不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様6社 -
2023/09/11
※2023/11/06 更新
マルウェア感染させると考えられるURLを検知（2023/09/11）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://77[.]91[.]68[.]78/lend/Setup1234[.]exe hxxp://77[.]91[.]68[.]78/lend/SusanoFortniteCheats[.]exe hxxps://topshelfcasino[.]com/1[.]jpg hxxp://77[.]91[.]68[.]78/lend/setupX[.]exe hxxps://republishnow[.]com/1[.]jpg hxxp://77[.]91[.]68[.]78/lend/crypt[.]exe hxxp://77[.]91[.]124[.]231/new/fotod345[.]exe hxxp://77[.]91[.]124[.]231/new/foto3450[.]exe hxxp://77[.]91[.]68[.]78/lend/cryptusa[.]exe hxxp://77[.]91[.]68[.]78/lend/xk555wjbvnhf3f[.]exe |
RedLine Stealer |
| URL | hxxp://77[.]91[.]68[.]52/file/lega[.]exe hxxp://xyl[.]lat/2BfwEnWXSKj6KgTm/Login[.]php hxxp://77[.]91[.]68[.]52/mac/Login[.]php hxxp://77[.]91[.]68[.]78/help/Login[.]php hxxp://79[.]110[.]62[.]80/8bmeVwqx/Login[.]php hxxp://xyl[.]lat/2BfwEnWXSKj6KgTm/index[.]php |
Amadey |
| URL | hxxp://kenman725[.]xyz/777/skxQtPN[.]exe hxxp://lexmad635[.]xyz/777/skxIkmE[.]exe |
SystemBC |
| URL | hxxps://embutidoskami[.]sdb[.]bo/wp-content/uploads/2015/05/client32[.]exe hxxps://embutidoskami[.]sdb[.]bo/wp-content/uploads/wpforms/cache/client(V106[.]215[.]441-upd)[.]url hxxp://80[.]76[.]51[.]250/Downloads/client_upd[.]lnk hxxps://embutidoskami[.]sdb[.]bo/wp-content/uploads/2015/06/HDDREQ[.]hta hxxps://embutidoskami[.]sdb[.]bo/wp-content/uploads/2015/05/LocalEditor[.]zip hxxps://invertirenmercados[.]com/1[.]php hxxps://invertirenmercados[.]com/1[.]php?954727 hxxps://invertirenmercados[.]com/1[.]php?819472 hxxps://invertirenmercados[.]com/1[.]php?352217 hxxps://invertirenmercados[.]com/1[.]php?847355 hxxps://invertirenmercados[.]com/1[.]php?1487244 hxxps://invertirenmercados[.]com/1[.]php?225501 hxxps://invertirenmercados[.]com/1[.]php?1103138 hxxps://invertirenmercados[.]com/1[.]php?61136 hxxps://invertirenmercados[.]com/1[.]php?1396426 hxxps://invertirenmercados[.]com/1[.]php?1283015 hxxps://invertirenmercados[.]com/1[.]php?690192 hxxps://invertirenmercados[.]com/1[.]php?751762 hxxps://invertirenmercados[.]com/1[.]php?1323998 hxxps://invertirenmercados[.]com/1[.]php?1362798 hxxps://invertirenmercados[.]com/1[.]php?259217 hxxps://invertirenmercados[.]com/1[.]php?517391 hxxps://invertirenmercados[.]com/1[.]php?1300090 hxxps://invertirenmercados[.]com/1[.]php?284844 hxxps://invertirenmercados[.]com/1[.]php?896445 hxxps://invertirenmercados[.]com/1[.]php?228618 |
NetSupportManager RAT |
| URL | hxxps://heldenfutter[.]de/blog[.]php hxxps://heartwoodproperties[.]com/blog[.]php |
GootLoader |
