不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/08/03
※2023/08/03 更新
マルウェア感染させると考えられるURLを検知（2023/08/03）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://23[.]94[.]148[.]51/680/IE_Netcape[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/obizx[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/obizx[.]doc hxxp://23[.]95[.]122[.]94/450/IB_iso[.]exe |
Formbook |
| URL | hxxp://216[.]128[.]145[.]196/~wellseconds/?p=817152758105 hxxp://216[.]128[.]145[.]196/~wellseconds/?p=5809290034477 hxxp://194[.]55[.]224[.]15/blair/five/fre[.]php |
LokiBot |
| URL | hxxp://94[.]131[.]101[.]77/83267a2bd0c9f748/msvcp140[.]dll hxxp://94[.]131[.]101[.]77/83267a2bd0c9f748/nss3[.]dll hxxp://94[.]131[.]101[.]77/83267a2bd0c9f748/mozglue[.]dll hxxp://94[.]131[.]101[.]77/83267a2bd0c9f748/freebl3[.]dll hxxp://94[.]131[.]101[.]77/83267a2bd0c9f748/vcruntime140[.]dll hxxp://94[.]131[.]101[.]77/83267a2bd0c9f748/softokn3[.]dll hxxp://94[.]131[.]101[.]77/83267a2bd0c9f748/sqlite3[.]dll hxxp://77[.]91[.]97[.]18/1c80d1b40e06f613[.]php |
Stealc |
| URL | hxxp://102[.]33[.]80[.]111:50264/Mozi[.]m | Mozi |
| URL | hxxp://94[.]156[.]6[.]203/Downloads/local-EN-version105[.]lnk hxxps://www[.]barclayledsolutions[.]com/wp-content/uploads/2023/04/junker[.]hta |
FAKEUPDATES |
| URL | hxxps://www[.]barclayledsolutions[.]com/wp-content/uploads/2023/02/client32[.]exe hxxps://www[.]barclayledsolutions[.]com/wp-content/uploads/2023/02/VideoCapturer[.]zip hxxps://magydostravel[.]com/cdn/91c818ee6e9ec29f8c1[.]php hxxps://mangoairsoft[.]com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/lolo[.]7z hxxps://mangoairsoft[.]com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/22[.]bat hxxps://mangoairsoft[.]com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/11[.]bat |
NetSupportManager RAT |
| URL | hxxp://2[.]59[.]254[.]18/_errorpages/texaszx[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/texaszx[.]doc hxxp://2[.]59[.]254[.]18/_errorpages/lawzx[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/lawzx[.]doc hxxp://80[.]76[.]51[.]248/kngeeog[.]txt hxxp://80[.]76[.]51[.]248/mynes[.]txt hxxp://195[.]178[.]120[.]24/centsop[.]exe hxxp://feedeposit[.]uob[.]edu[.]pk/0TTYuKFFp2Neo[.]exe |
Agent Tesla |
| URL | hxxp://194[.]180[.]49[.]153/udp/rdpcllp[.]exe hxxp://217[.]196[.]96[.]130/conhost[.]exe |
Coinminer |
| URL | hxxp://194[.]180[.]49[.]153/udp/taskhostclp[.]exe | Laplas |
| URL | hxxp://dhanwantaridiagnostics[.]com/setup[.]dll hxxp://cat[.]lobret[.]co[.]za/sf64r[.]dll |
SystemBC |
| URL | hxxp://31[.]44[.]184[.]88/ga[.]js hxxps://31[.]44[.]184[.]88/updates[.]rss hxxps://risky[.]dlingqling[.]cf:34690/ptj hxxps://gk-stst[.]ru/jquery-3[.]3[.]1[.]min[.]js hxxps://45[.]94[.]42[.]61:8443/updates[.]rss hxxps://81[.]68[.]248[.]129/ga[.]js hxxp://206[.]238[.]42[.]198/__utm[.]gif hxxp://59[.]110[.]235[.]230:8088/match hxxps://8[.]140[.]37[.]238:9090/pixel hxxp://43[.]138[.]75[.]234:9880/fwlink hxxps://101[.]43[.]46[.]145/dpixel hxxp://114[.]115[.]150[.]139/ca hxxps://60[.]204[.]133[.]143/api/x hxxp://45[.]158[.]231[.]141:8089/j[.]ad hxxp://101[.]43[.]46[.]145:8081/fwlink hxxps://129[.]211[.]211[.]145/match hxxp://39[.]106[.]138[.]33/visit[.]js hxxps://mkbkygbgwcdc[.]buzz/api/3 hxxp://8[.]222[.]132[.]67:8000/dot[.]gif hxxp://137[.]175[.]19[.]153:8088/load hxxps://165[.]3[.]127[.]43/push hxxp://45[.]158[.]231[.]141:5000/activity hxxps://45[.]141[.]139[.]214/g[.]pixel hxxps://124[.]220[.]7[.]195/en_US/all[.]js