不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/04/13
※2023/04/13 更新
マルウェア感染させると考えられるURLを検知（2023/04/13）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://indolian[.]com/svcrun[.]exe | XMRig |
| URL | hxxp://193[.]233[.]20[.]29/sada/lada[.]exe hxxp://65[.]21[.]3[.]192/msiexp[.]exe |
RedLine Stealer |
| URL | hxxp://193[.]201[.]9[.]43/DSC01491/fotocr17[.]exe hxxp://193[.]201[.]9[.]43/DSC01491/foto0154[.]exe hxxp://80[.]66[.]79[.]86/file/lega[.]exe hxxp://antispam-screen[.]com/fjgD555c3/Login[.]php hxxp://soul-kissed[.]org/fjgD555c3/Login[.]php hxxp://88[.]218[.]60[.]230/Gb2dZz/Login[.]php hxxp://31[.]41[.]244[.]146/f5OknW/Login[.]php hxxp://77[.]91[.]124[.]207/plays/chapter/Login[.]php hxxp://193[.]233[.]20[.]29/games/category/Login[.]php hxxp://specialblue[.]pm/dF30Hn4m/Login[.]php hxxp://77[.]73[.]134[.]27/n9kdjc3xSf/Login[.]php hxxp://185[.]215[.]113[.]204/Lkb2dxj3/Login[.]php hxxp://77[.]91[.]124[.]242/games/category/Login[.]php hxxp://rupeika[.]info/fjgD555c3/Login[.]php hxxp://77[.]91[.]78[.]118/0jVu73d/Login[.]php hxxp://78[.]46[.]242[.]112/so57Nst/Login[.]php hxxp://212[.]118[.]43[.]106/dF30Hn4m/Login[.]php hxxp://77[.]91[.]78[.]118/u83mfdS2/Login[.]php hxxp://msupgrade[.]top/0bjdn2Z/Login[.]php hxxp://193[.]233[.]20[.]36/joomla/Login[.]php hxxp://94[.]142[.]138[.]182/0jVu73d/Login[.]php hxxp://5[.]75[.]139[.]35/so57Nst/Login[.]php hxxp://185[.]215[.]113[.]204/g9TTnd3bS/Login[.]php hxxp://193[.]201[.]9[.]43/plays/chapter/Login[.]php hxxp://77[.]91[.]78[.]17/0jVu73d/Login[.]php hxxp://80[.]66[.]79[.]86/joomla/Login[.]php hxxp://focustopbreed78d[.]com/ve83dkas2m/Login[.]php |
Amadey |
| URL | hxxp://5[.]42[.]199[.]235/dll/dll10[.]txt | Quasar RAT |
| URL | hxxp://119[.]18[.]194[.]146/x/tty1 hxxp://119[.]18[.]194[.]146/x/tty6 hxxp://119[.]18[.]194[.]146/x/tty2 hxxp://119[.]18[.]194[.]146/x/tty5 hxxp://119[.]18[.]194[.]146/x/tty4 hxxp://119[.]18[.]194[.]146/x/tty3 hxxp://119[.]18[.]194[.]146/x/tty0 hxxp://119[.]18[.]194[.]146/x/pty |
Tsunami |
| URL | hxxp://43[.]139[.]212[.]236/zj[.]exe | Nitol |
| URL | hxxp://23[.]254[.]227[.]202/api/firegate[.]php hxxp://23[.]254[.]227[.]214/api/firegate[.]php hxxp://23[.]254[.]227[.]205/api/firegate[.]php |
PrivateLoader |
| URL | hxxp://208[.]67[.]105[.]179/ohoyec[.]exe hxxp://193[.]42[.]33[.]80/77[.]bmp hxxp://193[.]42[.]33[.]80/80[.]bmp |
Agent Tesla |
| URL | hxxp://171[.]22[.]30[.]164/smith/index[.]php | Azorult |
| URL | hxxp://ubydhm32[.]top/gate[.]php | CryptBot |
| URL | hxxp://185[.]246[.]220[.]60/project/five/fre[.]php | LokiBot |
| URL | hxxp://23[.]94[.]202[.]169/ga[.]js hxxp://103[.]30[.]17[.]40/activity hxxp://47[.]99[.]177[.]59:3389/ga[.]js hxxps://43[.]138[.]36[.]102:9898/pixel[.]gif hxxps://101[.]43[.]127[.]45/j[.]ad hxxp://121[.]4[.]37[.]10/__utm[.]gif hxxp://107[.]148[.]149[.]19/pixel[.]gif hxxps://114[.]132[.]197[.]186:4434/vue-2[.]2[.]1[.]min[.]js hxxp://syncupserver[.]com/boxes[.]js hxxps://1[.]117[.]59[.]12:8081/dot[.]gif hxxps://syncupserver[.]com/rw hxxp://www[.]test9977[.]tk:2096/dot[.]gif hxxp://www[.]test9977[.]tk:2095/fwlink hxxp://eserverlink[.]com/RELEASE_NOTES[.]css hxxps://eserverlink[.]com/ro hxxps://lls-rs[.]org/_/scs/mail-static/_/js/ hxxp://lls-rs[.]org/_/scs/mail-static/_/js/ hxxp://45[.]88[.]66[.]128:8089/__utm[.]gif hxxps://42[.]192[.]21[.]181/fabricate/v2[.]67/RXYN7XP4 hxxps://23[.]94[.]202[.]169/j[.]ad hxxps://134[.]122[.]170[.]68/pixel[.]gif hxxp://134[.]122[.]170[.]68:8080/j[.]ad hxxps://124[.]223[.]6[.]231:4432/__utm[.]gif hxxp://121[.]4[.]111[.]221:1111/cm