不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様6社 -
2023/09/21
※2023/09/21 更新
マルウェア感染させると考えられるURLを検知（2023/09/21）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://alexsazo[.]com/2[.]tar[.]gpg | SectopRAT |
| URL | hxxps://alexsazo[.]com/1[.]jpg hxxp://77[.]91[.]124[.]231/smo/expo[.]exe hxxp://wispafoods[.]com/BestSoftware[.]exe |
RedLine Stealer |
| URL | hxxp://christopherantonio[.]top/calc2[.]exe | Stealc |
| URL | hxxps://ilovealtona[.]org/blog[.]php | GootLoader |
| URL | hxxps://opkfijuifbuyynyny[.]com/vvmd54/ hxxps://opkfijuifbuyynyny[.]com/ZgbN19Mx hxxps://opkfijuifbuyynyny[.]com/lander/chrome/_index[.]php hxxps://blh[.]2023[.]ebeenj[.]com/editContent hxxps://ldmx[.]2023[.]ebeenj[.]com/editContent hxxps://opkfijuifbuyynyny[.]com/lander/chrome_1695206714/_index[.]php hxxps://oiuugyfytvgb22h[.]com/ZgbN19Mx hxxps://oiuugyfytvgb22h[.]com/lander/chrome_1695206714/_index[.]php hxxps://oiuugyfytvgb22h[.]com/vvmd54/ hxxps://ckzg[.]2023[.]ebeenj[.]com/editContent hxxps://sqgu[.]2023[.]ebeenj[.]com/editContent hxxps://dygc[.]2023[.]ebeenj[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://151[.]236[.]218[.]158/wp/blog[.]php | Mars Stealer |
| URL | hxxps://dspsibiu[.]ro/Eelwar[.]u32 hxxp://172[.]93[.]160[.]125/qkQsgpofLqf108[.]bin hxxp://185[.]255[.]114[.]30/TtlfOQQSovVh20[.]bin hxxp://185[.]255[.]114[.]30/mhmLuHZSdKUoFOMJTVQnYr144[.]bin hxxps://nolma[.]com[.]sa/Disse[.]xsn |
CloudEyE |
| URL | hxxp://5[.]42[.]64[.]45/8bmeVwqx/Plugins/cred64[.]dll hxxp://5[.]42[.]64[.]45/8bmeVwqx/Plugins/clip64[.]dll hxxp://cat[.]lobret[.]co[.]za/55aa5e[.]exe |
Amadey |
| URL | hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/wealthzx[.]exe hxxp://81[.]161[.]229[.]147/ark[.]exe hxxp://berkshirebrewers[.]com/FRZ1/Forskan[.]java hxxp://berkshirebrewers[.]com/FRZ/KrIUQGhO224[.]bin hxxp://81[.]161[.]229[.]145/omego[.]exe hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/maxlobbing2[.]1[.]exe hxxp://94[.]156[.]161[.]167/tl/hg5323[.]txt hxxp://79[.]110[.]48[.]52/nigaxb[.]txt hxxp://192[.]3[.]176[.]153/421/TiWorker[.]exe hxxp://94[.]156[.]161[.]167/GWA[.]vbs hxxp://stephenmichaelsmith[.]com/wp-includes/assets/PloNsIWjhuKj189[.]bin hxxps://mailhosting[.]click/ienwscx[.]exe hxxp://94[.]156[.]161[.]167/HVD[.]vbs hxxp://79[.]110[.]48[.]52/omob[.]vbs hxxp://193[.]42[.]33[.]63/eveningmmeddddFile[.]vbs hxxp://79[.]110[.]48[.]52/idex[.]vbs hxxp://stephenmichaelsmith[.]com/rb1/fIjnEDNahO53[.]bin hxxp://stephenmichaelsmith[.]com/ds1/Posernes[.]pfb hxxp://193[.]42[.]33[.]63/aktivosssssssfileapamaFile[.]vbs hxxp://stephenmichaelsmith[.]com/flexi/NzTiyNhAp154[.]bin hxxp://stephenmichaelsmith[.]com/k1/yhXPungSIxZsmMgZr246[.]bin hxxp://stephenmichaelsmith[.]com/k2/Spartan[.]asi hxxp://stephenmichaelsmith[.]com/flexi3/Stenchvans38[.]psd hxxp://185[.]225[.]75[.]151/jokiulob[.]vbs hxxp://193[.]42[.]33[.]63/mohammmeddddFile[.]vbs hxxp://coloradokibosafarihostel[.]co[.]tz/zam/EGU[.]vbs |
Agent Tesla |
| URL | hxxp://159[.]69[.]100[.]165:10088/data[.]zip hxxp://116[.]203[.]11[.]147/data[.]zip |
Vidar |
| URL | hxxp://192[.]3[.]101[.]21/344/TiWorker[.]exe hxxp://192[.]3[.]179[.]157/112/TiWorker[.]exe hxxp://192[.]3[.]179[.]157/112/1/Rzcjkedka[.]exe hxxp://192[.]3[.]101[.]8/90/TiWorker[.]exe |