| URL | hxxp://139[.]9[.]182[.]167/x/pty hxxp://139[.]9[.]182[.]167/x/irq0 hxxp://139[.]9[.]182[.]167/x/irq2 hxxp://139[.]9[.]182[.]167/x/irq1 |
Tsunami |
| URL | hxxp://95[.]214[.]27[.]56/morninfgggvbsdroid[.]vbs hxxp://95[.]214[.]27[.]56/cousinnnnfileFile[.]vbs hxxp://95[.]214[.]27[.]56/droidddd[.]hta |
Agent Tesla |
| URL | hxxp://dispatchweekly[.]com/14baef17b6d04c23[.]php | Mars Stealer |
| URL | hxxps://38[.]47[.]238[.]225/jquery-3[.]3[.]1[.]min[.]js hxxp://116[.]204[.]91[.]166/cm hxxp://112[.]124[.]14[.]64/load hxxps://38[.]91[.]119[.]211/cm hxxps://test[.]227api[.]com/__utm[.]gif hxxps://39[.]101[.]150[.]221/jquery-3[.]3[.]1[.]min[.]js hxxps://119[.]167[.]229[.]212/static/js/jquery-3[.]3[.]1[.]min[.]js hxxps://113[.]194[.]51[.]139/static/js/jquery-3[.]3[.]1[.]min[.]js hxxps://36[.]248[.]54[.]138/static/js/jquery-3[.]3[.]1[.]min[.]js hxxps://119[.]188[.]86[.]194/static/js/jquery-3[.]3[.]1[.]min[.]js hxxps://122[.]228[.]255[.]200/static/js/jquery-3[.]3[.]1[.]min[.]js hxxp://120[.]79[.]230[.]62:7878/owa/ hxxp://49[.]232[.]197[.]218:8092/pixel hxxps://cs45up230823s[.]iqiyia[.]com:2083/activity hxxp://43[.]138[.]62[.]36:8080/__utm[.]gif hxxp://213[.]142[.]159[.]117/en_US/all[.]js hxxp://81[.]69[.]18[.]115/ca hxxps://38[.]207[.]179[.]124/ga[.]js hxxps://cs45up230808[.]iqiyia[.]com:2053/ptj hxxps://152[.]136[.]47[.]4/activity hxxp://81[.]68[.]121[.]207:2031/__utm[.]gif hxxp://43[.]138[.]62[.]36:8081/activity hxxp://43[.]138[.]62[.]36:97/match hxxps://8[.]130[.]66[.]2:8081/_/scs/mail-static/_/js/ hxxps://43[.]156[.]59[.]135:10443/en_US/all[.]js hxxp://123[.]249[.]87[.]1:25535/ga[.]js hxxp://123[.]249[.]87[.]1:0/ga[.]js hxxp://csxv[.]sec[.]cm:8080/image/ hxxp://118[.]25[.]16[.]4:60030/load hxxps://cdnoss[.]sec[.]cm/image/ hxxp://101[.]34[.]249[.]226:9999/activity hxxp://43[.]143[.]128[.]154/j[.]ad hxxps://sunshine[.]nicetrue[.]one:8443/index[.]jsp hxxps://db[.]dbzjk[.]top:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://47[.]87[.]215[.]195/jquery-3[.]3[.]1[.]min[.]js hxxp://114[.]132[.]124[.]179:8001/split/d/7473220OP hxxps://update[.]livcloud[.]info/jquery-3[.]3[.]1[.]min[.]js hxxp://139[.]199[.]173[.]235:8080/api/getit hxxp://39[.]107[.]113[.]250:9001/ca hxxps://103[.]39[.]222[.]126:8443/dot[.]gif hxxps://45[.]138[.]157[.]71/pixel hxxps://8[.]217[.]178[.]80/dpixel hxxps://local[.]cnbcheadlines[.]com/default[.]jsp hxxps://blog[.]awscustomersupport[.]com/page[.]jsp hxxp://124[.]70[.]19[.]189:8080/visit[.]js hxxps://110[.]42[.]1[.]134:8443/pixel[.]gif hxxps://101[.]34[.]71[.]193/pixel[.]gif hxxp://110[.]41[.]11[.]72/dpixel hxxps://111[.]231[.]31[.]198/en_US/all[.]js hxxps://66[.]59[.]198[.]109:8443/favicon[.]ico