不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様44社 -
2023/09/25
※2023/09/25 更新
マルウェア感染させると考えられるURLを検知（2023/09/25）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://139[.]84[.]231[.]199:8080/get/CF6frm57nj/mta[.]dll | AsyncRAT |
| URL | hxxps://uilscvnzdds[.]shop/AutoPay-/ hxxps://hadespanel[.]online/ratsaz hxxps://uilscvnzdds[.]shop/sahamedalat[.]apk hxxps://hadespanel[.]online/ratsaz/ports/ hxxp://5[.]255[.]117[.]149//rat[.]php hxxp://5[.]255[.]117[.]149/rat[.]php hxxps://witheveryregistration[.]click/los/panel[.]php?link hxxps://witheveryregistration[.]click/los hxxps://witheveryregistration[.]click/los/panel[.]php hxxps://remote[.]mrkorosh[.]site/config/-1001830809790 hxxps://remote[.]mrkorosh[.]site/api/-1001830809790 hxxps://uilscvnzdds[.]shop/AutoPay-/index[.]php hxxps://ssd-vip[.]website/kabos hxxps://ssd-vip[.]website/kabos/web[.]txt hxxps://ssd-vip[.]website/kabos/log[.]php hxxps://sahamedalat[.]whi[.]ir/Saham%20Man[.]apk hxxps://hello[.]zlc[.]ir/siachal/ |
IRATA |
| URL | hxxp://eeepdcn[.]ua/single[.]php hxxp://efeuhot[.]ua/single[.]php hxxp://ccodoom[.]net/single[.]php hxxp://ddpkzaq[.]info/single[.]php hxxp://eojyaqr[.]ua/single[.]php |
TeamSpy |
| URL | hxxps://cczqyvuy812jdy[.]com/vvmd54/ hxxps://cczqyvuy812jdy[.]com/ZgbN19Mx hxxps://cczqyvuy812jdy[.]com/lander/chrome_1695206714/_index[.]php hxxp://cczqyvuy812jdy[.]com/lander/chrome_1695206714/_index[.]php hxxp://cczqyvuy812jdy[.]com/ZgbN19Mx hxxps://japcr[.]reseller[.]wonderfulworldblog[.]com/gotoCheckout hxxps://jtvo[.]2023[.]ebeenj[.]com/editContent hxxps://lxdi[.]2023[.]ebeenj[.]com/editContent hxxps://ksi[.]2023[.]ebeenj[.]com/editContent hxxps://mphqg[.]2023[.]ebeenj[.]com/editContent hxxps://nbvyrxry216vy[.]com/vvmd54/ hxxps://nbvyrxry216vy[.]com/lander/chrome_1695206714/_index[.]php hxxps://nbvyrxry216vy[.]com/ZgbN19Mx hxxps://reedx51mut[.]com/vvmd54/ hxxps://reedx51mut[.]com/ZgbN19Mx hxxps://reedx51mut[.]com/lander/chrome_1695206714/_index[.]php hxxps://oqbkc[.]2023[.]ebeenj[.]com/editContent hxxps://miri[.]2023[.]ebeenj[.]com/editContent hxxps://klhby[.]2023[.]ebeenj[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://js[.]yalafix[.]com:443/checkin hxxps://110[.]42[.]206[.]10:8080/p/freemail/lib/polyfill/es5-polyfill[.]js hxxp://20[.]237[.]12[.]116/jquery-3[.]3[.]1[.]min[.]js hxxps://1[.]94[.]3[.]150/ptj hxxps://54[.]215[.]87[.]253/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://91[.]238[.]181[.]238:3389/Validate/v10[.]6/W2GE3SC8 hxxps://91[.]238[.]181[.]238/Validate/v10[.]6/W2GE3SC8 hxxps://119[.]29[.]106[.]110/__utm[.]gif hxxps://113[.]31[.]111[.]220/dequeue/faculty/201NJGW7N8NX hxxp://82[.]157[.]110[.]128/fwlink hxxps://47[.]101[.]41[.]158:37676/pixel[.]gif hxxp://43[.]138[.]62[.]36:9000/cm hxxp://123[.]207[.]5[.]159:89/j[.]ad