不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様10社 -
2023/07/18
※2023/07/18 更新
マルウェア感染させると考えられるURLを検知（2023/07/18）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://www[.]torq[.]qa/nekario2[.]1[.]exe | Warzone RAT |
| URL | hxxp://80[.]66[.]75[.]37/a-Xmifagl[.]dll | PureCrypter |
| URL | hxxp://171[.]22[.]30[.]164/arnold/five/fre[.]php hxxp://185[.]246[.]220[.]85/findspace/five/fre[.]php hxxp://185[.]252[.]179[.]165/B19041/dwmnj[.]exe hxxp://195[.]178[.]120[.]24/NBbH87[.]exe hxxp://138[.]68[.]56[.]139/?p=1172516806443 hxxp://185[.]252[.]179[.]165/Desktop/dwmfs[.]exe hxxps://malicious[.]ozkanburgac[.]com/NBbH87[.]exe hxxp://138[.]68[.]56[.]139/?p=94571115 hxxp://79[.]110[.]49[.]21/luiz/five/fre[.]php |
LokiBot |
| URL | hxxp://globalautomobileshop[.]com/app64[.]dll hxxp://admlogs85[.]xyz/rh111[.]exe hxxp://fexstat227[.]xyz/skx111[.]exe |
SystemBC |
| URL | hxxp://jameslachman[.]com/wjgviwkk hxxp://jameslachman[.]com/nsajgv |
VenomLNK |
| URL | hxxps://slurpslimes[.]org/spzPgNkL hxxps://ijko[.]rfc[.]zitoprohealth[.]com/editContent hxxps://caxsf[.]rfc[.]zitoprohealth[.]com/editContent hxxps://yhvtg[.]rfc[.]zitoprohealth[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://45[.]9[.]74[.]164/b7djSDcPcZ/Plugins/clip64[.]dll hxxp://45[.]9[.]74[.]164/b7djSDcPcZ/Plugins/cred64[.]dll hxxp://timemaintenance[.]live/Amday[.]exe hxxp://87[.]121[.]47[.]63/laker/index[.]php hxxp://87[.]121[.]47[.]63/laker/Plugins/clip64[.]dll hxxp://77[.]91[.]124[.]31/new/fotod25[.]exe hxxp://77[.]91[.]124[.]31/new/foto135[.]exe |
Amadey |
| URL | hxxp://5[.]78[.]111[.]161:8088/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://5[.]78[.]111[.]161:8088/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://5[.]78[.]111[.]161:8088/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://5[.]78[.]111[.]161:8088/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://5[.]78[.]111[.]161:8088/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://5[.]78[.]111[.]161:8088/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://5[.]78[.]111[.]161:8088/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll |
RecordBreaker |
| URL | hxxp://185[.]244[.]48[.]81/aaca0bb107ddf418/freebl3[.]dll hxxp://185[.]244[.]48[.]81/aaca0bb107ddf418/nss3[.]dll hxxp://194[.]59[.]31[.]66/4b77f6dcb86d3ddc/sqlite3[.]dll hxxp://194[.]59[.]31[.]66/4b77f6dcb86d3ddc/nss3[.]dll hxxp://194[.]59[.]31[.]66/4b77f6dcb86d3ddc/mozglue[.]dll hxxp://185[.]244[.]48[.]81/aaca0bb107ddf418/msvcp140[.]dll hxxp://185[.]244[.]48[.]81/aaca0bb107ddf418/mozglue[.]dll hxxp://194[.]59[.]31[.]66/4b77f6dcb86d3ddc/softokn3[.]dll hxxp://185[.]244[.]48[.]81/aaca0bb107ddf418/sqlite3[.]dll hxxp://185[.]244[.]48[.]81/aaca0bb107ddf418/softokn3[.]dll