不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2023/08/21
※2023/08/21 更新
マルウェア感染させると考えられるURLを検知（2023/08/21）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://192[.]3[.]223[.]26/380/isHost[.]exe hxxp://192[.]3[.]223[.]26/280/ChromeSetup[.]exe hxxp://94[.]156[.]161[.]167/tl/er33[.]txt hxxp://94[.]156[.]161[.]167/EHJ[.]vbs |
Agent Tesla |
| URL | hxxp://94[.]228[.]169[.]55/7baff47bec0ff5db[.]php hxxp://81[.]19[.]137[.]220/72e62e029dc81ebf[.]php hxxp://industrias-lopez[.]com/2/data64_3[.]exe |
Stealc |
| URL | hxxp://94[.]228[.]126[.]154/LongpollBetterprotect/server01image/linevoiddbProtect/Wordpress3/Privatesecurehxxp/secure/Game77Test/Trafficgeo/dbwp[.]php hxxp://62[.]109[.]13[.]186/default3updateprovider/windows/Video5Wp/Sqltemp2linux/7server/WindowsLowEternal/test5/vmflowerTemporary[.]php hxxp://5[.]42[.]77[.]211/hxxp/Proton/CdnWordpressdatalife/dleTestUploads/protect1DleLine/ProcessorLineProton/Eternallongpollgenerator/cdn5/EternalpipePythonAsynctraffic[.]php hxxp://95[.]217[.]3[.]189/Db/4/eternalVoiddb/Js/Serverdb/4/sql/_Private37/Update2Vmdefault/1dbTrack/Bigloadexternal/packet/eternalUploads/4cpu/PythonBase/cpuflowerpubliccdnDownloads[.]php hxxp://45[.]61[.]188[.]238/_downloads[.]php hxxp://185[.]189[.]181[.]87/processlinux[.]php hxxp://51[.]38[.]163[.]64/javascriptAuthdbLocaltemporary[.]php |
DCRat |
| URL | hxxps://postegro-lili[.]site/postegro[.]apk | Anubis |
| URL | hxxps://jvhzs[.]photo[.]beyoudcor[.]com/editContent hxxps://acecc[.]photo[.]beyoudcor[.]com/editContent hxxps://ywaaj[.]photo[.]beyoudcor[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://78[.]47[.]72[.]178:27002/files[.]zip hxxp://135[.]148[.]76[.]83/kopa[.]zip hxxp://65[.]21[.]252[.]46/sometwoadasy[.]zip hxxp://65[.]21[.]187[.]146/files[.]zip hxxp://94[.]130[.]190[.]4:8080/pack[.]zip hxxp://79[.]137[.]204[.]77/book[.]zip hxxp://116[.]203[.]42[.]123/upgrade[.]zip hxxp://5[.]75[.]171[.]168:27002/files[.]zip hxxp://128[.]140[.]45[.]45/get[.]zip hxxp://195[.]201[.]45[.]115/pack[.]zip hxxp://116[.]203[.]166[.]240:27015/forum[.]zip hxxp://37[.]27[.]11[.]1/forum[.]zip hxxp://116[.]203[.]165[.]166:27002/files[.]zip hxxp://213[.]142[.]147[.]139/newund[.]zip hxxp://5[.]75[.]214[.]16:12771/pack[.]zip hxxp://95[.]217[.]28[.]234/forum[.]zip hxxp://176[.]31[.]25[.]213/gipica[.]zip hxxp://146[.]70[.]169[.]174/update10[.]zip hxxp://95[.]216[.]183[.]42/pack[.]zip hxxp://95[.]217[.]241[.]202/files[.]zip hxxp://95[.]217[.]246[.]133/pack[.]zip hxxp://116[.]203[.]9[.]153/files[.]zip hxxp://95[.]217[.]242[.]246/files[.]zip hxxp://116[.]203[.]42[.]123/update[.]zip hxxp://5[.]75[.]211[.]220/pack[.]zip hxxp://116[.]203[.]42[.]123/install[.]zip hxxp://49[.]13[.]27[.]53/elosx[.]zip hxxp://195[.]201[.]47[.]241:8080/pack[.]zip hxxp://195[.]201[.]251[.]182:27015/forum[.]zip hxxp://159[.]69[.]198[.]239:27015/forum[.]zip hxxp://5[.]75[.]211[.]155/files[.]zip hxxp://135[.]181[.]46[.]141/someoneadasylf[.]zip hxxp://116[.]202[.]177[.]109/upgrade[.]zip |
Vidar |