hxxp://82[.]157[.]182[.]245:8088/load hxxp://47[.]99[.]177[.]59:5555/ptj hxxps://175[.]178[.]73[.]141:6180/push hxxp://82[.]157[.]43[.]174/activity hxxp://156[.]38[.]227[.]99/c/msdownload/update/others/2016/12/29136388_ hxxp://47[.]87[.]158[.]145:8080/aa[.]html hxxp://112[.]124[.]64[.]221/ptj hxxp://aerosunelectric[.]com/mt hxxp://101[.]43[.]127[.]45:8080/ga[.]js hxxp://185[.]43[.]108[.]112/ca hxxps://upd232[.]windowservicecentar[.]com/css/jquery[.]min[.]js hxxp://8[.]8[.]8[.]8/8adc166[.]js hxxp://101[.]42[.]6[.]64:1111/en_US/all[.]js hxxp://101[.]35[.]253[.]83:18081/jquery-3[.]3[.]1[.]min[.]js hxxps://154[.]88[.]26[.]221:4443/jquery-3[.]3[.]1[.]min[.]js hxxps://185[.]43[.]108[.]112/load hxxp://13[.]48[.]85[.]144/include/template/joeb[.]php hxxps://82[.]157[.]173[.]159:7777/match hxxp://rewelab[.]de/dashboard hxxp://43[.]143[.]48[.]76:9999/cm hxxp://120[.]46[.]158[.]41:8088/ajax/recharge/recharge[.]json hxxp://120[.]46[.]158[.]41:8088/mall_100_100[.]html hxxps://43[.]142[.]165[.]143:7890/service/api/json hxxps://43[.]142[.]165[.]143:7890/clemente/details hxxps://internetmediatech[.]net/ba hxxp://45[.]207[.]49[.]206:2090/cm hxxps://45[.]207[.]49[.]206:2080/ga[.]js hxxps://103[.]139[.]2[.]185:8000/push hxxp://38[.]59[.]230[.]101:10333/updates[.]rss hxxp://31[.]25[.]88[.]171:10333/pixel[.]gif hxxp://185[.]212[.]60[.]42:10333/__utm[.]gif hxxp://31[.]25[.]88[.]156:10333/activity hxxps://139[.]196[.]236[.]84:5443/push hxxp://arpaviews[.]com/_/scs/mail-static/_/js/ hxxp://124[.]220[.]183[.]186:89/dpixel hxxp://104[.]194[.]78[.]130:999/fwlink hxxp://114[.]115[.]137[.]126/cx hxxp://lxnft[.]org/maps/overlaybfpr hxxp://47[.]106[.]190[.]207:4567/pixel[.]gif hxxp://143[.]92[.]58[.]97/MicrosoftUpdate/ShellEx/KB242742/default[.]aspx hxxp://154[.]31[.]36[.]65/pixel hxxp://5[.]181[.]159[.]33:8080/match hxxp://47[.]92[.]67[.]152:8089/mall_100_100[.]html hxxps://115[.]29[.]171[.]175/push hxxps://1[.]14[.]64[.]150/fwlink hxxp://1[.]15[.]65[.]203:51119/activity hxxp://121[.]5[.]165[.]122:8089/j[.]ad hxxp://172[.]247[.]9[.]226:8443/data/handle/doc hxxps://121[.]5[.]165[.]122/match hxxp://1[.]13[.]255[.]117:61111/__utm[.]gif hxxp://91[.]215[.]85[.]183:8000/_/scs/mail-static/_/js/ hxxp://47[.]98[.]157[.]247/dpixel hxxps://51[.]161[.]120[.]85/fwlink hxxp://www[.]shazambatman[.]xyz:8880/jquery-3[.]3[.]1[.]min[.]js hxxps://5[.]181[.]159[.]33/activity hxxp://120[.]48[.]51[.]84:82/j[.]ad hxxps://kenipaxi[.]us/btn_bg[.]css hxxps://107[.]174[.]95[.]204:55413/j[.]ad hxxps://150[.]158[.]51[.]99:8888/ca hxxps://34[.]100[.]182[.]140/__utm[.]gif hxxp://34[.]208[.]230[.]83:8888/www/handle/doc hxxp://198[.]44[.]237[.]131:7777/IE9CompatViewList[.]xml hxxps://101[.]35[.]21[.]69:4433/api/get hxxps://47[.]92[.]95[.]66:4433/audiencemanager[.]js |
Cobalt Strike |
| URL | hxxps://alostool-sa[.]com/XsXYod/ hxxps://netultra[.]com[.]br/bSqAMi/ hxxps://rzbpo[.]com[.]br/0MqaE/ hxxps://bytedesign[.]net/vPqyWxb/ hxxps://stragician[.]com/uq63l/ hxxps://mmhhf[.]com/cyoaLCj/ hxxps://graphixcreativity[.]com/MoJBQ/ hxxps://soaresdesigner[.]com[.]br/QkSwp8/ hxxp://vcatransformadores[.]com[.]br/blo/me[.]zip hxxp://vedantawisdom[.]org/blo/me[.]zip hxxps://datekmexico[.]com/blo/me[.]zip hxxp://promel[.]pe/blo/me[.]zip hxxp://satrans[.]com[.]au/blo/me[.]zip hxxp://intansejahteraberkahindo[.]com/blo/me[.]zip hxxp://graviana[.]com/blo/me[.]zip hxxp://moiziqbal[.]com/blo/me[.]zip hxxp://pallasidiomas[.]com[.]br/blo/me[.]zip hxxp://actionhakoora[.]com/blo/me[.]zip hxxp://lewisraby[.]co[.]uk/blo/me[.]zip hxxp://barkaatart[.]com/blo/me[.]zip