hxxp://194[.]59[.]31[.]66/4b77f6dcb86d3ddc/freebl3[.]dll hxxp://194[.]59[.]31[.]66/4b77f6dcb86d3ddc/msvcp140[.]dll hxxp://194[.]59[.]31[.]66/4b77f6dcb86d3ddc/vcruntime140[.]dll hxxp://185[.]244[.]48[.]81/aaca0bb107ddf418/vcruntime140[.]dll hxxp://77[.]105[.]146[.]152/603aeb43718ab133[.]php hxxp://77[.]105[.]146[.]152/bfda4df0727326b7/mozglue[.]dll hxxp://77[.]105[.]146[.]152/bfda4df0727326b7/nss3[.]dll hxxp://77[.]105[.]146[.]152/bfda4df0727326b7/sqlite3[.]dll hxxp://77[.]105[.]146[.]152/bfda4df0727326b7/freebl3[.]dll hxxp://77[.]105[.]146[.]152/bfda4df0727326b7/msvcp140[.]dll hxxp://77[.]105[.]146[.]152/bfda4df0727326b7/softokn3[.]dll hxxp://77[.]105[.]146[.]152/bfda4df0727326b7/vcruntime140[.]dll hxxp://unlikeget[.]top/f059ec3d7eb90876/nss3[.]dll hxxp://unlikeget[.]top/f059ec3d7eb90876/freebl3[.]dll hxxp://unlikeget[.]top/f059ec3d7eb90876/msvcp140[.]dll hxxp://unlikeget[.]top/f059ec3d7eb90876/sqlite3[.]dll hxxp://unlikeget[.]top/f059ec3d7eb90876/mozglue[.]dll hxxp://unlikeget[.]top/f059ec3d7eb90876/softokn3[.]dll hxxp://unlikeget[.]top/f059ec3d7eb90876/vcruntime140[.]dll hxxp://nwstats3[.]site/4e6508e4090e861a[.]php hxxp://blogvpnreserch[.]com/5f223a8b38f80207/mozglue[.]dll hxxp://blogvpnreserch[.]com/5f223a8b38f80207/softokn3[.]dll hxxp://blogvpnreserch[.]com/5f223a8b38f80207/freebl3[.]dll hxxp://blogvpnreserch[.]com/5f223a8b38f80207/sqlite3[.]dll hxxp://blogvpnreserch[.]com/5f223a8b38f80207/msvcp140[.]dll hxxp://blogvpnreserch[.]com/5f223a8b38f80207/nss3[.]dll hxxp://blogvpnreserch[.]com/5f223a8b38f80207/vcruntime140[.]dll hxxp://blogvpnreserch[.]com/a431f538ac55c20c[.]php |
Stealc |
| URL | hxxp://servxblog79[.]xyz/statweb255/ hxxp://serverxlogs21[.]xyz/statweb255/ hxxp://demblog289[.]xyz/statweb255/ hxxp://blogxstat38[.]xyz/statweb255/ hxxp://blogxstat25[.]xyz/statweb255/ hxxp://admlogs77x[.]online/statweb255/ hxxp://85[.]192[.]41[.]196/s[.]exe hxxp://45[.]9[.]74[.]80/new/toolspub2[.]exe hxxp://5[.]42[.]78[.]22/cib[.]exe hxxp://192[.]3[.]26[.]168/79/wikimap[.]exe hxxp://192[.]3[.]26[.]168/windows/x/ZdjVYOnpioO33[.]bin |
SmokeLoader |
| URL | hxxp://49[.]13[.]59[.]137/someoneadasylf[.]zip hxxp://128[.]140[.]92[.]122:8081/files[.]zip hxxp://91[.]107[.]209[.]224/someoneadasylf[.]zip hxxp://135[.]181[.]46[.]141/jovndoe[.]zip hxxp://37[.]27[.]6[.]23/hendoved[.]zip |
Vidar |
| URL | hxxp://87[.]121[.]221[.]212/damianozx[.]exe hxxp://87[.]121[.]221[.]212/texaszx[.]exe hxxp://87[.]121[.]221[.]212/texaszx[.]doc hxxp://87[.]121[.]221[.]212/damianozx[.]doc hxxp://87[.]121[.]221[.]212/divinezx[.]exe hxxp://198[.]23[.]156[.]251/77/igccu[.]exe hxxp://198[.]23[.]156[.]251/80/wind[.]exe hxxp://lt[.]paramountflow[.]com/lt[.]exe hxxps://www[.]mackeyplant[.]com/doc/Remittance_Advice_120723[.]zip |
Agent Tesla |