Formbook |
| URL | hxxp://179[.]43[.]176[.]42/kuci/SBqxEB20ZJgWYrR[.]exe | Snake Keylogger |
| URL | hxxp://103[.]228[.]126[.]12/213/TiWorker[.]exe hxxp://81[.]161[.]229[.]22/T199W/smss[.]exe hxxp://mous[.]midlandpaper[.]icu/_errorpages/mous/five/fre[.]php hxxp://fresh2[.]shunfengpower[.]buzz/_errorpages/fresh2/fre[.]php hxxp://45[.]61[.]169[.]32/?p=5430614 hxxp://zang2[.]areen[.]top/_errorpages/zang2/five/fre[.]php hxxp://kelly[.]chinacarbonfiber[.]buzz/_errorpages/kelly/five/fre[.]php hxxp://193[.]42[.]33[.]63/okwugwwoooooFile[.]vbs hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/kellyzx[.]exe hxxp://81[.]161[.]229[.]96/120/TiWorker[.]exe hxxp://45[.]61[.]169[.]32/?p=472066478309995 hxxp://45[.]61[.]169[.]32/?p=89553 hxxp://45[.]61[.]169[.]32/?p=75025632 |
LokiBot |
| URL | hxxp://147[.]78[.]47[.]48/pixel[.]gif hxxp://185[.]11[.]61[.]85/updates[.]rss hxxps://185[.]11[.]61[.]85/ca hxxp://164[.]155[.]201[.]133/ptj hxxps://106[.]14[.]201[.]1/__utm[.]gif hxxps://3[.]141[.]98[.]21/owa/5i8u5Z2ttBk3HHy-UYLSX1bD89B9U hxxp://1[.]14[.]32[.]41:8083/load hxxps://152[.]136[.]116[.]44:4443/jquery-3[.]3[.]1[.]min[.]js hxxp://185[.]225[.]75[.]3:8086/c/msdownload/update/others/2020/10/29136388_ hxxp://211[.]159[.]173[.]202:5555/match hxxps://117[.]50[.]174[.]241/pixel hxxp://106[.]14[.]201[.]1/g[.]pixel hxxps://betshopkipstri[.]com/pixel hxxps://bb[.]makkgg[.]fyi/jd/ hxxp://139[.]159[.]203[.]44:8010/cx hxxp://3[.]141[.]98[.]21/owa/eV19SoVsnrwBXSiKRE0f6Q0Qx hxxp://82[.]115[.]223[.]34/g[.]pixel hxxps://107[.]189[.]13[.]227/pixel hxxps://107[.]172[.]216[.]18:8082/activity hxxps://123[.]249[.]104[.]83:2053/g[.]pixel hxxps://111[.]229[.]247[.]93/load hxxps://www[.]baidusec[.]top:2096/js[.]js hxxp://59[.]110[.]172[.]50/__utm[.]gif hxxp://114[.]115[.]185[.]41:44444/dpixel hxxp://223[.]247[.]221[.]123:8888/g[.]pixel hxxp://123[.]249[.]100[.]70/visit[.]js hxxp://43[.]139[.]67[.]239/pixel hxxps://149[.]129[.]72[.]37:48444/cm hxxps://124[.]220[.]101[.]231/admin/facvicon[.]jpg hxxps://1[.]94[.]11[.]140/owa/ hxxps://5[.]181[.]80[.]82/apiv8/getStatus hxxp://124[.]220[.]101[.]231/admin/facvicon[.]jpg hxxps://118[.]195[.]147[.]172/ca hxxp://bb[.]makkgg[.]fyi:8080/jd/ |
Cobalt Strike |
| URL | hxxps://pasteio[.]com/raw/xsDAh2DpNHo9 hxxps://pasteio[.]com/raw/xvRXmZSd1JNo hxxps://pasteio[.]com/raw/xnNCt2Ojtfed |
VoidRAT |
| URL | hxxp://jensin[.]com[.]vn/docss/portfolio[.]zip | Gozi |
| URL | hxxp://124014cm[.]nyashnyash[.]top/nyashsupport[.]php hxxp://934062cm[.]nyashnyash[.]top/nyashsupport[.]php |
DCRat |
| URL | hxxp://94[.]142[.]138[.]221/file/name[.]exe | Raccoon |
| URL | hxxp://194[.]169[.]175[.]220:8081/login hxxp://194[.]169[.]175[.]233:8081/login hxxp://171[.]22[.]28[.]230:8081/login hxxps://p-rise[.]online/login |
RisePro |
| URL | hxxp://aioeuqo[.]ru/single[.]php | TeamSpy |
| URL | hxxp://servermlogs27[.]xyz/statweb255/ hxxp://servmblog45[.]xyz/statweb255/ hxxp://demblog575[.]xyz/statweb255/ hxxp://admlogs85x[.]xyz/statweb255/ hxxp://blogmstat389[.]xyz/statweb255/ hxxp://blogmstat255[.]xyz/statweb255/ |
SmokeLoader |
