不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様43社 -
2023/10/02
※2023/10/02 更新
マルウェア感染させると考えられるURLを検知（2023/10/02）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]138[.]74[.]85/dark[.]zip hxxp://195[.]201[.]228[.]145/temp[.]zip hxxp://116[.]202[.]4[.]35:1333/temp[.]zip hxxps://drive[.]google[.]com/uc?export=download&confirm=no_antivirus&id=1x4eXfLIM1wpN0DXUUl4_wESZu17iXtzs |
Vidar |
| URL | hxxp://45[.]15[.]156[.]137:8081/login hxxp://194[.]169[.]175[.]239:8081/login |
RisePro |
| URL | hxxp://343848cm[.]nyashnyash[.]top/Provider_packetBigloadwindowsFlowerAsynctestCdn[.]php hxxp://766392m[.]dccrk[.]top/cpudletemp[.]php hxxp://23872634cm[.]whiteproducts[.]ru/L1nc0In[.]php |
DCRat |
| URL | hxxp://aqwxeyo[.]ru/single[.]php | TeamSpy |
| URL | hxxp://171[.]22[.]28[.]226/download/Services[.]exe hxxp://171[.]22[.]28[.]226/download/rise/StealerClient_Cpp[.]exe hxxp://171[.]22[.]28[.]226/download/WWW14_64[.]exe hxxp://85[.]217[.]144[.]143/files/RBY1[.]exe |
PrivateLoader |
| URL | hxxp://5[.]42[.]64[.]10/api/files/software/s5[.]exe hxxp://blindsportssa[.]org[.]au/save[.]exe hxxp://77[.]91[.]68[.]78/lend/birza[.]exe hxxp://77[.]91[.]68[.]78/lend/asca1ex1234[.]exe hxxp://77[.]91[.]68[.]78/lend/ja8drj17aq21234[.]exe hxxp://77[.]91[.]68[.]78/lend/UNIQTRAFF[.]exe hxxp://77[.]91[.]68[.]78/lend/Elize123[.]exe hxxp://77[.]91[.]68[.]238/new/foto1221[.]exe hxxp://77[.]91[.]68[.]78/lend/ja8drj17aq2[.]exe hxxp://77[.]91[.]68[.]52/fuza/foto1221[.]exe hxxp://77[.]91[.]97[.]131/333/Eliz[.]bat hxxp://77[.]91[.]97[.]131/333/ed1[.]exe hxxp://77[.]91[.]97[.]131/333/information[.]exe hxxp://moshito-marketing[.]com/Main[.]exe hxxps://server2-slabx[.]ocmtancmi2c5t[.]live/osmesis/695326187[.]png |
RedLine Stealer |
| URL | hxxp://77[.]91[.]68[.]78/lend/WinDhcp[.]exe hxxp://193[.]42[.]32[.]101/files/RBY1[.]exe hxxp://193[.]42[.]32[.]101/files/UMM2[.]exe hxxp://85[.]217[.]144[.]143/files/UMM2[.]exe hxxp://85[.]217[.]144[.]143/files/UMM[.]exe hxxp://enfantfoundation[.]com/netTime[.]exe |
Coinminer |
| URL | hxxp://79[.]110[.]48[.]52/afkjo[.]vbs | Warzone RAT |
| URL | hxxp://79[.]110[.]48[.]52/smito[.]vbs hxxp://79[.]110[.]48[.]52/ndert[.]vbs hxxp://103[.]228[.]126[.]12/660/audiodg[.]exe hxxps://api[.]telegram[.]org/bot6383484083:AAEOJzyjj7OZjWPyR6JNxXFWK63ilQslb30/ hxxps://discord[.]com/api/webhooks/1153718958092980356/Dvx2X0ZOxB0JZvA4-WwKsAgWMUkF9A_eS-zWrNoS11pSjA5BUHkXszsb8yuPBeG_cQYi hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/agodzx[.]doc hxxp://193[.]42[.]33[.]63/exploitprivate/goatedinvagina[.]vbs hxxp://192[.]3[.]95[.]131/160/audiodg[.]exe hxxp://193[.]42[.]33[.]63/exploitprivate/x[.]xx[.]x[.]x[.]doc hxxp://171[.]22[.]28[.]226/download/rise/StealerClient_Sharp[.]exe hxxp://193[.]42[.]33[.]63/alteredcasbon7RVuMkLvXuAoxru[.]exe hxxps://payorderreceipt[.]info/voilarape[.]online/invoice/docdav20230925[.]exe