| URL | hxxps://hinokiworld[.]com/wp-content/themes/sketch/squabbler/ hxxp://burikov[.]com/fumigation/ hxxps://tourism[.]maalina-company[.]com/popularization/ hxxps://ekhayafarm[.]com/contrivance hxxp://masteriwestheighs[.]com/polemic/ hxxps://lossofgravity[.]com/thriftiness/ hxxps://thetripsuggest[.]com/tai/ hxxps://inoverse[.]com/turkred/wp-content/themes/sketch/vigorous/ hxxps://siintec[.]com/proctorial/ hxxps://inovatdigital[.]com/propellent/ hxxps://nataliafrica[.]com/certitude/ hxxps://nataliafrica[.]com/4e061d30-3964-4788-bdd9-7257b164fbfd hxxps://thezoomit[.]com/anticipative/ hxxp://tahtaadam[.]com/serious/ |
IcedID |
| URL | hxxp://198[.]23[.]156[.]248/83/wins[.]EXE hxxp://198[.]23[.]156[.]248/qs/IsLYlEDfXpZxqiN12[.]bin hxxp://192[.]3[.]243[.]148/500/wins[.]exe hxxp://192[.]3[.]243[.]148/450/win[.]exe hxxp://5[.]253[.]114[.]108/oFiOkGUr93[.]bin hxxp://87[.]121[.]221[.]212/jawazx[.]exe hxxp://192[.]3[.]26[.]168/windows/f/ayewoMsIHKx140[.]bin |
CloudEyE |
| URL | hxxp://itrevolution[.]in/maximan2[.]1[.]exe hxxp://198[.]23[.]156[.]248/85/winell[.]exe hxxp://198[.]23[.]156[.]248/85/wine[.]exe hxxp://103[.]16[.]215[.]29/Desktop/csrssfs[.]exe hxxp://103[.]57[.]130[.]167/Explorer/wininit[.]exe |
Formbook |
| URL | hxxp://120[.]46[.]210[.]49:88/ca hxxp://82[.]157[.]145[.]105:4445/ga[.]js hxxps://175[.]24[.]177[.]84:50001/load hxxp://154[.]221[.]17[.]44:2090/push hxxp://45[.]152[.]64[.]75/search/ hxxp://175[.]178[.]41[.]181/ptj hxxp://81[.]68[.]106[.]68:8888/__utm[.]gif hxxp://103[.]145[.]107[.]83:8080/visit[.]js hxxps://ok[.]ppctech[.]xyz/admin/info hxxp://124[.]71[.]205[.]116:801/ca hxxp://49[.]4[.]24[.]255:8012/match hxxps://121[.]41[.]179[.]124/__utm[.]gif hxxp://175[.]24[.]177[.]84:50002/match hxxps://newstatisc[.]googleinfo[.]se:2053/ga[.]js hxxp://8[.]140[.]37[.]238:50001/dpixel hxxp://47[.]120[.]2[.]120/visit[.]js hxxps://43[.]139[.]246[.]195/pixel[.]gif hxxp://59[.]110[.]4[.]246:81/activity hxxps://www[.]darkerstan[.]top/visit[.]js hxxp://31[.]44[.]184[.]129/fwlink hxxp://103[.]234[.]72[.]200/ptj hxxp://66[.]135[.]30[.]181/j[.]ad hxxp://47[.]236[.]19[.]63:8989/dpixel hxxp://154[.]39[.]240[.]110:8080/dpixel hxxp://101[.]43[.]198[.]94:4446/dpixel hxxp://185[.]81[.]68[.]90:808/visit[.]js hxxp://123[.]249[.]100[.]157/owa/ hxxp://118[.]126[.]95[.]13:8000/mht_image/ hxxp://121[.]36[.]18[.]243/ca hxxp://81[.]19[.]137[.]0:8888/dot[.]gif hxxps://static[.]tencentsbank[.]com/owa/ hxxps://82[.]157[.]145[.]105/updates[.]rss hxxp://49[.]4[.]24[.]255:8023/fwlink hxxp://43[.]139[.]246[.]195/ptj hxxp://47[.]93[.]242[.]212/cx hxxp://20[.]90[.]138[.]102/watch hxxps://45[.]152[.]64[.]75/search/ hxxp://43[.]139[.]246[.]195/fwlink hxxp://114[.]118[.]4[.]166:8100/api/getit hxxp://116[.]204[.]85[.]141/pixel