hxxp://awesomejackson[.]zscaler[.]skytapdns[.]com:8369/dpixel hxxps://107[.]189[.]12[.]159/en_US/all[.]js hxxp://47[.]94[.]13[.]132/dot[.]gif hxxps://www[.]unbreakable[.]live/j[.]ad hxxps://117[.]18[.]13[.]220:1443/updates[.]rss hxxp://81[.]68[.]249[.]97:8090/visit[.]js hxxp://170[.]64[.]169[.]229:4433/c/msdownload/update/others/2020/10/29136388_ hxxp://shop[.]zandda[.]club:2095/c/msdownload/update/others/2020/10/29136388_ hxxp://43[.]139[.]18[.]81:7777/g[.]pixel hxxp://8[.]130[.]86[.]184/visit[.]js hxxp://103[.]234[.]72[.]187:60012/updates[.]rss hxxp://81[.]68[.]249[.]97:9001/activity hxxp://81[.]68[.]241[.]8:8087/pixel[.]gif hxxps://47[.]115[.]219[.]93:8443/__utm[.]gif hxxps://159[.]223[.]77[.]201/updates[.]rss hxxp://54[.]251[.]238[.]73/fwlink hxxp://117[.]18[.]13[.]220:8080/pixel[.]gif hxxp://116[.]204[.]81[.]202/match hxxp://45[.]94[.]42[.]61:8089/visit[.]js hxxps://8[.]140[.]37[.]238:9999/updates[.]rss hxxps://43[.]156[.]59[.]135:10443/dpixel hxxps://42[.]194[.]158[.]203:8443/www/handle/doc hxxp://8[.]130[.]75[.]152:22/fwlink hxxp://101[.]201[.]39[.]160:8080/fwlink hxxp://146[.]190[.]87[.]201:83/updates[.]rss hxxp://47[.]113[.]204[.]28:8899/visit[.]js hxxp://3[.]139[.]29[.]76/dpixel hxxp://47[.]100[.]176[.]153/pixel[.]gif hxxps://43[.]224[.]34[.]113/push hxxp://123[.]57[.]74[.]202:8888/visit[.]js hxxp://81[.]70[.]5[.]157/dpixel hxxps://163[.]197[.]217[.]251:8090/cm hxxp://122[.]51[.]97[.]82/en_US/all[.]js hxxps://45[.]77[.]10[.]192:4433/g[.]pixel hxxps://3[.]108[.]202[.]101/dot[.]gif hxxps://118[.]190[.]210[.]23/search/ hxxp://103[.]146[.]231[.]32/visit[.]js hxxps://124[.]220[.]180[.]112/en_US/all[.]js hxxps://103[.]255[.]176[.]110/updates[.]rss hxxps://tools[.]internalupdate[.]net/admin-console hxxps://apiv1[.]financialservicesnorthamerica[.]com/opensearch hxxps://mentalhealth[.]cghospital[.]org/admin-console hxxp://r1[.]dread-it[.]online/picture/slashdot/8OY5EI1E hxxps://114[.]115[.]185[.]63/activity hxxp://home[.]yangguifeiyahoo[.]shop/image/ hxxps://microsoft-bank[.]com/match hxxp://107[.]175[.]245[.]165/ga[.]js |
Cobalt Strike |
| URL | hxxp://www[.]delta-hydraulic[.]com/MnzDvrlTvUeO183[.]bin hxxp://198[.]46[.]176[.]189/670/IBS_Cortana[.]exe hxxp://103[.]6[.]248[.]9/T018W/wininit[.]exe hxxp://192[.]3[.]189[.]179/400/Regasm[.]exe |
CloudEyE |
| URL | hxxp://212[.]192[.]219[.]52/87656[.]txt hxxp://91[.]212[.]166[.]12/dll/dll[.]txt |
Remcos |
| URL | hxxp://185[.]230[.]162[.]77/mass/Excel[.]exe | DBatLoader |
| URL | hxxp://43[.]154[.]189[.]105:7093/Guendengf[.]exe | Ghost RAT |
| URL | hxxps://gazette[.]cercledeyoga[.]fr/go[.]php hxxps://gehrels[.]info/go[.]php |
GootLoader |
| URL | hxxp://49[.]236[.]208[.]231/cundi[.]x86_64 | Bashlite |
| URL | hxxp://kaatsonlinesupport[.]com/ipnd[.]php hxxp://thenewmusictunes[.]com/WVKA/qbv[.]php |
Bitter RAT |
| URL | hxxp://2[.]59[.]254[.]18/_errorpages/pablozx[.]doc hxxp://2[.]59[.]254[.]18/_errorpages/pablozx[.]exe |
Warzone RAT |
| URL | hxxp://217[.]12[.]206[.]230/c2conf hxxp://107[.]172[.]0[.]180/Payment[.]exe |
Lumma Stealer |
| URL | hxxp://erfolgsgruender[.]com/Profistiler763432_ping[.]exe | Amadey |
| URL | hxxp://185[.]81[.]114[.]175:642/moealalah[.]jpg | AsyncRAT |
| URL | hxxp://80[.]87[.]198[.]76/Pipe_mariadb/ProtectbaseCpu7/28/_image3linux/4Bettersecure/2/4/96/ProviderupdatedleTemporary[.]php hxxp://82[.]146[.]48[.]182/dumpupdate/sql45/9bigloadTempsecure/pipepoll/_ServerBase/protectDbdownloads[.]php hxxp://079471cm[.]nyashtyan[.]top/nyashsupport[.]php |
DCRat |