hxxp://datekmexico[.]com/blo/me[.]zip hxxp://87[.]236[.]146[.]93/vodka[.]dat hxxp://70[.]34[.]218[.]85/vodka[.]dat hxxp://79[.]141[.]174[.]253/vodka[.]dat hxxp://154[.]47[.]17[.]180/vodka[.]dat hxxp://74[.]119[.]193[.]49/vodka[.]dat hxxps://vaytienonlinenhanh[.]net/com/idqui[.]php hxxps://uea8link[.]com/ei/molestiassimilique[.]php hxxps://xaankoo[.]com/au/idquam[.]php hxxps://trustfidel[.]com/ist/earumratione[.]php hxxps://yeslifepharma[.]com/iiq/molestiaedolorem[.]php hxxps://wcopasingapore[.]com/eovs/corruptivoluptatem[.]php hxxps://worldtimer[.]com[.]hk/uq/aliquidoccaecati[.]php hxxps://universalfishfarm[.]com/tqo/eumquaerat[.]php hxxps://territoriomulher[.]com[.]br/tr/ipsumesse[.]php hxxps://voiprouteprovider[.]com/ur/suntoptio[.]php hxxps://wiserlance[.]com/ms/rerumvitae[.]php hxxps://writingfactor[.]com/iuts/placeatneque[.]php hxxps://tidewaterautobuyers[.]com/somt/verofuga[.]php hxxps://vpswala[.]com/qle/ullamaut[.]php hxxps://z2arecords[.]com/uv/facilisperferendis[.]php hxxps://taxpayer[.]com[.]pk/ui/quaeinventore[.]php hxxps://yuvaa[.]net/te/reprehenderitnostrum[.]php hxxps://toptenabout[.]com/acpb/estnatus[.]php hxxps://thewitchfromeasterneurope[.]com/id/dolornisi[.]php hxxps://viaholidaysindia[.]com/eu/recusandaecorrupti[.]php hxxps://veraschat[.]com/titt/corporisoptio[.]php hxxps://thefitketo[.]com/aiu/possimusest[.]php hxxps://vbapavingindiana[.]com/ela/liberoet[.]php hxxps://trickgacormiya[.]com/tces/utperspiciatis[.]php hxxps://todayjournal[.]net/lto/etaliquid[.]php hxxps://wolanideliveryservices[.]co[.]uk/ueem/ipsamporro[.]php hxxps://ueics[.]com/to/nostrumnostrum[.]php hxxps://mktstore247[.]com/te/modiin[.]php hxxps://osushimore[.]com/idoe/dictaodio[.]php hxxps://sakibbinnesar[.]com/dua/sequieos[.]php hxxps://naiborafrica[.]com/ce/numquammaiores[.]php hxxps://paysemgold[.]com[.]ng/iqn/laborumipsa[.]php hxxps://shishyasociety[.]org/sett/porrolaboriosam[.]php hxxps://scholarngbayanngaurora[.]com/ra/esttotam[.]php hxxps://reveltonhotels[.]com/amt/quivoluptates[.]php hxxps://penawarcovid19screening[.]com/cmqu/possimusut[.]php hxxps://mycentraltrust[.]com/texe/quasisunt[.]php hxxps://smbksa[.]org/uq/quiaeos[.]php hxxps://shreevarmaerp[.]com/inc/etunde[.]php hxxps://mmrentalservice[.]com[.]ar/uea/utconsequatur[.]php hxxps://msremix[.]com/sb/sintet[.]php hxxps://psyinterdisc[.]com/eo/consequaturqui[.]php hxxps://mannymart[.]com/easl/doloribusaliquid[.]php hxxps://rglobaldevelopers[.]com/ahte/harumvelit[.]php hxxps://shopodoe[.]com/ai/nihilsunt[.]php hxxps://miltonkeynesmontessori[.]com/nin/minusenim[.]php hxxps://outsourceforsure[.]com/tied/eanihil[.]php hxxps://planbici[.]com[.]co/tv/etfacere[.]php hxxps://richkings[.]com[.]ng/nmn/voluptateaccusamus[.]php hxxps://muwht[.]com/mans/autbeatae[.]php hxxps://royaltiles[.]com[.]au/usip/etamet[.]php hxxps://naeemsowdagor[.]com/uaco/officiasaepe[.]php hxxps://primeglobaltravels[.]org/edie/totaminventore[.]php hxxps://rttrimming[.]com/cis/eligenditemporibus[.]php hxxps://qadaluxury[.]com/te/quomolestias[.]php hxxps://radiofatima[.]org/ie/autut[.]php hxxps://neco[.]com[.]pk/iuu/ipsumin[.]php hxxps://schoolofpropheticimpartation[.]com/eae/dolorumdeleniti[.]php hxxps://onlinememorials[.]com[.]au/las/excepturimolestiae[.]php hxxps://skylarkworld[.]com[.]pk/mut/autemlabore[.]php hxxps://saspoto[.]co[.]uk/stii/sedqui[.]php hxxps://tatthopunzo[.]com/ldi/explicaboet[.]php hxxps://mesinter[.]com/tonn/cumquibusdam[.]php hxxps://paksociety[.]org/rt/isteenim[.]php hxxps://saveoninsurancerates[.]com/nmu/blanditiisnecessitatibus[.]php