwlink hxxps://pesobuw[.]com/make/v3[.]54/UF59OFOW3OXS |
Cobalt Strike |
| URL | hxxp://194[.]87[.]199[.]77/LongpollProcessor/ExternalTo3/4requestLinux/wordpress/asyncUniversalProviderVideo/6/4/private/Cpu9/JavascriptwindowsLinux/WindowsUploads/wordpress/External/Python/voiddb9central/Temp/0PhpEternal/local2/GameDump/ProviderUpdatewordpress[.]php | DCRat |
| URL | hxxps://2c06a[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://53fdb[.]signing[.]unitynotarypublic[.]com/subscribeEvent hxxps://c2717[.]fate[.]truelance[.]com/subscribeEvent hxxps://f2d19[.]signing[.]unitynotarypublic[.]com/subscribeEvent |
FAKEUPDATES |
| URL | hxxp://103[.]167[.]85[.]122/googlesave/vbc[.]exe hxxp://103[.]167[.]85[.]122/spaceX/vbc[.]exe hxxp://104[.]168[.]46[.]125/fresh/qwsdffhfhcvxcdgdfhfgjfjfgdfdfgxcvcxv[.]doc |
Formbook |
| URL | hxxp://auto[.]stevenpartners[.]com:23015/give-me-chpv hxxp://auto[.]stevenpartners[.]com:23015/give-me-ffpv hxxp://auto[.]stevenpartners[.]com:23015/ie hxxp://auto[.]stevenpartners[.]com:23015/maili hxxp://auto[.]stevenpartners[.]com:23015/moz-sdk |
Houdini |
| URL | hxxp://predictindia[.]co/loki/Panel/five/fre[.]php hxxp://efvsx[.]cf/PWS/fre[.]php hxxps://efvsx[.]ga/PWS/fre[.]php hxxp://103[.]171[.]1[.]139/googlesave/csrss[.]exe hxxp://192[.]210[.]160[.]133/000000000_OOOOOOO_ooooooo_ooOOOOOOO_OOOOO/OOOOOOOO_OOOOOOO_OOO[.]doc hxxp://192[.]210[.]160[.]133/224/vbc[.]exe hxxp://194[.]180[.]49[.]166/googlesave/[.]win32[.]exe hxxp://efvsx[.]ga/PWS/fre[.]php |
LokiBot |
| URL | hxxp://1[.]246[.]223[.]54:4952/Mozi[.]m | Mozi |
| URL | hxxp://172[.]174[.]176[.]153/dll/Dll[.]ppam | NjRAT |
| URL | hxxp://77[.]73[.]134[.]27/race[.]exe hxxps://k9designstudio[.]com/boom[.]exe |
PrivateLoader |
| URL | hxxps://www[.]js-hurling[.]com/webcpconents/generateddxgf[.]exe | Quasar RAT |
| URL | hxxp://62[.]204[.]41[.]119/well/desto[.]exe hxxp://62[.]204[.]41[.]119/well/fermo[.]exe |
RedLine Stealer |
| URL | hxxps://unionbindinqcompany[.]it/vbs[.]exe | Remcos |
| URL | hxxps://yokobin[.]online:59357/pAHwRMsgZUThNquW/TubMIqygORePptAH[.]html#PKswGvaVipN0et2loOYDqI3Tk4MzS7jLE8hHU6CfgB9dA1nRWZXrmQuFxy5Jbc+/= hxxp://157[.]90[.]148[.]112/408 hxxp://157[.]90[.]148[.]112/562 hxxp://65[.]109[.]208[.]142/682 hxxp://65[.]21[.]58[.]6/794 hxxp://95[.]217[.]16[.]127/439 hxxp://95[.]217[.]16[.]127/580 hxxp://95[.]217[.]16[.]127/607 hxxp://95[.]217[.]16[.]127/670 hxxp://95[.]217[.]16[.]127/698 hxxp://95[.]217[.]16[.]127/701 hxxp://95[.]217[.]16[.]127/827 hxxp://95[.]217[.]16[.]127/839 |
Vidar |