hxxp://154[.]9[.]227[.]74:8081/__utm[.]gif hxxp://49[.]233[.]56[.]4/match hxxp://47[.]113[.]188[.]133:81/pixel hxxp://121[.]36[.]18[.]243:5432/match hxxps://93[.]157[.]86[.]27/dot[.]gif hxxps://182[.]92[.]181[.]146:9443/jquery-3[.]3[.]1[.]min[.]js hxxps://www[.]gzjinyou[.]cn/jquery-3[.]3[.]1[.]min[.]js hxxps://www[.]cnhile-hl[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://58[.]49[.]187[.]148/g[.]pixel hxxps://116[.]253[.]24[.]240/fwlink hxxps://116[.]172[.]148[.]7/IE9CompatViewList[.]xml hxxps://117[.]34[.]17[.]204/fwlink hxxps://58[.]217[.]206[.]245/IE9CompatViewList[.]xml hxxps://117[.]34[.]18[.]102/g[.]pixel hxxps://119[.]188[.]86[.]194/ga[.]js hxxps://122[.]246[.]12[.]168/IE9CompatViewList[.]xml hxxps://221[.]228[.]216[.]78/fwlink hxxps://64[.]44[.]102[.]84/restore/v5[.]88/W0V7CRVFH hxxps://xovohed[.]org/restore/v5[.]88/W0V7CRVFH hxxps://l[.]wps[.]pics:2053/www/handle/doc hxxps://64[.]44[.]102[.]84:8080/restore/v5[.]88/W0V7CRVFH hxxps://xovohed[.]org:8080/restore/v5[.]88/W0V7CRVFH hxxps://o[.]wps[.]pics:2083/www/handle/doc hxxps://116[.]205[.]232[.]186:8888/www/handle/doc hxxps://softwaredw[.]com/64hxxpS[.]dll hxxp://205[.]185[.]123[.]233:8521/jquery-3[.]3[.]1[.]min[.]js hxxp://103[.]234[.]72[.]107/pixel hxxp://101[.]35[.]19[.]133/updates[.]rss hxxp://104[.]21[.]52[.]153/api/getit hxxp://172[.]67[.]201[.]32/api/getit hxxps://ns1[.]gcloud-api[.]com:8443/ca hxxp://139[.]199[.]180[.]136/__utm[.]gif hxxp://81[.]68[.]249[.]97:9001/en_US/all[.]js hxxps://rw1[.]sentrysource[.]com/__utm[.]gif hxxp://81[.]68[.]249[.]97:8090/match hxxp://175[.]24[.]177[.]84:50002/ptj hxxp://124[.]71[.]205[.]116:801/pixel[.]gif hxxp://47[.]120[.]2[.]120/updates[.]rss hxxp://124[.]223[.]91[.]53:88/g[.]pixel hxxps://175[.]24[.]177[.]84:50001/match hxxp://180[.]76[.]164[.]197:12345/pixel[.]gif hxxp://92[.]63[.]196[.]48:92/updates[.]rss hxxp://103[.]234[.]72[.]187:60012/j[.]ad hxxps://81[.]70[.]167[.]153/g[.]pixel hxxp://121[.]36[.]52[.]164:8080/push hxxp://43[.]143[.]250[.]89:443/jquery-3[.]3[.]1[.]min[.]js hxxps://64[.]227[.]71[.]13/__utm[.]gif hxxps://download[.]baidumusic[.]cloud/api/broadcast/index hxxp://38[.]147[.]172[.]224/push hxxps://159[.]75[.]155[.]203/NewsTodayUIBV[.]php hxxp://49[.]4[.]24[.]255/ptj hxxp://103[.]101[.]176[.]146:8032/jquery-3[.]3[.]1[.]min[.]js hxxps://211[.]149[.]186[.]220:9443/ptj hxxp://edg[.]mdstech[.]com[.]tw/fd/ls/ hxxp://77[.]75[.]230[.]153:8084/push hxxp://8[.]143[.]2[.]128:8081/dpixel hxxp://38[.]6[.]177[.]68:801/visit[.]js hxxp://120[.]72[.]117[.]131/IE9CompatViewList[.]xml hxxps://edg[.]mdstech[.]com[.]tw/fd/ls/ hxxp://124[.]221[.]183[.]95:6661/dot[.]gif hxxp://38[.]55[.]189[.]132:4444/__utm[.]gif hxxps://106[.]14[.]75[.]240:1443/en_US/all[.]js