hxxps://qm-system[.]com/btai/ametqui[.]php hxxps://nvl[.]uts[.]com[.]pk/xien/abtotam[.]php hxxps://soleildafrique-ci[.]com/seda/repudiandaerem[.]php hxxps://rafahayashida[.]com/mt/etasperiores[.]php hxxps://prodottitipicipassini[.]com/ovlu/nisiquis[.]php hxxps://mrmochishoerepairs[.]com/at/consequaturmolestias[.]php hxxps://symbia[.]com[.]pk/etu/suntblanditiis[.]php hxxps://octaresume[.]com/uu/officiisenim[.]php hxxps://phoneafrienddfw[.]com/ops/aliquidmagnam[.]php hxxps://onlinedemoserver3[.]com/nu/ipsumdolorem[.]php hxxps://sbmaterialsandsupplies[.]com/es/sitsunt[.]php hxxps://rcim[.]org[.]pk/ts/nostrumvero[.]php hxxps://mychapterplatform[.]com/un/etet[.]php hxxps://silversportlimited[.]com/smi/etconsequatur[.]php hxxps://olympicdinerli[.]com/ucet/namquia[.]php hxxps://practika[.]org/aai/utharum[.]php hxxps://sermaqui-peru[.]com/it/perspiciatisaut[.]php hxxps://mongomo-bf[.]com/met/etatque[.]php hxxps://seedsbob[.]com/uui/uui[.]php hxxps://tawkil[.]net/oi/undesit[.]php hxxps://skclinpat[.]com/ecr/doloribusquae[.]php hxxps://quarzolajoya[.]com/unt/natusvoluptates[.]php hxxps://organizationlist[.]com/aeqt/doloratque[.]php hxxps://milagrodev[.]it/ust/veritatisdebitis[.]php hxxps://sitecini[.]net/aete/nullaquod[.]php hxxps://mascoteatetienda[.]com[.]ar/oua/ineaque[.]php hxxps://subtexglobal[.]co[.]uk/lso/quiamagni[.]php hxxps://rightcutbot[.]com/aa/inlibero[.]php hxxps://rasulpurbd[.]org/ie/veleum[.]php hxxps://smashingafricatours[.]com/ei/idconsequatur[.]php hxxps://raizone[.]com[.]mx/uqua/accusantiumvel[.]php hxxps://ncbgrupo[.]com[.]pe/utl/odioconsequatur[.]php hxxps://naijasong[.]com[.]ng/aupu/dignissimoslaborum[.]php hxxps://massatelecom[.]com[.]br/spis/aliassunt[.]php hxxps://sigmaonoutreach[.]com/ls/veroipsam[.]php hxxps://rabari[.]org/si/temporaporro[.]php hxxps://srilakshmispares[.]com/deot/atsaepe[.]php hxxps://seringasr[.]com[.]br/tcun/corruptiquasi[.]php hxxps://puntourbano[.]com/umi/quinisi[.]php hxxps://protec[.]com[.]mx/lnoi/etlabore[.]php hxxps://symcloud[.]net/theo/quodsunt[.]php hxxps://sempu[.]sky[.]net[.]id/dc/voluptatemnon[.]php hxxps://redrosetoken[.]com/ra/reprehenderitomnis[.]php hxxps://ozhomes[.]co[.]uk/tn/delenitideleniti[.]php hxxps://siddirajumissionfoundation[.]org/nqa/errorut[.]php hxxps://privacybuild[.]com/nips/delenitivelit[.]php hxxps://novaembroiders[.]com/strt/ipsumenim[.]php hxxps://octasofts[.]com/atnu/liberoaut[.]php hxxps://strongergames[.]com/esi/suntid[.]php hxxps://sassysecrets[.]com[.]au/mu/numquamducimus[.]php hxxps://stylepion[.]com/aerf/doloreset[.]php hxxps://paribartankhulna[.]org/ndia/eadoloribus[.]php hxxps://offrant[.]com/bn/quiasit[.]php hxxps://prolifepakistan[.]org/ui/solutaet[.]php hxxps://ns-exports[.]com/tu/temporehic[.]php hxxps://onlinemartshopping[.]com/unn/quidemsuscipit[.]php hxxps://mantenimientoautomotriz[.]com[.]mx/den/explicabosed[.]php hxxps://suntrustfb[.]com/as/officiisquia[.]php hxxps://srtvtalentexpo[.]com/qq/omnisdolores[.]php hxxps://rifcoad[.]com/oud/consequunturperspiciatis[.]php hxxps://mtshamser[.]com/ama/maximedolorem[.]php hxxps://solidoitalia[.]it/rdpi/voluptatequi[.]php hxxps://mypenspeakspoetry[.]com/au/etat[.]php hxxps://nobarpildun[.]com/einr/nequeoptio[.]php hxxps://pushkarpatel[.]com/ssti/delenitidebitis[.]php hxxps://roychem[.]com[.]ng/mr/omnisquia[.]php hxxps://jomibikri[.]com/atre/quiaconsequatur[.]php hxxps://liveonserver[.]com/as/dolorsed[.]php hxxps://lyceebalzac[.]com/ern/quipariatur[.]php hxxps://ladizland[.]com/cml/suntaspernatur[.]php hxxps://ispgroup[.]com[.]tr/uua/corporisducimus[.]php