hxxps://discord[.]com/api/webhooks/1155851254833098752/vo7YFAKtXfOsqzCNUtNicDb-UATDDMk-I1yIVvfrhWq2PcNTiC3zk-xEzVbiwJTsDRuZ hxxps://api[.]telegram[.]org/bot6387707054:AAExEhOu5cvzos03gKQmQZZNt5kPUvk1nl8/ hxxps://api[.]telegram[.]org/bot6508457872:AAFDejUKejywB5VlMSXK_4YHXE-viXxNI3M/ hxxp://79[.]110[.]48[.]52/nix[.]txt hxxp://193[.]42[.]33[.]63/vY7NqPNdCvuT7Sy[.]exe hxxps://api[.]telegram[.]org/bot6427432332:AAGyIx5JbPsqGBbtUPZiOxBN-KJpEpoKGnM/ hxxps://api[.]telegram[.]org/bot6568247464:AAHsSOES5pRueRqAlbG1bx5hx02y4of2d_Q/ hxxp://193[.]42[.]33[.]63/cqBmSn7ZZ0p6a7K[.]exe hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/tedzx[.]exe hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/prosperzx[.]exe hxxp://192[.]3[.]95[.]131/155/audiodg[.]exe hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/rankobazx[.]exe hxxp://193[.]42[.]33[.]63/greeecousinnnnnnnfrilPulGj0ozA9NC7Db[.]exe hxxp://94[.]156[.]161[.]167/tl/lu47821[.]txt hxxp://94[.]156[.]161[.]167/LUG[.]vbs |
Agent Tesla |
| URL | hxxp://galandskiyher3[.]com/downloads/toolspub1[.]exe hxxp://77[.]91[.]68[.]52/fuza/kus[.]exe hxxp://185[.]225[.]74[.]144/files/Umm2[.]exe hxxp://162[.]244[.]93[.]4/~rubin/redlol[.]exe |
SmokeLoader |
| URL | hxxp://194[.]180[.]49[.]211/bas/RRAIN[.]exe hxxp://194[.]180[.]49[.]211/bas/RAINN[.]exe |
WSHRAT |
| URL | hxxps://glowriters[.]com/eummolestias/i[.]exe | SystemBC |
| URL | hxxp://77[.]91[.]68[.]78/lend/Dropper1[.]exe hxxp://77[.]91[.]68[.]78/lend/Dropper[.]exe hxxp://128[.]140[.]101[.]125/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll |
Raccoon |
| URL | hxxp://124[.]221[.]206[.]123:8443/ca hxxps://xaracc556[.]com/interpret/v3[.]44/ZHWFCJMX0U93 hxxps://43[.]153[.]222[.]28/en_US/all[.]js hxxps://cs45upb230906[.]iqiyid[.]com:2053/IE9CompatViewList[.]xml hxxps://20[.]250[.]1[.]110/inquiry/v7[.]40/573P2JWK hxxps://47[.]236[.]19[.]63/dpixel hxxp://104[.]168[.]68[.]35:39001/fwlink hxxp://8[.]130[.]84[.]57/cm hxxps://upbetanetworks[.]org:757/bg[.]html hxxp://powellfamilydentist[.]com:8080/lt[.]js hxxp://163[.]197[.]217[.]136/dot[.]gif hxxps://cs[.]vegaking[.]xyz/api/3 hxxp://20[.]124[.]232[.]200:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://45[.]207[.]39[.]2/IE9CompatViewList[.]xml hxxps://files[.]jslibc[.]com/jquery-3[.]3[.]1[.]min[.]js hxxp://20[.]124[.]232[.]200/jquery-3[.]3[.]1[.]min[.]js hxxps://cusihunej[.]info/lt[.]html hxxp://185[.]246[.]118[.]208/Mod/v9[.]89/VVR3Y7NF7DH4 hxxps://jmvummtu333[.]com/Set/st/ZUB0OTQ41 hxxps://3[.]22[.]216[.]255/links hxxps://8[.]131[.]118[.]10/j[.]ad hxxps://cs45upb230906[.]iqiyid[.]com:2053/__utm[.]gif hxxps://47[.]100[.]244[.]166:4443/match hxxp://209[.]141[.]46[.]45:8888/push hxxp://172[.]173[.]122[.]38/_/scs/mail-static/_/js/ hxxp://43[.]154[.]14[.]120/push hxxp://91[.]240[.]118[.]216/ga[.]js hxxps://185[.]225[.]75[.]86/jquery-3[.]3[.]1[.]min[.]js