hxxps://107[.]189[.]13[.]227/visit[.]js hxxps://47[.]236[.]19[.]63/cx hxxp://124[.]223[.]83[.]171:8055/activity hxxp://8[.]130[.]128[.]97/fwlink hxxps://176[.]113[.]115[.]54/match hxxps://124[.]221[.]206[.]123:8443/en_US/all[.]js hxxp://119[.]29[.]145[.]4:8080/en_US/all[.]js hxxp://148[.]66[.]2[.]194:8080/fwlink hxxp://60[.]204[.]220[.]208/cm hxxps://106[.]75[.]251[.]66:8443/j[.]ad hxxps://cdn[.]apiadmin[.]live:8443/index/ hxxp://110[.]40[.]157[.]87/match hxxps://138[.]68[.]91[.]128:4443/owa/ hxxp://43[.]139[.]221[.]182:6666/cx hxxp://124[.]221[.]0[.]93:7080/push hxxps://101[.]32[.]186[.]170/en_US/all[.]js hxxps://139[.]59[.]235[.]156/_/scs/mail-static/_/js/ hxxps://tsvsnjv[.]com/Damage/references/M36H9AYJ6 hxxp://104[.]168[.]54[.]203/load hxxps://rokllold279[.]com/display/cgi-sys/KV0L5VRPLUTU hxxp://124[.]221[.]206[.]123:8099/visit[.]js hxxps://194[.]29[.]187[.]194/jquery-3[.]3[.]1[.]min[.]js hxxps://sts[.]tencentopenapi[.]xyz:8443/image/ hxxp://198[.]44[.]184[.]235/__utm[.]gif hxxp://172[.]171[.]232[.]120/dot[.]gif hxxps://ttxxx[.]club:8443/api/3 hxxp://62[.]234[.]48[.]219/push hxxp://47[.]100[.]170[.]9:81/updates[.]rss hxxps://rokllofrold29[.]com/Upset/v3[.]22/WGRDACX3 hxxp://176[.]113[.]115[.]54/ga[.]js hxxps://45[.]81[.]39[.]16/jquery-3[.]3[.]1[.]min[.]js hxxp://117[.]50[.]187[.]39:801/cx hxxps://45[.]77[.]169[.]140/c/msdownload/update/others/2023/09/29136388_ hxxp://159[.]223[.]29[.]112/activity hxxp://85[.]209[.]11[.]107/visit[.]js hxxp://118[.]195[.]143[.]76/api/3 hxxps://31[.]24[.]227[.]218/fwlink hxxp://106[.]75[.]232[.]107/dpixel hxxp://47[.]115[.]219[.]93:8809/__utm[.]gif hxxps://107[.]172[.]216[.]18:8082/pixel hxxp://47[.]109[.]97[.]92:5555/match hxxp://www[.]mylinkedln[.]com/broadcast hxxps://www[.]baidusec[.]top:2096/newspaper[.]js hxxps://42[.]193[.]101[.]234/load hxxp://42[.]193[.]101[.]234/cx hxxp://111[.]229[.]247[.]93/IE9CompatViewList[.]xml hxxp://47[.]99[.]172[.]42:7443/jquery-3[.]3[.]1[.]min[.]js hxxps://medtechgroups[.]com/universal-access[.]css hxxp://117[.]72[.]8[.]251/g[.]pixel hxxp://financialservicesunion[.]com/admin[.]js hxxps://180[.]184[.]194[.]145/ptj hxxps://servicedesk-solutions[.]net/im[.]php hxxp://39[.]106[.]2[.]238:81/fwlink hxxp://175[.]178[.]99[.]133/__utm[.]gif hxxps://video[.]baiduu[.]online/wp06/wp-includes/po[.]php hxxp://39[.]106[.]75[.]77/activity hxxp://124[.]221[.]183[.]95:4567/push hxxps://119[.]45[.]118[.]187:2087/api/3 hxxps://www[.]jtitraining[.]com/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://dns[.]zonstdns[.]xyz/g[.]pixel hxxps://74[.]235[.]187[.]46/async/ddljson hxxp://49[.]232[.]22[.]171/pixel[.]gif hxxp://39[.]107[.]113[.]250:8888/activity hxxps://porkchopsandwich[.]net/j[.]ad hxxps://www[.]porkchopsandwich[.]net/en_US/all[.]js hxxp://www[.]porkchopsandwich[.]net/ga[.]js