hxxps://gmgporder[.]com/al/cupiditatevero[.]php hxxps://lojamaxinutri[.]com[.]br/ru/nullarepudiandae[.]php hxxps://ezhealthcare[.]com[.]pk/eitp/rerumquo[.]php hxxps://enrolhere[.]com/est/voluptasrepudiandae[.]php hxxps://hccariquemes[.]com[.]br/xru/quodad[.]php hxxps://jmbnewsindia[.]com/ue/doloreaut[.]php hxxps://formacionrobotica[.]com/ea/providentdelectus[.]php hxxps://geocodesltd[.]org/oro/veritatisreprehenderit[.]php hxxps://kristinamirkovic[.]com/oob/voluptateet[.]php hxxps://khanapeenajeena[.]com/us/sapientesed[.]php hxxps://ganpathymanpower[.]com/eb/mollitiaducimus[.]php hxxps://geovary[.]com/ati/iurenam[.]php hxxps://equilaterogroup[.]com/qutc/fugafacilis[.]php hxxps://level1group[.]net/tel/necessitatibusillo[.]php hxxps://firstpageblog[.]com/its/porroquasi[.]php hxxps://goldeneinsurance[.]com/osn/exercitationemut[.]php hxxps://eurolearnit[.]org/ldem/liberodolores[.]php hxxps://inforport[.]com[.]ng/mt/evenietrem[.]php hxxps://himfgcalidad[.]org/ims/quisquamet[.]php hxxps://insuranceratesaving[.]com/mp/doloredelectus[.]php hxxps://gorevciyiz[.]com/peo/facereet[.]php hxxps://kgn-enterprises[.]com/ill/quodalias[.]php hxxps://julitetpharmacy[.]com/lom/erroralias[.]php hxxps://grupo-dym[.]com/eim/rationeconsequatur[.]php hxxps://maheshfoundation[.]org/reun/eavoluptatem[.]php hxxps://lucraw[.]com/iros/eumqui[.]php hxxps://fendersblog[.]com/ei/etipsam[.]php hxxps://germantradelimited[.]com/uio/omniset[.]php hxxps://getmeoutofforeclosure[.]com/ie/delenitiqui[.]php hxxps://esports-rks[.]com/de/uteaque[.]php hxxps://finephysio[.]co[.]uk/oauu/voluptatemest[.]php hxxps://cdxsrl[.]com/ods/praesentiumest[.]php hxxps://ingeniousbh[.]com/nuc/veniamaut[.]php hxxps://kecc[.]co[.]uk/tv/quiaquibusdam[.]php hxxps://grupohercar[.]com[.]mx/ntie/quoconsequuntur[.]php hxxps://installen[.]com/vele/etquidem[.]php hxxps://kajniti[.]com/oa/quamiste[.]php hxxps://industriaskripytoniano[.]com/eit/estvoluptatem[.]php hxxps://iptv-bsm[.]com/tldt/eain[.]php hxxps://harpsimplified[.]com/tts/rationeofficia[.]php hxxps://hexaitsolutions[.]com/umi/voluptasid[.]php hxxps://loveworlduyo[.]org/eot/quisit[.]php hxxps://logicalloopholes[.]com/nit/utnon[.]php hxxps://icacit[.]org[.]pe/eu/eumnon[.]php hxxps://fly-pedia[.]com/ois/solutaunde[.]php hxxps://hc-solution[.]com/be/blanditiisdelectus[.]php hxxps://floraprodutosnaturais[.]com[.]br/imu/officiiscupiditate[.]php hxxps://jayamairsolvers[.]com/rs/nihilut[.]php hxxps://ispenerji[.]com[.]tr/inau/exercitationemut[.]php hxxps://fb505[.]com/isne/utiste[.]php hxxps://lvfashionworld[.]com/utn/nemoconsequatur[.]php hxxps://lifeandinsurances[.]com/tal/quisin[.]php hxxps://maitrekodjogeorgeskoffi[.]com/euq/voluptatemnulla[.]php hxxps://ihrcafrica[.]org/irc/nostrumoccaecati[.]php hxxps://garageaccesorios[.]com/eol/doloressed[.]php hxxps://fincoedge[.]com/fu/reiciendiseos[.]php hxxps://inspoxpert[.]com[.]au/ame/nobisdolores[.]php hxxps://ingeniousinterlacsolutions[.]com/tteu/iurequas[.]php hxxps://ludowire[.]com/iqsu/iustoquidem[.]php hxxps://gihdglobal[.]org/eet/eosex[.]php hxxps://kikicareer[.]com/mo/consequaturvoluptates[.]php hxxps://ferreterialunailo[.]com/ei/utsunt[.]php hxxps://lylrefrigeracion[.]com[.]pe/eod/eumest[.]php hxxps://koveration[.]com/nmu/minimased[.]php hxxps://jcmpsoftware[.]com[.]co/mesa/providentaut[.]php hxxps://freemagaziness[.]com/sesa/cumquenatus[.]php hxxps://indiapollsconsulting[.]com/na/quisipsum[.]php hxxps://grupogedeon[.]com[.]ar/ado/quasquia[.]php hxxps://kmbiztech[.]com/eaa/oditveniam[.]php hxxps://louiscardahi[.]com/ntsm/aliasdolorem[.]php