hxxp://139[.]155[.]159[.]81:8082/activity hxxp://216[.]83[.]45[.]170/cx hxxp://192[.]227[.]178[.]247:8080/IE9CompatViewList[.]xml hxxp://49[.]234[.]29[.]148/pixel hxxps://cs45[.]gamesmetaa[.]com/__utm[.]gif hxxp://185[.]109[.]48[.]179:8080/cm hxxp://123[.]249[.]91[.]163:8089/push hxxp://119[.]84[.]129[.]234/match hxxp://103[.]44[.]170[.]229/pixel[.]gif hxxp://220[.]181[.]125[.]242/ptj hxxp://113[.]5[.]183[.]248/dot[.]gif hxxp://125[.]76[.]247[.]249/__utm[.]gif hxxp://182[.]118[.]13[.]170/ca hxxp://60[.]21[.]166[.]232/match hxxp://58[.]218[.]215[.]170/pixel hxxp://58[.]218[.]215[.]165/pixel[.]gif hxxp://111[.]48[.]71[.]121/pixel hxxp://217[.]195[.]153[.]169/visit[.]js hxxp://124[.]220[.]148[.]109:9997/load hxxp://139[.]159[.]203[.]44:8009/pixel hxxp://165[.]227[.]154[.]89/visit[.]js hxxps://209[.]141[.]39[.]46:1443/dot[.]gif hxxps://175[.]178[.]79[.]10/activity hxxp://175[.]178[.]79[.]10/dot[.]gif hxxp://1[.]14[.]68[.]150/en_US/all[.]js hxxps://185[.]11[.]61[.]46/visit[.]js hxxps://31[.]44[.]184[.]88/__utm[.]gif hxxp://185[.]11[.]61[.]46/j[.]ad hxxp://31[.]44[.]184[.]82/cm hxxp://116[.]62[.]180[.]202:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://45[.]32[.]45[.]123/ca hxxps://sanjianke[.]icu/api/getit hxxp://45[.]91[.]81[.]100:9091/__utm[.]gif hxxps://103[.]238[.]226[.]146:9443/cx hxxps://cdn[.]cdndbapp[.]top:8443/jquery-3[.]3[.]1[.]min[.]js hxxp://sanjianke[.]icu/api/getit hxxp://101[.]35[.]19[.]133/match hxxp://206[.]238[.]42[.]198/pixel hxxp://173[.]82[.]79[.]254:1234/dot[.]gif hxxp://52[.]13[.]83[.]52/zOMGAPT hxxps://46[.]4[.]10[.]187/visit[.]js hxxp://100[.]42[.]64[.]104/j[.]ad hxxp://45[.]137[.]10[.]60:8080/g[.]pixel hxxp://120[.]78[.]151[.]171/cx hxxp://124[.]220[.]180[.]202:30001/dpixel hxxp://101[.]43[.]103[.]253/dpixel hxxp://43[.]136[.]27[.]234/push hxxps://43[.]136[.]27[.]234/ga[.]js hxxps://124[.]221[.]126[.]235:9999/ptj hxxps://3[.]216[.]88[.]182/match hxxp://47[.]99[.]171[.]179:6000/__utm[.]gif hxxp://42[.]193[.]108[.]198:9000/push hxxp://104[.]168[.]54[.]203:8089/cx hxxp://182[.]92[.]70[.]43:4567/g[.]pixel hxxps://45[.]207[.]27[.]31:8443/updates[.]rss hxxp://124[.]220[.]215[.]247/pixel[.]gif hxxps://121[.]43[.]35[.]47/updates hxxp://182[.]92[.]131[.]14:8888/dot[.]gif hxxp://54[.]183[.]172[.]133/j[.]ad hxxp://139[.]159[.]203[.]44:8001/IE9CompatViewList[.]xml hxxp://43[.]207[.]191[.]238:8456/MicrosoftUpdate/ShellEx/KB242742/default[.]aspx hxxp://45[.]76[.]33[.]111/dpixel hxxp://106[.]75[.]215[.]25:8089/dot[.]gif hxxps://43[.]138[.]154[.]3:6443/cm hxxps://185[.]243[.]113[.]173:8080/put/util/AXXRV7P4 hxxps://xisowah[.]info:8080/put/util/AXXRV7P4 hxxp://021[.]qaxno1[.]ml:2083/poll hxxps://119[.]45[.]11[.]236/jquery-3[.]3[.]1[.]min[.]js hxxp://162[.]14[.]81[.]81:9999/IE9CompatViewList[.]xml