hxxp://porkchopsandwich[.]net/en_US/all[.]js hxxp://101[.]34[.]71[.]193/jquery-3[.]3[.]1[.]min[.]js hxxps://c1[.]flashjick[.]top:2053/api/3 hxxp://104[.]168[.]54[.]203/dot[.]gif hxxp://82[.]157[.]57[.]66/ptj hxxps://82[.]157[.]57[.]66/en_US/all[.]js hxxp://139[.]155[.]154[.]67:8089/__utm[.]gif hxxp://45[.]11[.]46[.]50:7001/en_US/all[.]js hxxp://104[.]248[.]242[.]202/cm hxxps://152[.]136[.]60[.]210/visit[.]js |
Cobalt Strike |
| URL | hxxp://js[.]yalafix[.]com:443/Logo[.]jpg | Meterpreter |
| URL | hxxp://213[.]159[.]208[.]100/5downloads/mariadbCdnMulti/0Php/7/base07geo/08/3/Wp3Video/4Auth0/Longpoll/External/wpEternal/Processor/Testbetter/6temporaryMariadb/ServerPython/670image/vm/processDb[.]php hxxp://makui[.]kriptonhosting[.]store/b1b0a368[.]php hxxp://185[.]106[.]92[.]110/_Defaultwindows[.]php |
DCRat |
| URL | hxxp://193[.]168[.]141[.]163/4b91eb784a77478c[.]php hxxp://193[.]168[.]141[.]163/2c960ece73a2c15a/nss3[.]dll hxxp://193[.]168[.]141[.]163/2c960ece73a2c15a/softokn3[.]dll hxxp://193[.]168[.]141[.]163/2c960ece73a2c15a/msvcp140[.]dll hxxp://193[.]168[.]141[.]163/2c960ece73a2c15a/vcruntime140[.]dll hxxp://193[.]168[.]141[.]163/2c960ece73a2c15a/mozglue[.]dll hxxp://193[.]168[.]141[.]163/2c960ece73a2c15a/freebl3[.]dll hxxp://193[.]168[.]141[.]163/2c960ece73a2c15a/sqlite3[.]dll hxxp://176[.]123[.]8[.]152/0fad59ad7536045a[.]php hxxp://176[.]123[.]8[.]152/044d0f5f47e0eb72/msvcp140[.]dll hxxp://176[.]123[.]8[.]152/044d0f5f47e0eb72/mozglue[.]dll hxxp://176[.]123[.]8[.]152/044d0f5f47e0eb72/freebl3[.]dll hxxp://176[.]123[.]8[.]152/044d0f5f47e0eb72/sqlite3[.]dll hxxp://176[.]123[.]8[.]152/044d0f5f47e0eb72/nss3[.]dll hxxp://176[.]123[.]8[.]152/044d0f5f47e0eb72/vcruntime140[.]dll hxxp://176[.]123[.]8[.]152/044d0f5f47e0eb72/softokn3[.]dll hxxp://185[.]161[.]251[.]81/c85cabe680e08506[.]php hxxp://185[.]161[.]251[.]81/a4cf60df505c17ab/nss3[.]dll hxxp://185[.]161[.]251[.]81/a4cf60df505c17ab/mozglue[.]dll hxxp://185[.]161[.]251[.]81/a4cf60df505c17ab/sqlite3[.]dll hxxp://185[.]161[.]251[.]81/a4cf60df505c17ab/freebl3[.]dll hxxp://185[.]161[.]251[.]81/a4cf60df505c17ab/vcruntime140[.]dll hxxp://185[.]161[.]251[.]81/a4cf60df505c17ab/softokn3[.]dll hxxp://185[.]161[.]251[.]81/a4cf60df505c17ab/msvcp140[.]dll |
Stealc |
| URL | hxxp://greenvillage[.]or[.]tz/wp-content/yanf/ULK[.]vbs hxxp://79[.]110[.]48[.]52/kencec[.]vbs hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/damianozx[.]exe hxxp://79[.]110[.]48[.]52/myn[.]txt hxxp://193[.]42[.]33[.]63/uchefridauuuuuuuFile[.]vbs hxxp://79[.]110[.]48[.]52/qasx[.]vbs hxxp://193[.]42[.]33[.]63/couzineeeeeeeeeeeeee[.]exe hxxp://193[.]42[.]33[.]63/aktivosexeeeeeee[.]exe |
Agent Tesla |
| URL | hxxp://172[.]200[.]176[.]88/kitlouco[.]php | Metamorfo |