hxxps://kelportals[.]com/tmat/velitnam[.]php hxxps://fajarmarketing[.]com/enm/quibusdamsed[.]php hxxps://kbtkmtajumapolo[.]com/eler/rerumet[.]php hxxps://jacitechies[.]com/eoxa/autofficia[.]php hxxps://goprotogo[.]com/tua/voluptatesplaceat[.]php hxxps://lalmonirhat[.]net/edp/errorquaerat[.]php hxxps://enitanlpa[.]com/eaes/veniamfacere[.]php hxxps://freezyind[.]com/es/voluptasnesciunt[.]php hxxps://estudiosanvicente[.]com[.]ar/slpt/odiolaudantium[.]php hxxps://eunews24[.]net/tr/inet[.]php hxxps://jwmbeatit[.]com/nob/voluptatumenim[.]php hxxps://jobezalert[.]com/re/utnon[.]php hxxps://aasraatrust[.]org/qtee/evenietmagni[.]php hxxps://dominionmandateinstitute[.]com/mul/pariaturdolor[.]php hxxp://totalassist[.]co[.]uk/uiia/autemet[.]php hxxps://altofola-mag[.]org/ml/ipsamolestiae[.]php hxxps://alakeys[.]com/iur/nonullam[.]php hxxps://alrazihealthcarehospital[.]com/aca/quiaanimi[.]php hxxp://extremetobacco[.]com/leem/oditeius[.]php hxxps://daralhanan[.]org/uid/vitaenesciunt[.]php hxxps://alienterprises[.]com[.]pk/ets/aspernaturvel[.]php hxxps://bass256[.]com/xuq/voluptatesrepudiandae[.]php hxxps://ds-block[.]com/pe/accusamusvero[.]php hxxps://barakatpharmacy[.]com/li/magnamsunt[.]php hxxp://beetelmedia[.]com/pet/quaetenetur[.]php hxxp://yatrihumsafar[.]com/uss/maximefacilis[.]php hxxps://autotechnica[.]com[.]br/peu/optioad[.]php hxxps://edwb[.]org/uaqt/repellataut[.]php hxxps://alzheimeraprendeyactua[.]org/de/veritatisomnis[.]php hxxps://disenova[.]com/tm/quiaspernatur[.]php hxxp://cuoppoedrink[.]it/cim/ullamea[.]php hxxps://daniloroessger[.]de/ica/delectusnecessitatibus[.]php hxxp://estudiosanvicente[.]com[.]ar/slpt/odiolaudantium[.]php hxxp://gonutritioncore[.]com/tsi/repudiandaelibero[.]php hxxps://cafeterastradicionales[.]com[.]mx/qlue/optioreiciendis[.]php hxxps://babyvaley[.]com/etdi/sitdolorum[.]php hxxps://accesoriosparabarista[.]com[.]mx/eu/iurereiciendis[.]php hxxp://f-77defence[.]com/sip/estqui[.]php hxxp://bravobakerycaffe[.]com/la/rerumtenetur[.]php hxxps://ceylife[.]com[.]tr/ie/namcommodi[.]php hxxps://cgprogramming[.]com/voei/liberout[.]php hxxps://citizeninfotechnepal[.]com/nti/rerumsequi[.]php hxxp://pointcar24[.]net/cut/nameos[.]php hxxp://buraqimpexllc[.]com/tlo/siterror[.]php hxxps://daaraltaaqa[.]com/iml/totammolestiae[.]php hxxps://aeonenviro[.]com/orqu/temporeenim[.]php hxxps://beautysymbols[.]com/mla/quaedignissimos[.]php hxxps://criizn[.]com/it/etincidunt[.]php hxxps://buy2smm[.]com/om/omnisomnis[.]php hxxps://datarhalalmeat[.]com/poo/illotemporibus[.]php hxxps://ejoar[.]net/test/nihilinventore[.]php hxxps://activesupportandcare[.]org[.]ng/aroo/voluptasharum[.]php hxxps://aaaassociates[.]com/ri/velitdolore[.]php hxxps://dcciha[.]com/tc/quibusdamaspernatur[.]php hxxp://gslcorporate[.]com/pe/idsequi[.]php hxxp://shifa365dev[.]com/at/quaein[.]php hxxps://aarionafoundation[.]org/mdqi/inventoremolestias[.]php hxxps://bsiconcepts[.]com/qq/laboriosamtempore[.]php hxxps://annekuemuraphd[.]com/uqae/etaperiam[.]php hxxps://cardahi[.]com/am/voluptasut[.]php hxxps://bhislass[.]com/luu/utfacilis[.]php hxxps://absolarsols[.]com/et/ullamexplicabo[.]php hxxps://corrocoategypt[.]com/aau/quodharum[.]php hxxps://dclcargo[.]com/aoe/laboreaut[.]php hxxp://reparacionlicuadoras[.]com[.]mx/aun/repellendusvoluptatem[.]php hxxps://denosterres[.]com/ua/doloreprovident[.]php hxxps://arhconsultores[.]com/uiti/saepeincidunt[.]php hxxp://ebenezer-efoundation[.]org/etia/istea[.]php hxxp://jghproyectosyservicios[.]com/tumu/saepevitae[.]php hxxps://chemicalwarehouse[.]com[.]ng/nin/utnumquam[.]php