| URL | hxxp://23[.]224[.]61[.]90:6666/dpixel hxxps://101[.]32[.]72[.]240/split/d/7473220OP hxxp://36[.]139[.]116[.]199:1234/en_US/all[.]js hxxps://140[.]143[.]147[.]47/fwlink hxxps://43[.]140[.]195[.]36/ga[.]js hxxps://43[.]142[.]153[.]249:9443/en_US/all[.]js hxxp://103[.]234[.]72[.]107/fwlink hxxps://205[.]164[.]28[.]147/ca hxxps://104[.]248[.]242[.]202/cm hxxps://149[.]129[.]72[.]37:8444/j[.]ad hxxps://support[.]dnsgdn[.]com/d/msdownload/update/others/2022/09/32561369_ hxxps://173[.]249[.]201[.]243/cx hxxps://117[.]25[.]130[.]94/updates[.]rss hxxp://162[.]14[.]81[.]81:8099/ca hxxps://8[.]142[.]117[.]220/cx hxxps://8[.]219[.]88[.]106:32443/Compare/v2[.]66/G6EBS8VJR0 hxxps://bova[.]fyi:2083/wp08/wp-includes/dtcla[.]php hxxps://gk-stst[.]ru:5000/jquery-3[.]3[.]1[.]min[.]js hxxp://104[.]248[.]242[.]202:8081/pixel hxxp://23[.]106[.]215[.]7/load hxxp://173[.]249[.]201[.]243:88/dpixel hxxps://36[.]139[.]116[.]199:4444/__utm[.]gif hxxps://67[.]207[.]69[.]42/Dev/v4[.]67/JU4JKUQ7W86 hxxp://175[.]178[.]90[.]192:8081/visit[.]js hxxp://175[.]178[.]90[.]192:6605/pixel hxxp://206[.]238[.]42[.]198/pixel[.]gif hxxp://124[.]223[.]28[.]25:8886/__utm[.]gif hxxp://47[.]104[.]239[.]124:7788/en_US/all[.]js hxxp://198[.]211[.]32[.]231/include/template/isx[.]php hxxps://172[.]233[.]195[.]99/dpixel hxxps://118[.]195[.]137[.]246:9001/static/mancard/img/qrcode_download_john[.]png hxxp://124[.]221[.]123[.]55:8883/Demonstrate/v6[.]59/2CKKGMNXTZM hxxp://175[.]178[.]90[.]192:6604/__utm[.]gif hxxps://1[.]13[.]17[.]173:2020/fwlink hxxp://101[.]42[.]254[.]219:5656/IE9CompatViewList[.]xml hxxp://47[.]104[.]239[.]124:8899/IE9CompatViewList[.]xml hxxp://203[.]56[.]121[.]86:5678/en_US/all[.]js hxxp://175[.]178[.]90[.]192:6603/en_US/all[.]js hxxps://47[.]75[.]108[.]68:2022/IE9CompatViewList[.]xml hxxps://85[.]206[.]172[.]192/fwlink hxxp://42[.]51[.]40[.]232:9999/__utm[.]gif hxxp://67[.]207[.]93[.]135/metro91/admin/1/ppptp[.]jpg hxxps://124[.]222[.]173[.]69/fwlink hxxp://20[.]106[.]253[.]207:4455/dot[.]gif hxxp://129[.]226[.]92[.]29/j[.]ad hxxps://y1[.]changbaishanlab[.]top:2053/api/3 hxxps://172[.]233[.]195[.]99:4433/__utm[.]gif hxxps://138[.]197[.]47[.]152/IE9CompatViewList[.]xml hxxp://123[.]207[.]5[.]159:89/updates[.]rss hxxps://116[.]198[.]11[.]22/cx hxxps://149[.]129[.]72[.]37:8444/push hxxp://49[.]233[.]103[.]218:5566/cm hxxp://94[.]156[.]253[.]25/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://167[.]99[.]246[.]113/cx hxxp://139[.]59[.]139[.]136:8888/dot[.]gif hxxps://cs45tx230726[.]gamesmetaa[.]com:2083/pixel[.]gif hxxps://167[.]99[.]246[.]113:31443/cm hxxp://8[.]142[.]134[.]43:8080/j[.]ad hxxp://39[.]105[.]223[.]243:6666/en_US/all[.]js hxxps://111[.]92[.]241[.]196:8088/IE9CompatViewList[.]xml hxxps://cs45up230808[.]iqiyia[.]com:2053/dpixel hxxp://111[.]92[.]241[.]196:8089/dpixel hxxps://23[.]95[.]107[.]200:4444/dot[.]gif hxxps://117[.]25[.]130[.]94/load hxxp://123[.]56[.]128[.]182/updates[.]rss hxxps://47[.]120[.]11[.]176/dot[.]gif hxxps://8[.]142[.]134[.]43/updates[.]rss hxxps://risky[.]dlingqling[.]cf:34690/activity hxxps://64[.]176[.]39[.]153/jquery-3[.]3[.]1[.]min[.]js hxxp://websystemdisk[.]com:8080/aa[.]js hxxps://121[.]40[.]119[.]94:8443/pixel[.]gif hxxps://7w[.]lv:8443/updates[.]rss hxxps://123[.]253[.]227[.]74/pixel[.]gif hxxp://45[.]76[.]179[.]63:443/jquery-3[.]3[.]1[.]min[.]js hxxps://app[.]ethvseos[.]nl:2096/jquery-3[.]3[.]1[.]min[.]js hxxps://206[.]119[.]179[.]88/cx |
Cobalt Strike |
| URL | hxxp://drep[.]space/D1122334 | AVrecon |