| URL | hxxp://omegalb[.]com/gYaqzwfMrMXtpCKLHF64[.]bin hxxp://147[.]189[.]131[.]75/AogRSAQ74[.]bin hxxp://185[.]255[.]114[.]9/vqbPmyaPEydMRPeTXgsCME219[.]bin |
CloudEyE |
| URL | hxxps://sterkinekor[.]co[.]zw/univer[.]exe | Arkei Stealer |
| URL | hxxp://193[.]42[.]32[.]101/files/UMM[.]exe | Coinminer |
| URL | hxxp://45[.]66[.]230[.]113/Malware[.]zip | Eternity |
| URL | hxxp://fesportal[.]com/forum/index[.]php hxxp://sylviamund[.]com/forum/index[.]php hxxp://soulofevil[.]com/forum/index[.]php hxxp://77[.]91[.]68[.]238/smo/kus[.]exe |
Amadey |
| URL | hxxp://77[.]91[.]68[.]78/lend/d3xi5rws2ffuli[.]exe hxxp://77[.]91[.]68[.]78/lend/WhiteCrypt[.]exe hxxp://77[.]91[.]68[.]78/lend/2[.]exe hxxp://77[.]91[.]68[.]239/dark/nsi85[.]exe hxxp://194[.]55[.]224[.]41/c[.]exe hxxp://77[.]91[.]68[.]238/new/foto7447[.]exe hxxp://194[.]55[.]224[.]41/g[.]exe |
RedLine Stealer |
| URL | hxxp://77[.]91[.]68[.]78/lend/rh_0[.]4[.]9rc1[.]exe | Rhadamanthys |
| URL | hxxp://179[.]43[.]176[.]42/kuci/WXwEfBwFojUL7Eo[.]exe | Snake Keylogger |
| URL | hxxp://94[.]228[.]168[.]51/login | RisePro |
| URL | hxxp://co36686[.]twsite[.]de/chisom/gate[.]php | Pony |
| URL | hxxp://103[.]178[.]234[.]224/x86_64 hxxp://154[.]27[.]93[.]228/x86_64 |
Bashlite |
| URL | hxxp://77[.]91[.]68[.]78/lend/LummaC2[.]exe hxxp://satanakop[.]fun/api hxxp://seededraisinlilinglov[.]fun/api hxxp://coldwinded[.]fun/api |
Lumma Stealer |
| URL | hxxps://jvasky[.]com/blog[.]php hxxps://kalendarze[.]merkuriusz[.]pl/blog[.]php hxxps://kapsalonbrand[.]nl/blog[.]php hxxps://kantarellstigen1[.]se/blog[.]php hxxps://iprommark[.]com[.]ua/blog[.]php hxxps://insource[.]nz/blog[.]php hxxps://inspiration4fitness[.]de/blog[.]php hxxps://jacksworkspace[.]com/blog[.]php hxxps://hslawcorp[.]com/blog[.]php hxxps://karlshamnsfotoklubb[.]se/blog[.]php hxxps://ippm[.]dk/blog[.]php hxxps://johnryan[.]ie/blog[.]php hxxps://jphilippeau[.]com/blog[.]php hxxps://hologramy-kolekcjonerskie[.]pl/blog[.]php hxxps://heatherwoodpta[.]org/blog[.]php hxxps://imago-int[.]eu/blog[.]php hxxps://junkwize[.]passionstaging[.]co[.]uk/blog[.]php hxxps://herbert-strohmaier[.]de/blog[.]php hxxps://ibirtm[.]pl/blog[.]php hxxps://inprojexautomotive[.]com/blog[.]php hxxps://hoco-moebel[.]de/blog[.]php hxxps://iuic[.]de/blog[.]php hxxps://heuberg-einrichtungen[.]de/blog[.]php hxxps://hockeycorner[.]net/blog[.]php |
GootLoader |
| URL | hxxp://mksad917[.]xyz/skx111[.]exe | SystemBC |
| URL | hxxp://5[.]42[.]64[.]10/api/files/software/s1[.]exe | DanaBot |
| URL | hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nssdbm3[.]dll hxxp://45[.]84[.]0[.]80/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll |
RecordBreaker |
| URL | hxxp://ffice[.]aluminprodu[.]top/_errorpages/office/five/fre[.]php hxxp://office[.]aluminprodu[.]top/_errorpages/office/five/fre[.]php |
LokiBot |