hxxp://ugandatailors[.]org/slb/quiaexercitationem[.]php hxxp://kaptanyachting[.]com/iti/blanditiistotam[.]php hxxps://chinacomercia[.]com/eq/pariaturomnis[.]php hxxps://blockchaincoinsrestore[.]com/adn/fugitminima[.]php hxxps://alexxassociates[.]com/pru/iddolorem[.]php hxxp://eurolearnit[.]org/ldem/liberodolores[.]php hxxps://ajkshopee[.]com/dtee/necessitatibuseius[.]php hxxps://eac-peru[.]com/ii/remullam[.]php hxxps://abttunisie[.]com/rnoi/consecteturmolestias[.]php hxxp://stprevent[.]com/er/aliquidex[.]php hxxp://intimapassion[.]com[.]br/mimo/quaspraesentium[.]php hxxps://cleannitjs[.]com/tv/cumdolor[.]php hxxps://alzheimercapacitacioncontinua[.]org/ic/similiqueanimi[.]php hxxps://afroglams[.]com/eii/esteius[.]php hxxps://drjalalzadeh[.]com/rpo/doloremeum[.]php hxxps://aciminsights[.]com/tabn/autet[.]php hxxp://tropicalradio[.]co[.]ug/le/le[.]php hxxps://bulldozergames[.]com/usmu/remquod[.]php hxxps://behnamsafari[.]de/nuan/estminus[.]php hxxps://bonesolution[.]org/nrp/laborequi[.]php hxxps://daikinyetkiliservisi[.]com/ri/vitaeest[.]php hxxps://acfuganda[.]org/ml/earumsoluta[.]php hxxp://xaankoo[.]com/au/idquam[.]php hxxps://clinicasanarte[.]com/lai/sequisunt[.]php hxxps://cloudcybercore[.]com/pr/doloremillum[.]php hxxp://glondex[.]com/un/eosquis[.]php hxxp://ideabici[.]it/asil/inventoreeos[.]php hxxp://ukbanglanews[.]com/nin/quiad[.]php hxxps://amzobuy[.]com/mid/recusandaererum[.]php hxxps://duzenoglu[.]com[.]tr/atee/nondolorem[.]php hxxps://cartravelsgunturnalluri[.]com/sqou/veroenim[.]php hxxp://faster2023[.]com/tsqe/voluptasofficia[.]php hxxp://sharmalotteryshop[.]com/eimu/namharum[.]php hxxps://ccsnr[.]com/ee/itaqueconsequatur[.]php hxxps://advogadosimbituba[.]com[.]br/oiqs/quisvitae[.]php hxxps://chattlechain[.]com/et/possimusvelit[.]php hxxps://desamproperties[.]com/ar/doloremquequo[.]php hxxps://a20g[.]com/mu/atdolor[.]php hxxp://fundacionvaloreshumanoscolombia[.]org/mai/natushic[.]php hxxps://apollopizzakidderminster[.]co[.]uk/ls/eaminima[.]php hxxps://cosmetictypes[.]com/hmus/corruptiet[.]php hxxps://askemiratilawyers[.]com/iat/nisiperferendis[.]php hxxp://smillean[.]fr/hlun/nihilculpa[.]php hxxps://acfilmmaker[.]com/bnts/dolordebitis[.]php hxxp://everspicesceylon[.]com/vul/omnisnon[.]php hxxps://cheftuoyo[.]com/caop/estet[.]php hxxp://cosmicitltd[.]com/oer/vitaequidem[.]php hxxp://yeahps[.]com/toul/magnamdignissimos[.]php hxxp://trickgacormiya[.]com/tces/utperspiciatis[.]php hxxp://bamvas[.]com/ot/recusandaeofficiis[.]php hxxps://arenatransautos[.]com[.]br/blo/me[.]zip hxxps://lordbhumiassociates[.]com/blo/me[.]zip hxxp://almacorp[.]com/blo/64366a5e9986e[.]zip hxxps://foodiesafari[.]it/ote/quasmollitia[.]php hxxps://tristatepavingmd[.]com/se/beataeiure[.]php hxxps://moitruongxaydungvn[.]com/rod/sedet[.]php hxxp://9diamondlaundry[.]com/ea/voluptatevoluptate[.]php hxxps://g2iprovisaoamericana[.]med[.]br/blo/me[.]zip hxxps://saugatimilsina[.]com[.]np/blo/me[.]zip hxxps://india-shoppy[.]com/blo/me[.]zip hxxps://uoalhuda[.]edu[.]iq/blo/me[.]zip hxxp://almacorp[.]com/blo/me[.]zip hxxp://secondstep-sy[.]com/blo/me[.]zip hxxp://parintieducati[.]ro/blo/me[.]zip hxxp://vrindatechnologies[.]com/blo/me[.]zip hxxp://lordbhumiassociates[.]com/blo/me[.]zip hxxp://arenatransautos[.]com[.]br/blo/me[.]zip hxxps://bytedesign[.]net/vPqyWxb/020423[.]gif hxxp://uoalhuda[.]edu[.]iq/blo/me[.]zip hxxp://saugatimilsina[.]com[.]np/blo/me[.]zip hxxp://india-shoppy[.]com/blo/me[.]zip hxxp://g2iprovisaoamericana[.]med[.]br/blo/me[.]zip hxxp://tvspropertyindia[.]in/blo/me[.]zip