hxxps://60[.]204[.]187[.]184/jquery-3[.]3[.]1[.]min[.]js hxxp://43[.]156[.]59[.]135:8090/cm hxxp://166[.]88[.]77[.]229/pixel hxxps://221[.]236[.]21[.]186/jquery-3[.]3[.]1[.]min[.]js hxxps://112[.]192[.]20[.]180/jquery-3[.]3[.]1[.]min[.]js hxxps://117[.]50[.]163[.]24:8443/dot[.]gif hxxp://5[.]101[.]0[.]241/en_US/all[.]js hxxp://47[.]98[.]233[.]77:6666/en_US/all[.]js hxxp://194[.]26[.]29[.]99:8080/ga[.]js hxxp://5[.]101[.]0[.]241/dot[.]gif hxxps://47[.]120[.]0[.]195/g[.]pixel hxxp://82[.]115[.]223[.]34/activity hxxp://150[.]158[.]44[.]176:8080/dpixel hxxp://175[.]178[.]255[.]202/ptj hxxps://175[.]178[.]255[.]202:8443/en_US/all[.]js hxxp://api[.]office-updates[.]org/owa/ hxxp://117[.]72[.]11[.]130/push hxxp://45[.]138[.]157[.]71/push hxxp://139[.]196[.]47[.]225:8087/jquery-3[.]3[.]1[.]min[.]js hxxp://43[.]139[.]146[.]77/cx hxxp://154[.]90[.]57[.]70:9090/ca hxxps://36[.]140[.]65[.]131:10443/async/ddljson hxxp://charon2[.]corporate-helpdesk[.]de/push hxxp://update[.]rent/download/Chrome[.]exe hxxp://101[.]34[.]71[.]193/push hxxps://sunshine[.]nicetrue[.]one:8443/users[.]jsp hxxps://104[.]244[.]94[.]132/match hxxp://198[.]98[.]52[.]184:20001/dpixel hxxp://123[.]56[.]82[.]231/include/template/isx[.]php hxxps://43[.]138[.]62[.]36/ptj hxxps://124[.]71[.]84[.]65:8443/load hxxps://124[.]71[.]84[.]65/updates[.]rss hxxp://101[.]43[.]149[.]73:8001/dot[.]gif hxxp://101[.]34[.]36[.]115:8076/updates[.]rss hxxp://privia[.]keremsarmis[.]com/bombaimha[.]php hxxp://213[.]142[.]159[.]117/bombaimha[.]php hxxp://2[.]56[.]241[.]244/dpixel hxxps://www[.]weatherths[.]com/jquery-3[.]3[.]1[.]min[.]js hxxp://114[.]115[.]165[.]215/dot[.]gif hxxps://121[.]4[.]69[.]24:10443/search/ hxxps://27[.]124[.]18[.]14/__utm[.]gif hxxp://27[.]124[.]18[.]14/dot[.]gif hxxp://43[.]136[.]14[.]250/visit[.]js hxxp://101[.]43[.]186[.]248/push hxxp://101[.]35[.]4[.]152:8088/api/3 hxxp://43[.]143[.]218[.]146:9999/load hxxps://101[.]42[.]43[.]204:8443/fwlink hxxp://101[.]34[.]58[.]211:2222/en_US/all[.]js hxxp://39[.]100[.]80[.]61/ca hxxp://cdnoss[.]sec[.]cm/image/ hxxps://47[.]103[.]106[.]214/push hxxp://www[.]weatherths[.]com/jquery-3[.]3[.]1[.]min[.]js hxxps://sunshine[.]nicetrue[.]one/pages[.]jsp hxxp://118[.]24[.]128[.]43/IE9CompatViewList[.]xml hxxp://47[.]120[.]0[.]195/__utm[.]gif |
Cobalt Strike |
| URL | hxxps://buypropertyinuae[.]com/[.]N1[.]jpg hxxps://buypropertyinuae[.]com/[.]M1[.]jpg hxxps://buypropertyinuae[.]com/[.]O1[.]jpg hxxp://95[.]214[.]25[.]236/o/o[.]png |
AsyncRAT |
| URL | hxxp://kenman725[.]xyz/777/mtxrOlo[.]exe hxxp://lexmad635[.]xyz/777/mtxNugh[.]exe hxxp://lexmad635[.]xyz/777/mtxfyhp[.]exe |
Phobos |
