不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様7社 -
2023/08/10
※2023/08/10 更新
マルウェア感染させると考えられるURLを検知（2023/08/10）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://103[.]37[.]60[.]36/data/loki[.]exe hxxp://194[.]55[.]224[.]15/kelly/five/fre[.]php hxxp://2[.]59[.]254[.]18/_errorpages/kellyzx[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/kellyzx[.]doc hxxp://79[.]110[.]48[.]215/thirdugo/five/fre[.]php hxxp://103[.]29[.]3[.]236/T088W/smss[.]exe hxxp://79[.]110[.]48[.]215/sid/five/fre[.]php |
LokiBot |
| URL | hxxps://game-cheat[.]net/MinerFullDetect[.]exe | Coinminer |
| URL | hxxp://858925lm[.]nyashtyan[.]top/hxxppacketserverprotectdownloads[.]php hxxp://212[.]109[.]195[.]187/PollupdateprocessorAsyncDatalife[.]php hxxp://82[.]146[.]52[.]24/2/db42/basehxxpSql/ProcessVm/Eternal7/downloadsPoll/better/dle6auth/3default/Vm/1pollCdn/Default/DlelowWordpress/Async4Traffic0/VideogeoCpulocalCdn[.]php hxxp://188[.]120[.]242[.]207/Php/Multiflower/poll/CdnSecurePacket/Protongeo3Auth/VmVm5Local/6Line1/6Externalauth/EternalSecure7Test/8/Generatortraffictest/WpdlePrivate/GameCpu/hxxpsqlwpcentral[.]php |
DCRat |
| URL | hxxp://150[.]158[.]212[.]71:9091/loader[.]hta hxxp://150[.]158[.]212[.]71:9091/LogonFile[.]exe hxxp://119[.]91[.]65[.]79:7002/ptj hxxp://3[.]98[.]128[.]3/cm hxxp://34[.]125[.]1[.]141:4444/fwlink hxxp://45[.]77[.]247[.]144:8088/IE9CompatViewList[.]xml hxxp://60[.]204[.]139[.]246/match hxxp://43[.]137[.]41[.]57/ga[.]js hxxp://103[.]146[.]231[.]32:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://111[.]229[.]88[.]185:8081/ga[.]js hxxps://106[.]54[.]168[.]113/g[.]pixel hxxp://62[.]234[.]3[.]193:10240/j[.]ad hxxp://20[.]83[.]148[.]22:5000/preload hxxps://43[.]143[.]221[.]53:6666/activity hxxps://www[.]upgrad3[.]cc:2022/visit[.]js hxxp://101[.]43[.]248[.]36:7101/j[.]ad hxxp://103[.]30[.]43[.]148:4500/ptj hxxp://43[.]143[.]47[.]110:3334/j[.]ad hxxp://150[.]158[.]212[.]71/updates[.]rss hxxp://150[.]158[.]212[.]71/DZqN hxxps://43[.]143[.]47[.]110:3333/ca hxxp://101[.]43[.]15[.]142/activity hxxps://3[.]98[.]128[.]3/cx hxxps://139[.]59[.]102[.]49:1222/__utm[.]gif hxxp://216[.]83[.]48[.]71:8080/UdLX hxxp://13[.]231[.]210[.]125:8081/push hxxp://118[.]195[.]157[.]85/fwlink hxxps://82[.]157[.]7[.]213/match hxxps://99avip[.]online/c/msdownload/update/others/2016/12/29136388_ hxxps://103[.]238[.]225[.]181/dot[.]gif hxxp://47[.]95[.]221[.]112/jquery-3[.]3[.]1[.]min[.]js hxxps://116[.]198[.]18[.]134/__utm[.]gif hxxps://jtexpress[.]life:8443/dpixel |
Cobalt Strike |
| URL | hxxps://winetourism[.]co[.]za/wp-content/uploads/temp/settings/en-win-upd(localchr)[.]url hxxps://winetourism[.]co[.]za/wp-content/uploads/temp/importance-x[.]hta hxxp://94[.]156[.]6[.]203/Downloads/revenue-en-local[.]lnk hxxps://billdeckhart[.]com/wp-content/uploads/revslider/objects/independencest[.]zip hxxps://www[.]heckelmann[.]info/wp-content/uploads/montezuma/thumb/images/download-EN(local-upd)[.]url hxxps://www[.]heckelmann[.]info/wp-content/uploads/montezuma/thumb/independence[.]hta hxxps://www[.]heckelmann[.]info/wp-content/uploads/montezuma/imaginationset[.]zip hxxp://94[.]156[.]6[.]203/Downloads/personality-upd[.]lnk |
NetSupportManager RAT |