hxxp://81[.]68[.]241[.]8:7777/j[.]ad hxxp://217[.]195[.]153[.]169/match hxxps://101[.]34[.]214[.]82/www/handle/doc hxxp://152[.]89[.]198[.]29/__utm[.]gif hxxps://152[.]89[.]198[.]29/load hxxp://176[.]113[.]115[.]145/ca hxxp://43[.]154[.]14[.]120:25001/jquery-3[.]3[.]1[.]min[.]js hxxps://47[.]113[.]151[.]138/cm hxxp://47[.]108[.]137[.]190:50050/ga[.]js hxxp://81[.]68[.]241[.]8:8087/g[.]pixel hxxps://101[.]35[.]233[.]204/ptj hxxp://120[.]46[.]210[.]49:88/updates[.]rss hxxp://www[.]micorsoft[.]xyz:8080/g[.]pixel hxxp://106[.]75[.]245[.]100/load hxxp://114[.]115[.]160[.]181:802/preload hxxp://106[.]54[.]181[.]10:808/updates[.]rss hxxps://124[.]222[.]25[.]251/owa/ hxxps://18[.]224[.]165[.]207/__utm[.]gif hxxp://23[.]105[.]202[.]225:8000/cx hxxp://47[.]243[.]85[.]106:1111/zOMGAPT hxxps://43[.]142[.]165[.]143/clemente/details hxxp://107[.]148[.]62[.]239/image/ hxxp://170[.]130[.]165[.]159/jquery-3[.]3[.]1[.]min[.]js hxxp://fashion4everyone[.]biz/Disable/fileadmin/GC2W8LORKCTB hxxp://sport-program[.]com/Disable/fileadmin/GC2W8LORKCTB hxxp://139[.]59[.]102[.]49:1111/g[.]pixel hxxps://170[.]130[.]165[.]159/jquery-3[.]3[.]1[.]min[.]js hxxp://46[.]21[.]153[.]161/design/query/9X5M3SOE0F hxxp://103[.]193[.]189[.]251:1433/suggest hxxp://82[.]156[.]157[.]156:7005/IE9CompatViewList[.]xml hxxps://47[.]243[.]85[.]106:2222/zOMGAPT hxxp://3[.]93[.]213[.]179/__utm[.]gif hxxp://175[.]178[.]35[.]25:9999/load hxxp://167[.]179[.]102[.]109:9876/j[.]ad hxxps://kufufeyu[.]org/RELEASE_NOTES[.]html hxxp://124[.]221[.]183[.]95:6666/match hxxp://43[.]142[.]175[.]45:88/jquery-3[.]3[.]1[.]min[.]js hxxps://120[.]48[.]116[.]48:2443/cm hxxp://182[.]92[.]207[.]125:10010/updates[.]rss hxxp://165[.]154[.]161[.]150:3000/cm hxxp://124[.]221[.]236[.]95:8888/IE9CompatViewList[.]xml hxxp://windows-tech-support[.]su/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books |
Cobalt Strike |
| URL | hxxp://87[.]121[.]47[.]63/lend/gold123[.]exe hxxp://87[.]121[.]47[.]63/lend/post[.]exe hxxp://194[.]169[.]175[.]136:3003/file[.]exe hxxp://87[.]121[.]47[.]63/lend/sk[.]exe hxxp://194[.]169[.]175[.]138:3002/file[.]exe hxxps://malicious[.]ozkanburgac[.]com/file[.]exe hxxp://45[.]15[.]159[.]69/ros[.]exe |
RedLine Stealer |
| URL | hxxp://fexstat257[.]xyz/mtx111[.]exe hxxp://cexsad917[.]xyz/mtx111[.]exe |
Phobos |
| URL | hxxp://skicloud-my[.]xyz/c2sock hxxp://fastcloudlife-my[.]xyz/c2sock hxxp://crazypictures[.]xyz/c2sock hxxp://worldofpoetry[.]xyz/c2sock hxxp://many-verses[.]xyz/c2sock hxxp://stoppublick[.]xyz/c2sock |
Lumma Stealer |
| URL | hxxp://123[.]60[.]18[.]108:30443/react[.]production[.]min[.]js | Metasploit |
| URL | hxxp://escort[.]in[.]ua/axasxcdsvsdcpony/gate[.]php | Pony |
| URL | hxxp://117[.]207[.]228[.]73:50049/Mozi[.]m hxxp://117[.]212[.]168[.]216:46590/Mozi[.]m |