| URL | hxxps://ejb[.]workout[.]oystergardener[.]net/editContent hxxps://oiuytyfvq621mb[.]org/vvmd54/ hxxps://oiuytyfvq621mb[.]org/ZgbN19Mx hxxps://oiuytyfvq621mb[.]org/lander/chrome/_index[.]php hxxps://pklkknj89bygvczvi[.]com/vvmd54/ hxxps://ngvcfrttgyu512vgv[.]net/ZgbN19Mx hxxps://ngvcfrttgyu512vgv[.]net/lander/chrome/_index[.]php hxxps://lgvup[.]workout[.]oystergardener[.]net/editContent hxxps://ytntf5hvtn2vgcxxq[.]com/ZgbN19Mx hxxps://ytntf5hvtn2vgcxxq[.]com/lander/chrome/_index[.]php hxxps://marcborowy[.]com/cdn/wds[.]min[.]php hxxps://marcborowy[.]com/cdn/zwewmrqqgqnaww[.]php hxxps://ziucsugcbfyfbyccbasy[.]com/vvmd54/ hxxps://ziucsugcbfyfbyccbasy[.]com/ZgbN19Mx hxxps://ziucsugcbfyfbyccbasy[.]com/lander/chrome/_index[.]php hxxps://921hapudyqwdvy[.]com/lander/chrome/_index[.]php hxxps://ytntf5hvtn2vgcxxq[.]com/vvmd54/ hxxps://921hapudyqwdvy[.]com/vvmd54/ hxxps://921hapudyqwdvy[.]com/ZgbN19Mx hxxps://creativity[.]kinchcorp[.]com/xFEl0b9zRrigcx/j8mIJ87ZzH/O+Iwes |
FAKEUPDATES |
| URL | hxxp://post-infos[.]com/bins/2023[.]exe[.]exe hxxp://fr-address[.]com/bins/2023[.]exe[.]exe hxxp://change-infos[.]com/bins/2023[.]exe[.]exe hxxp://wholeadress-renew[.]digital/bins/2023[.]exe[.]exe hxxp://pr24note[.]info/bins/2023[.]exe[.]exe hxxp://newall-getrenew[.]digital/bins/2023[.]exe[.]exe hxxp://mailgo24[.]sbs/bins/2023[.]exe[.]exe |
Aurora Stealer |
| URL | hxxp://185[.]254[.]37[.]243/bins/tel[.]x86 hxxp://185[.]254[.]37[.]243/bins/tel[.]arm7 hxxp://213[.]181[.]206[.]141/i686 hxxp://213[.]181[.]206[.]141/powerpc hxxp://213[.]181[.]206[.]141/mips hxxp://213[.]181[.]206[.]141/armv4l hxxp://213[.]181[.]206[.]141/x86 hxxp://213[.]181[.]206[.]141/armv5l hxxp://213[.]181[.]206[.]141/armv6l hxxp://213[.]181[.]206[.]141/sparc hxxp://213[.]181[.]206[.]141/sh4 hxxp://213[.]181[.]206[.]141/mipsel hxxp://98[.]159[.]98[.]31/f2q2kke5aadloo4aasdjjjfirbmw/0xh0roxxnavebusyoo[.]arm7 |
Bashlite |
| URL | hxxp://status[.]klopware[.]space/_Defaultwindows[.]php hxxp://419819cm[.]nyashkoon[.]top/nyashsupport[.]php hxxp://012244cm[.]nyashtyan[.]top/nyashsupport[.]php hxxp://604291cm[.]nyashkoon[.]top/nyashsupport[.]php hxxp://5[.]42[.]85[.]163/_Defaultwindows[.]php |
DCRat |
| URL | hxxp://81[.]161[.]229[.]120/raw/update/iexpress[.]exe hxxp://81[.]161[.]229[.]120/raw/x/ECheck[.]exe hxxp://81[.]161[.]229[.]120/raw/a/VCheck[.]exe hxxp://81[.]161[.]229[.]120/raw/a/verify[.]exe hxxp://81[.]161[.]229[.]120/raw/x/XCheck[.]exe hxxp://marrakechchoralmeeting[.]ma/netTime[.]exe hxxp://raw[.]gamemewsupdate[.]online/raw/a/verify[.]exe hxxp://raw[.]gamemewsupdate[.]online/raw/x/XCheck[.]exe hxxp://raw[.]gamemewsupdate[.]online/raw/a/VCheck[.]exe hxxp://raw[.]gamemewsupdate[.]online/raw/update/iexpress[.]exe hxxp://raw[.]gamemewsupdate[.]online/raw/x/ECheck[.]exe hxxp://check[.]gameupdate[.]site/raw/update/iexpress[.]exe |