hxxp://multconsultlaboratories[.]com/blo/me[.]zip hxxp://kalog[.]vn/blo/me[.]zip hxxp://seedsindia[.]org/blo/me[.]zip hxxp://tevoi[.]info/blo/me[.]zip hxxp://movarlogistics[.]com/blo/me[.]zip hxxp://kingstylehomes[.]com[.]au/blo/me[.]zip hxxps://farm-sharing[.]at/blo/me[.]zip hxxp://qeepsolutions[.]co[.]ke/blo/me[.]zip hxxp://orangemultimedia[.]in/blo/me[.]zip hxxp://dreamwebservice[.]in/blo/me[.]zip hxxp://hc-solution[.]com/blo/me[.]zip hxxp://asiaengrs[.]com/blo/me[.]zip hxxp://grecokitchens[.]com/blo/me[.]zip hxxp://iamss[.]ir/blo/me[.]zip hxxp://farm-sharing[.]at/blo/me[.]zip hxxp://147[.]135[.]248[.]250/boris[.]dat hxxps://xebiaus[.]com/blo/me[.]zip hxxps://mahanjewelry[.]ir/blo/me[.]zip hxxps://elmaestro[.]in/blo/me[.]zip hxxps://climatech-sa[.]com/blo/me[.]zip hxxp://smt4you[.]net/blo/me[.]zip hxxp://techtattva[.]in/blo/me[.]zip hxxp://onlineschool[.]co[.]tz/blo/me[.]zip hxxp://verolineengineers[.]com/blo/me[.]zip hxxp://jtaguapura[.]com/blo/me[.]zip hxxp://msasolucoes[.]com[.]br/blo/me[.]zip hxxp://reraonline[.]xyz/blo/me[.]zip hxxp://rotary2440[.]net/blo/me[.]zip hxxp://skymarqbydsr[.]com/blo/me[.]zip hxxp://vaga[.]gq/blo/me[.]zip hxxp://janusc[.]com[.]au/blo/me[.]zip hxxp://newwayrealestate[.]in/blo/me[.]zip hxxp://websoftcomputers[.]co[.]in/blo/me[.]zip hxxp://xuxi[.]ir/blo/me[.]zip hxxp://owtad[.]ir/blo/me[.]zip hxxp://vishalbrassproducts[.]com/blo/me[.]zip hxxp://cryoshield[.]co[.]za/blo/me[.]zip hxxp://almazenplastcomp[.]com/blo/me[.]zip hxxp://auto1[.]pk/blo/me[.]zip hxxp://aatsny[.]com/blo/me[.]zip hxxp://hussaincatering[.]com/blo/me[.]zip hxxp://ivanlogistics[.]com/blo/me[.]zip hxxp://arjunanewsonline[.]com/blo/me[.]zip hxxp://amglotec[.]com/blo/me[.]zip hxxp://ioqacademy[.]com/blo/me[.]zip hxxp://f-77defence[.]com/blo/me[.]zip hxxp://eventourarte[.]cl/blo/me[.]zip hxxp://ankitsudhera[.]com/blo/me[.]zip hxxp://asgharintl[.]net/blo/me[.]zip hxxps://navicoads[.]com/blo/me[.]zip hxxps://ranokxlogistics[.]com/blo/me[.]zip hxxps://monoistomathraki[.]com/blo/me[.]zip hxxp://krishikannada[.]com/blo/me[.]zip hxxp://odiajans[.]com/blo/me[.]zip hxxp://howtospeakenglish[.]in/blo/me[.]zip hxxp://noor-relaxation[.]com/blo/me[.]zip hxxp://jpalomo[.]com/blo/me[.]zip hxxp://facitrh[.]com[.]br/blo/me[.]zip hxxp://trackblazers[.]in/blo/me[.]zip hxxp://cklab[.]my/blo/me[.]zip hxxp://man2kotasmg[.]sch[.]id/blo/me[.]zip hxxp://reraonline[.]info/blo/me[.]zip hxxp://nesennor[.]ir/blo/me[.]zip hxxp://solarzone[.]com[.]pk/blo/me[.]zip hxxp://danuxdecolombia[.]com/blo/me[.]zip hxxp://carneliantc[.]com/blo/me[.]zip hxxp://omarglani[.]com/blo/me[.]zip hxxp://baumadera[.]cl/blo/me[.]zip hxxp://kamranortho[.]com/blo/me[.]zip hxxp://ranokxlogistics[.]com/blo/me[.]zip hxxp://navicoads[.]com/blo/me[.]zip hxxp://monoistomathraki[.]com/blo/me[.]zip hxxp://siddiqsonsfurniture[.]com/blo/me[.]zip hxxp://xebiaus[.]com/blo/me[.]zip hxxp://mahanjewelry[.]ir/blo/me[.]zip hxxp://elmaestro[.]in/blo/me[.]zip hxxp://climatech-sa[.]com/blo/me[.]zip hxxps://epec[.]com[.]bd/blo/me[.]zip |
QakBot |
| URL | hxxp://45[.]88[.]67[.]75/pdf/doc[.]pdf hxxp://45[.]88[.]67[.]75/pdf/a1[.]pdf hxxp://45[.]88[.]67[.]75/pdf/a[.]pdf |
XWorm |
| URL | hxxp://ciclotronperu[.]com/kobaltrot2[.]1[.]exe | Remcos |
| URL | hxxp://104[.]248[.]91[.]138:8080/hxxp/svchost[.]exe hxxp://104[.]248[.]91[.]138:8080/hxxp/syshost[.]exe hxxp://104[.]248[.]91[.]138:8080/hxxp/inst[.]exe |
Aurora Stealer |
| URL | hxxp://111[.]249[.]211[.]63:42928/Mozi[.]m | Mozi |
| URL | hxxp://92[.]63[.]104[.]30/javascript_[.]php | DCRat |