| URL | hxxps://worldbestscanip[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://worldbestipscan[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://worldscanbestip[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://worldscanipbest[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://bestworldscanip[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://bestipworldscan[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://scanbestworldip[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://newfastcheckdns[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://newfastdnscheck[.]xyz/NmE0N2YwOWEzMTM3/ hxxps://dnsfastcheckall[.]xyz/NmE0N2YwOWEzMTM3/ |
Coper |
| URL | hxxp://194[.]55[.]224[.]11/sirR/five/fre[.]php | LokiBot |
| URL | hxxp://193[.]233[.]255[.]9/lend/nuIex_crypted[.]exe hxxp://193[.]233[.]255[.]9/lend/Al[.]exe hxxp://45[.]9[.]74[.]80/1808tui[.]exe hxxp://79[.]137[.]192[.]18/1808tui[.]exe hxxp://industrias-lopez[.]com/2/data64_1[.]exe |
RedLine Stealer |
| URL | hxxps://freeintalk[.]com/go[.]php | GootLoader |
| URL | hxxp://zzz[.]alie3ksgdd[.]com/m/okka25[.]exe hxxps://zzz[.]alie3ksgdd[.]com/m/okka25[.]exe |
Fabookie |
| URL | hxxp://193[.]233[.]255[.]9/lend/Setup2potok[.]exe hxxp://193[.]233[.]255[.]9/lend/456[.]exe |
Lumma Stealer |
| URL | hxxp://45[.]15[.]158[.]124/kinsing hxxp://45[.]15[.]158[.]124/kinsing_aarch64 |
Kinsing |
| URL | hxxp://vms[.]h4ck0ps[.]cc:8181/lLCGJlVNxPkoOSk4TOsBzgZtRiWWm hxxp://vms[.]h4ck0ps[.]cc:8181/backdoor_for_pdf[.]exe |
Metasploit |
| URL | hxxps://www[.]medichiccenter[.]com/wp-content/plugins/polylang/include/agezdv[.]exe | Rhadamanthys |
| URL | hxxp://taibi[.]at/tmp/ hxxp://mal-net[.]com/tmp/ hxxp://gromograd[.]ru/tmp/ hxxp://01stroy[.]ru/tmp/ hxxps://www[.]medichiccenter[.]com/RuntimeBroker[.]exe hxxp://193[.]233[.]255[.]9/lend/RuntimeBrokersidedark2[.]exe |
SmokeLoader |
| URL | hxxps://montec-shop[.]de/images/headers/enlc-stb(download(upd))ef[.]url hxxps://montec-shop[.]de/images/extensiontemper[.]zip hxxps://montec-shop[.]de/images/client32[.]exe hxxp://94[.]156[.]253[.]17/Downloads/careabout[.]hta |
NetSupportManager RAT |
| URL | hxxps://site1[.]ebl-ir[.]org/adl[.]apk hxxps://tuoi[.]site/kheybar/log[.]php hxxps://tuoi[.]site/kheybar/web[.]txt hxxps://tuoi[.]site/kheybar hxxps://toapptosh[.]ebl-ir[.]org/cart[.]php hxxps://toapptosh[.]ebl-ir[.]org/app[.]php hxxps://site12[.]ebl-ir[.]org/adl[.]apk hxxps://site11[.]ebl-ir[.]org/adl[.]apk hxxps://site9[.]ebl-ir[.]org/adl[.]apk hxxps://site10[.]ebl-ir[.]org/adl[.]apk hxxps://site7[.]ebl-ir[.]org/adl[.]apk hxxps://site8[.]ebl-ir[.]org/adl[.]apk hxxps://site6[.]ebl-ir[.]org/adl[.]apk hxxps://site3[.]ebl-ir[.]org/adl[.]apk hxxps://site4[.]ebl-ir[.]org/adl[.]apk hxxps://site5[.]ebl-ir[.]org/adl[.]apk hxxps://site2[.]ebl-ir[.]org/adl[.]apk hxxps://site13[.]ebl-ir[.]org/adl[.]apk hxxps://site14[.]ebl-ir[.]org/adl[.]apk hxxps://site15[.]ebl-ir[.]org/adl[.]apk hxxps://site16[.]ebl-ir[.]org/adl[.]apk hxxps://site17[.]ebl-ir[.]org/adl[.]apk hxxps://site18[.]ebl-ir[.]org/adl[.]apk hxxps://site19[.]ebl-ir[.]org/adl[.]apk hxxps://site20[.]ebl-ir[.]org/adl[.]apk hxxps://panel1[.]iran-pspcoi[.]info/adl[.]apk hxxps://panel2[.]iran-pspcoi[.]info/adl[.]apk hxxps://panel3[.]iran-pspcoi[.]info/adl[.]apk hxxps://tproject[.]cloud/last[.]php |
IRATA |
| URL | hxxp://192[.]210[.]175[.]4/Quotation/00O0o0O0o0O0o0O0o0o0000o0Oo0o0o00O00000o000000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300000000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300000000000[.]dOC hxxp://192[.]210[.]175[.]4/0070/igfxEM[.]exe |
Remcos |
| URL | hxxp://vms[.]h4ck0ps[.]cc:8181/final_pshnet_revhxxps[.]ps1 | Meterpreter |