Coinminer |
| URL | hxxp://217[.]196[.]96[.]228/27e2c065315ea17e[.]php hxxp://217[.]196[.]96[.]228/6d24030469a6b14b/nss3[.]dll hxxp://217[.]196[.]96[.]228/6d24030469a6b14b/mozglue[.]dll hxxp://217[.]196[.]96[.]228/6d24030469a6b14b/sqlite3[.]dll hxxp://217[.]196[.]96[.]228/6d24030469a6b14b/softokn3[.]dll hxxp://217[.]196[.]96[.]228/6d24030469a6b14b/msvcp140[.]dll hxxp://217[.]196[.]96[.]228/6d24030469a6b14b/vcruntime140[.]dll hxxp://217[.]196[.]96[.]228/6d24030469a6b14b/freebl3[.]dll hxxp://45[.]147[.]197[.]249/0156a772a135ba9f[.]php hxxp://45[.]147[.]197[.]249/52f2e3b1c96900bb/mozglue[.]dll hxxp://45[.]147[.]197[.]249/52f2e3b1c96900bb/vcruntime140[.]dll hxxp://45[.]147[.]197[.]249/52f2e3b1c96900bb/softokn3[.]dll hxxp://45[.]147[.]197[.]249/52f2e3b1c96900bb/sqlite3[.]dll hxxp://45[.]147[.]197[.]249/52f2e3b1c96900bb/freebl3[.]dll hxxp://45[.]147[.]197[.]249/52f2e3b1c96900bb/msvcp140[.]dll hxxp://45[.]147[.]197[.]249/52f2e3b1c96900bb/nss3[.]dll |
Stealc |
| URL | hxxp://192[.]3[.]23[.]247/400/igfxCU[.]exe | Formbook |
| URL | hxxp://185[.]28[.]39[.]17:7777/185[.]28[.]39[.]18/chungzx[.]doc hxxp://13[.]51[.]205[.]20/panel/uploads/Omlvtfbscoy[.]wav hxxp://192[.]3[.]108[.]47/CLT/1/NetHash[.]exe |
Remcos |
| URL | hxxp://galandskiyher2[.]com/downloads/toolspub4[.]exe | SmokeLoader |
| URL | hxxp://141[.]98[.]6[.]249:8383/oiishzg/Panel/five/fre[.]php hxxp://141[.]98[.]6[.]249/oiishzg/Panel/five/fre[.]php hxxp://104[.]168[.]166[.]188/bosa/fre[.]php hxxp://141[.]98[.]6[.]249:6798/heatitfghzg/Panel/five/fre[.]php |
LokiBot |
| URL | hxxps://gamerdet[.]tk/data/5770871504/payment/U2783V6b/netmelli/index[.]php hxxps://gamerdet[.]tk/data/5770871504/rat/7b5d2Ua9/index[.]php?phone= hxxps://openaico[.]ir/bot/stream/dl/?q=r6wp3wkS4rU hxxps://gamerdet[.]tk/data/5770871504 hxxps://gamerdet[.]tk/data hxxps://gamerdet[.]tk/data/5770871504/rat/7b5d2Ua9/index[.]php hxxps://gamerdet[.]tk/data/5770871504/rat/7b5d2Ua9 hxxps://gamerdet[.]tk/data/5770871504/payment/U2783V6b/netmelli |
IRATA |
| URL | hxxp://vahid[.]intendemo[.]ir/vsIbbYLy253[.]bin hxxp://vahid[.]intendemo[.]ir/RwFfNScRGm241[.]bin |
CloudEyE |
| URL | hxxp://77[.]91[.]68[.]78/lend/jfdgdfg[.]exe | RecordBreaker |
| URL | hxxp://89[.]208[.]103[.]204/book[.]zip hxxp://195[.]201[.]131[.]165/htdocs[.]zip hxxp://168[.]119[.]191[.]88:9000/htdocs[.]zip |
Vidar |
| URL | hxxp://worldtopnews[.]fun/c2conf | Lumma Stealer |