| URL | hxxp://2[.]59[.]254[.]18/_errorpages/alertzx[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/smokeyzx[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/damianozx[.]exe hxxps://sandiisells[.]com/chkyy2[.]txt hxxp://2[.]59[.]254[.]18/_errorpages/logszx[.]exe hxxp://2[.]59[.]254[.]18/_errorpages/alertzx[.]doc hxxp://2[.]59[.]254[.]18/_errorpages/damianozx[.]doc hxxp://80[.]76[.]51[.]248/kwen[.]vbs hxxp://185[.]225[.]75[.]194/nn[.]txt hxxp://94[.]156[.]161[.]167/HYY[.]vbs hxxp://80[.]76[.]51[.]248/abyx[.]vbs hxxp://80[.]76[.]51[.]248/nbvzfip[.]txt hxxps://pilkishop[.]ru/images[.]exe hxxp://185[.]225[.]75[.]194/new/mosa[.]exe |
Agent Tesla |
| URL | hxxp://vapdelivery[.]com[.]br/sass/bootstrap/mixins/authorize[.]exe hxxps://fetchdesignprint[.]co[.]za/wp-content/themes/twentytwenty/html[.]exe hxxps://laguna[.]alicia-gutierrez[.]com/wp-content/plugins/js_composer/include/params/vc_grid_item/editor/navbar/index[.]exe hxxps://dienmay01[.]maudemo[.]com/wp/wp-content/plugins/invoicing/vendor/ayecode/wp-super-duper/icons/defense[.]exe |
Parallax RAT |
| URL | hxxp://inkpressivedesigns[.]co[.]za/socgx64[.]dll hxxp://walleyewanderers[.]ca/somn64win[.]dll |
SystemBC |
| URL | hxxp://earthqik[.]website/Amday_soft[.]exe hxxp://bejenaru-studio[.]ro/a3e34cp[.]exe hxxp://amaad100[.]com/gBcskbwWs/index[.]php |
Amadey |
| URL | hxxp://80[.]76[.]51[.]180/I686 hxxp://80[.]76[.]51[.]180/SPARC hxxp://80[.]76[.]51[.]180/SH4 hxxp://80[.]76[.]51[.]180/I586 hxxp://80[.]76[.]51[.]180/M68K hxxp://37[.]44[.]238[.]213/nekoY/Neko[.]spc |
Bashlite |
| URL | hxxp://194[.]55[.]224[.]13/_errorpages/rovezx[.]doc hxxp://194[.]55[.]224[.]13/_errorpages/rove[.]exe hxxp://www[.]delta-hydraulic[.]com/img/ljnFAVyZDtA12[.]bin |
CloudEyE |
| URL | hxxp://194[.]180[.]48[.]72/dns[.]exe | Lumma Stealer |
| URL | hxxps://hair-med[.]com[.]pl/go[.]php hxxps://ffsimv[.]gr/go[.]php |
GootLoader |
| URL | hxxp://91[.]103[.]253[.]50/e9131e1df8a3fa06[.]php hxxp://91[.]103[.]253[.]50/d06356dd8482ebb2/nss3[.]dll hxxp://91[.]103[.]253[.]50/d06356dd8482ebb2/sqlite3[.]dll hxxp://91[.]103[.]253[.]50/d06356dd8482ebb2/freebl3[.]dll hxxp://91[.]103[.]253[.]50/d06356dd8482ebb2/mozglue[.]dll hxxp://91[.]103[.]253[.]50/d06356dd8482ebb2/softokn3[.]dll hxxp://91[.]103[.]253[.]50/d06356dd8482ebb2/msvcp140[.]dll hxxp://91[.]103[.]253[.]50/d06356dd8482ebb2/vcruntime140[.]dll |
Stealc |
| URL | hxxps://sguqd[.]excluded[.]everyadpaysmefirst[.]com/editContent hxxps://bfwy[.]excluded[.]everyadpaysmefirst[.]com/editContent hxxps://mfu[.]excluded[.]everyadpaysmefirst[.]com/editContent hxxps://bluegaslamp[.]org/V4CHvFq8 |
FAKEUPDATES |
| URL | hxxp://52[.]197[.]196[.]22/x/irq0 hxxp://52[.]197[.]196[.]22/x/irq2 hxxp://52[.]197[.]196[.]22/x/irq1 hxxp://52[.]197[.]196[.]22/x/pty |
Tsunami |
| URL | hxxp://sszteell[.]com/dgfhgfdtxxdzsregdfc/Fnkukgpygdf hxxp://179[.]43[.]175[.]187/olmx/pay[.]exe |
Remcos |
| URL | hxxp://192[.]3[.]193[.]171/400/WmiPrvSE[.]exe | Formbook |
| URL | hxxp://de4mon-p4nel[.]site/oski//7[.]jpg hxxp://de4mon-p4nel[.]site/oski//4[.]jpg hxxp://de4mon-p4nel[.]site/oski//5[.]jpg hxxp://de4mon-p4nel[.]site/oski//3[.]jpg hxxp://de4mon-p4nel[.]site/oski//1[.]jpg hxxp://de4mon-p4nel[.]site/oski//2[.]jpg hxxp://de4mon-p4nel[.]site/oski//6[.]jpg |
Oski Stealer |
| URL | hxxp://udag[.]cc/D1122334 hxxp://zerophone[.]cc/lumi/fmw[.]php |
AVrecon |