Mozi |
| URL | hxxp://91[.]199[.]147[.]95/stilak64[.]rar hxxp://91[.]199[.]147[.]95/stilak32[.]rar hxxp://91[.]199[.]147[.]95/cook64[.]rar hxxp://91[.]199[.]147[.]95/vnc64[.]rar hxxp://91[.]199[.]147[.]95/cook32[.]rar hxxp://91[.]199[.]147[.]95/vnc32[.]rar |
Gozi |
| URL | hxxp://85[.]192[.]40[.]209/deliver[.]exe | Coinminer |
| URL | hxxp://87[.]121[.]47[.]63/lend/deep[.]exe hxxp://116[.]62[.]11[.]90/main[.]exe |
AsyncRAT |
| URL | hxxp://45[.]12[.]253[.]98/setupsetup[.]php hxxp://45[.]9[.]74[.]80/new/setup[.]exe |
GCleaner |
| URL | hxxp://37[.]44[.]238[.]203/nekoY/Neko[.]sh4 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]ppc hxxp://209[.]25[.]141[.]223:18247/rebirth[.]arm4 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]m68 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]i686 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]spc hxxp://209[.]25[.]141[.]223:18247/rebirth[.]sh4 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]arm5 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]arm6 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]x86 hxxp://209[.]25[.]141[.]223:18247/rebirth[.]mips hxxp://209[.]25[.]141[.]223:18247/rebirth[.]mpsl hxxp://5[.]249[.]161[.]98/x86 hxxp://5[.]249[.]161[.]98/armv6l hxxp://5[.]249[.]161[.]98/i686 hxxp://5[.]249[.]161[.]98/sh4 hxxp://5[.]249[.]161[.]98/i586 hxxp://5[.]249[.]161[.]98/sparc hxxp://5[.]249[.]161[.]98/armv5l hxxp://5[.]249[.]161[.]98/armv4l hxxp://5[.]249[.]161[.]98/mipsel hxxp://5[.]249[.]161[.]98/mips |
Bashlite |
| URL | hxxp://24[.]199[.]83[.]51/userinit2[.]exe hxxp://24[.]199[.]83[.]51/winslvobf[.]exe hxxp://24[.]199[.]83[.]51/userinit4[.]exe hxxp://24[.]199[.]83[.]51/userinit1[.]exe hxxp://24[.]199[.]83[.]51/userinit3[.]exe hxxp://24[.]199[.]83[.]51/userinit[.]exe |
Meterpreter |
| URL | hxxp://77[.]91[.]124[.]31/smo/an[.]exe hxxp://149[.]50[.]129[.]58/rofl[.]exe |
Rhadamanthys |
| URL | hxxp://45[.]9[.]74[.]80/new/3eef203fb515bda85f514e168abb5973[.]exe | Glupteba |
| URL | hxxp://45[.]132[.]18[.]133/DbPublic/Wplongpoll5/85Temp/0sqlDump/wordpress/Flower3public8/javascriptServer/Dumpphp/providerPhp/PythonExternal9/EternalWppublic/Multi5Server/sqlVmAsyncLine/6Packet20/Poll/phpSecureUniversaldle/test/3asyncUpdate1/ProcessorgameMultidb[.]php | DCRat |
| URL | hxxp://bll1l[.]shop/Bll1l/index[.]php hxxp://b1ll2[.]shop/B1ll2/index[.]php |
Azorult |
| URL | hxxp://103[.]131[.]56[.]71/Desktop/csrssfs[.]exe hxxp://87[.]121[.]221[.]212/sp[.]exe |
DBatLoader |
| URL | hxxps://zensoft[.]store/ZenSoft[.]rar | Zen |
| URL | hxxp://ethre3vs[.]top/zip[.]php | CryptBot |
| URL | hxxp://headsity[.]com/list[.]php | Konni |
| URL | hxxp://185[.]209[.]161[.]89/bot/regex | Laplas |
