不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様18社 -
2023/09/29
※2023/09/29 更新
マルウェア感染させると考えられるURLを検知（2023/09/29）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]77[.]76[.]224/~clinics/uhjaX1tXloDzACvaR hxxp://45[.]77[.]76[.]224/~clinics/sObDSpisJ8vqe |
LokiBot |
| URL | hxxp://95[.]141[.]41[.]12/n9kd3X/index[.]php hxxp://mardukoff[.]info/n9kd3X/index[.]php hxxp://193[.]42[.]32[.]29/9bDc8sQ/index[.]php |
Amadey |
| URL | hxxp://51[.]89[.]205[.]213:8081/login hxxp://94[.]142[.]138[.]43:8081/login |
RisePro |
| URL | hxxp://168[.]119[.]168[.]251:10088/data[.]zip hxxps://drive[.]google[.]com/uc?export=download&confirm=no_antivirus&id=1sBt-3kR7LIPsFFpOOWbDl5POrKFNQ6WO |
Vidar |
| URL | hxxp://milkwithlacto[.]fun/c2conf hxxps://stable4download[.]ocmtancmi2c5t[.]website/eee[.]exe |
Lumma Stealer |
| URL | hxxps://hack-x[.]su/file/installs[.]exe | RedLine Stealer |
| URL | hxxps://discord[.]com/api/webhooks/1154336927366000673/Jk4ELugqgK9y6Ed57PuyX4obahplOtOUADODcma5L3loioc7ts6dqrNHpG0Qenz1WPSo hxxps://dispatchweekly[.]com/download[.]php hxxps://api[.]telegram[.]org/bot5573921253:AAHXKq7lrmioCzUGP-9p7lopfbVX0A_ZdQA/ |
Agent Tesla |
| URL | hxxps://api[.]telegram[.]org/bot6307848603:AAHuPYbVu9-pOqbv-rh59-MPBtLsLADgIWE/sendMessage?chat_id=6270867455 | Snake Keylogger |
| URL | hxxps://20[.]250[.]1[.]110/contact/bsd/M9BDBRYTM hxxps://154[.]221[.]17[.]44:2080/fwlink hxxp://135[.]125[.]201[.]221/__utm[.]gif hxxps://135[.]125[.]201[.]221/load hxxp://104[.]168[.]68[.]35:39001/pixel hxxp://powellfamilydentist[.]com:8080/av[.]js hxxps://cdnoss[.]sec[.]cm/common/view/aid hxxp://85[.]209[.]11[.]107/g[.]pixel hxxps://xavfgrtgrg[.]com/preserve/picture/IJNHFXU2X53 hxxps://209[.]250[.]245[.]144/jquery-3[.]3[.]1[.]min[.]js |
Cobalt Strike |
| URL | hxxp://94[.]140[.]114[.]21/vc32[.]tar hxxp://94[.]140[.]114[.]21/vc64[.]tar |
Gozi |
| URL | hxxp://88[.]119[.]174[.]100/atm/ hxxp://45[.]120[.]178[.]206/orst/ hxxp://88[.]119[.]175[.]234/is/ hxxps://brunaviolaoficial[.]com[.]br/vs/ hxxps://skillerszone[.]com/dis/ hxxps://palakkadscb[.]org/mrr/ hxxps://laplayosa[.]gob[.]ar/dmi/ hxxps://adfilms[.]lk/nrp/ hxxps://sosprinter[.]com[.]br/us/ hxxps://thefastestcard[.]com/dus/ hxxps://neftobd[.]com/tges/ hxxps://startvideoedition[.]com/meu/ hxxps://lookkiero[.]com/dlem/ hxxps://bjainpharmacrm[.]com/nd/ hxxps://itspak[.]com[.]pk/sstp/ hxxps://bornomalaschool[.]org/nio/ hxxps://division9kw[.]com/se/ hxxps://almonanhijama[.]com/asln/ hxxps://smartretouching[.]com/util/ hxxps://ebaeuropacontrol[.]com/ac/ hxxps://idsaperu[.]com/tp/ hxxps://beaccameroun[.]org/cc/ hxxps://mixologa[.]com/uu/ hxxps://kunals[.]com/tq/ hxxps://prowesstechllc[.]us/usii/ hxxp://smartsbee[.]co/ect/ hxxps://taxiumraah[.]com/afst/ hxxps://gitghana[.]com/sdr/ hxxps://quickeasyfinance[.]net/iql/ hxxps://shadowmaskbungalow[.]com/ups/ hxxps://successwithoutsacrifice[.]org/ve/ hxxps://codingtestsforkids[.]com/muuo/ hxxps://oobben[.]store/sitl/ hxxps://floriculturavalledasflores[.]com[.]br/etn/ hxxps://englishnet[.]com[.]mx/ml/ hxxp://107[.]191[.]37[.]106/ihpe/ hxxp://104[.]207[.]132[.]131/pm/ hxxp://140[.]82[.]7[.]92/sce/ hxxps://skp[.]co[.]id/iomq/ hxxps://professional-repair-services[.]com/tva/ hxxps://carrepairdubai[.]ae/eust/ hxxps://simondist[.]com/tlaa/ hxxps://nefzo[.]com/st/ hxxp://teamtalentelgia[.]com/ese/ hxxps://plan12[.]org/qu/ hxxps://clickntouch[.]net/uuis/ hxxps://greentechelectric[.]eu/lda/ hxxps://psicologa-mindfulness[.]it/ccr/ hxxps://the17laws[.]com/ete/ hxxp://romancehotel[.]net/riss/ hxxps://cadinova[.]ma/vsn/ hxxps://healosure[.]com/ta/ hxxps://soapap[.]gob[.]mx/asa/ hxxps://ismilemedical[.]com/de/ hxxps://consulciap[.]com/oau/ hxxps://bertam[.]com[.]my/xoes/ hxxps://brij[.]world/aut/ hxxps://sefs[.]com[.]mx/seme/ hxxps://adrianotoledo[.]com/iadn/ hxxps://innocence[.]co[.]in/et/ hxxps://cogitarepsicoterapia[.]com[.]br/srpr/ hxxps://plantix-eg[.]com/iiso/ hxxps://samehelsadat[.]com/iatu/ hxxps://aksharagalam[.]com/at/ hxxps://wubshetbekele[.]com/ifof/ hxxps://ziaintegracion[.]com/asu/ hxxps://synchronousdigital[.]com/qsau/ hxxps://hijrr[.]com/pae/ hxxps://unitedusedfurniture[.]com/oe/ hxxps://universewriters[.]com/tuo/ hxxps://apstaffing[.]us/lpqo/ hxxps://aeic-usa[.]com/rarn/ hxxps://uplines[.]co/mq/ hxxps://generalsmart[.]com[.]br/rtc/ hxxps://shoppingrf[.]com/gqf/ hxxps://thebabysense[.]ca/aipc/ hxxps://woodcorp[.]com[.]pk/im/ hxxps://landscapersindubai[.]com/no/ hxxps://hondamardan[.]com[.]pk/patc/ hxxps://moreroom-me[.]com/ic/ hxxps://alhijaztours[.]net/eor/ hxxps://redperifericaaqp[.]gob[.]pe/idai/ hxxps://libertyammunitions[.]com/ai/ hxxps://hamzarentacarislamabad[.]com/at/ hxxps://forbangladesh[.]com/aunr/ hxxps://passionacademy[.]edu[.]et/stde/ hxxps://love-sms[.]in/ugtn/ hxxps://lider[.]fm/nte/ hxxps://colantari[.]info/et/ hxxps://orgsapi[.]com/dt/ hxxps://arpatex[.]ch/nea/ hxxps://techzero[.]com[.]br/cnti/ hxxps://colegiodelsol[.]info/aid/ hxxps://gwsoluciones[.]com/gni/ hxxp://institutodeljuego[.]net/siel/ hxxps://dehandreatarot[.]online/tei/ hxxps://rubiomoveis[.]com[.]br/nni/ hxxps://btcgamblingtips[.]com/ece/ hxxps://guzpanel[.]quest/elas/ hxxps://lcmagency[.]art/ll/ hxxps://josim-uddin[.]com/luda/ hxxps://somoyerdarpon[.]com/oqce/ hxxps://crypticminer[.]cloud/see/ hxxps://gabioni[.]ge/uua/ hxxps://pollodacsa[.]com/sca/ hxxps://shubhamavenue[.]in/tonn/ hxxps://flanartscuisine[.]com/vo/ hxxps://pearlstore[.]co/nm/ hxxps://hum-yummy[.]com/mc/ hxxps://urban[.]ng/oro/ hxxps://initiative-td[.]org/iqua/ hxxps://roraimastudios[.]com/nn/ hxxps://puretechdigital[.]in/emi/ hxxps://modant-seabulk[.]com/tinu/ hxxps://homeparadz[.]com/stvi/ hxxps://elite-sd[.]com/cer/ hxxps://unanimousgoatcloting[.]com/iaep/ hxxps://dreamcitytoronto[.]ca/odp/ hxxps://renforcerusa[.]com/vt/ |
Pikabot |
| URL | hxxps://98ygdjhdvuhj[.]com/vvmd54/ hxxps://98ygdjhdvuhj[.]com/ZgbN19Mx hxxps://98ygdjhdvuhj[.]com/lander/chrome_1695206714/_index[.]php hxxps://tkk[.]2023[.]ebeenj[.]com/editContent hxxps://ojhggnfbcy62[.]com/vvmd54/ hxxps://pxv[.]2023[.]ebeenj[.]com/editContent hxxps://ojhggnfbcy62[.]com/ZgbN19Mx hxxps://ojhggnfbcy62[.]com/lander/chrome_1695206714/_index[.]php hxxps://zgwqx[.]2023[.]ebeenj[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://172[.]93[.]187[.]47/ByvaZRoKfclwDga48[.]bin hxxp://172[.]93[.]187[.]47/vOzujldjFUFjUstzuX202[.]bin hxxp://74[.]84[.]150[.]168/SQQHvlDMkKQhPQWCCUemm227[.]bin hxxp://74[.]84[.]150[.]168/lFdpv162[.]bin hxxp://103[.]237[.]86[.]138/hyMEPVyzXYX53[.]bin hxxp://103[.]237[.]86[.]138/bdGTAXpgm113[.]bin |
CloudEyE |
| URL | hxxp://208[.]91[.]189[.]189/05b85f6a6b0e9444/sqlite3[.]dll hxxp://208[.]91[.]189[.]189/05b85f6a6b0e9444/freebl3[.]dll hxxp://208[.]91[.]189[.]189/05b85f6a6b0e9444/nss3[.]dll hxxp://208[.]91[.]189[.]189/05b85f6a6b0e9444/mozglue[.]dll hxxp://208[.]91[.]189[.]189/05b85f6a6b0e9444/softokn3[.]dll hxxp://208[.]91[.]189[.]189/05b85f6a6b0e9444/msvcp140[.]dll hxxp://208[.]91[.]189[.]189/05b85f6a6b0e9444/vcruntime140[.]dll hxxp://193[.]201[.]8[.]110/c67be317e1e6e8d4/sqlite3[.]dll hxxp://193[.]201[.]8[.]110/c67be317e1e6e8d4/mozglue[.]dll hxxp://193[.]201[.]8[.]110/c67be317e1e6e8d4/freebl3[.]dll hxxp://193[.]201[.]8[.]110/c67be317e1e6e8d4/msvcp140[.]dll hxxp://193[.]201[.]8[.]110/c67be317e1e6e8d4/nss3[.]dll hxxp://193[.]201[.]8[.]110/c67be317e1e6e8d4/softokn3[.]dll hxxp://193[.]201[.]8[.]110/c67be317e1e6e8d4/vcruntime140[.]dll |
Stealc |
| URL | hxxp://79[.]110[.]48[.]52/afkjo[.]txt | Warzone RAT |