hxxp://3[.]140[.]239[.]216:30003/match hxxp://104[.]17[.]123[.]55/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxp://43[.]135[.]22[.]17:6667/cm hxxp://139[.]155[.]134[.]117:8099/jquery-3[.]3[.]2[.]N2cQ4mXdZ4nIo9XIhttp[.]min[.]js hxxp://13[.]208[.]185[.]148/cm hxxps://111[.]230[.]15[.]118/activity hxxp://124[.]222[.]129[.]148/cx hxxp://118[.]89[.]201[.]210:4444/visit[.]js hxxp://81[.]70[.]11[.]25:8081/c/msdownload/update/others/2016/12/29136388_ hxxp://92[.]63[.]196[.]45:81/j[.]ad hxxp://119[.]29[.]225[.]65:13426/jquery-3[.]3[.]1[.]min[.]js hxxp://31[.]44[.]184[.]82/j[.]ad hxxp://31[.]44[.]184[.]82/fwlink hxxp://31[.]44[.]184[.]73/IE9CompatViewList[.]xml hxxps://umomrmwa[.]com/comm/my-sql/D3OVDG1D255J hxxp://103[.]106[.]190[.]207/activity hxxp://88[.]214[.]26[.]33:50999/IE9CompatViewList[.]xml hxxp://143[.]92[.]58[.]97:8989/MicrosoftUpdate/ShellEx/KB242742/default[.]aspx hxxp://43[.]153[.]222[.]28:4646/visit[.]js |
Cobalt Strike |
| URL | hxxps://ssd-vip[.]website/mamad/web[.]txt hxxp://becshapraknet-ir[.]tk/app[.]apk hxxps://irsaham1402[.]site/app[.]apk hxxp://edalatsod-ir[.]tk/app[.]apk hxxps://xstarv2[.]store/[.]S/Bot hxxps://xstarv2[.]store/[.]S hxxps://xstarv2[.]store/[.]S/Bot/Panels/Hunter hxxps://xstarv2[.]store/[.]S/Bot/Panels hxxps://xstarv2[.]store/[.]S/Bot/Panels/Hunter/panel[.]php |
IRATA |
| URL | hxxp://107[.]172[.]75[.]146/200/audiodg[.]exe hxxp://50[.]3[.]182[.]140/wew/I0OIIOIOi0ioii0oiioi0ioiooi0i00i0i0iooi0ioi0ioi0oi0ioi0000%23%23%23%23%23%23%23%23%23%23%23%23%23%230000000%23%23%23%23%23%23%23%23%23%23%23%23%23%230000000[.]doc hxxp://50[.]3[.]182[.]140/350/audiodg[.]exe hxxp://192[.]3[.]23[.]242/110/TiWorker[.]exe hxxp://192[.]3[.]179[.]157/zw/Wtwvjbwnht[.]exe hxxp://192[.]3[.]23[.]242/120/tiworker[.]exe hxxp://192[.]3[.]23[.]242/90/mtdocs[.]exe hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/borilpokonta2[.]1[.]exe hxxp://checkblacklistwords[.]eu/words[.]txt |
Formbook |
| URL | hxxp://124[.]221[.]206[.]123:8443/3anZ | Metasploit |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1023901487681777749/1023903527459901460/Ssbaopba_Pjultaqh[.]jpg | PureCrypter |
| URL | hxxps://api[.]telegram[.]org/bot6563963046:AAGlyBHZ_ALQCHnOUZcYa0FHqP2za43gVaM/sendMessage?chat_id=5262627523 hxxps://api[.]telegram[.]org/bot6553808600:AAEctl9z_ViEe1VbBXIi3Q8EzcyyXMP9F5g/sendMessage?chat_id=5086753017 hxxps://api[.]telegram[.]org/bot6672846419:AAFSAihbjn4BiXgm0YY8G7ozGP9JeR3fpi4/sendMessage?chat_id=6469857895 hxxps://api[.]telegram[.]org/bot6353838065:AAFw-dmIrW4AukRvprM9LipsTyBb8iZ9FxM/sendMessage?chat_id=1467583453 |
Snake Keylogger |
| URL | hxxp://isaiahbenjamin[.]top/calc2[.]exe hxxp://217[.]196[.]96[.]138/a737400ffa5db996[.]php hxxp://45[.]140[.]147[.]83/eddb6f7ac3df755b[.]php hxxp://45[.]140[.]147[.]83/0d79b00b81d1cdb5/sqlite3[.]dll hxxp://45[.]140[.]147[.]83/0d79b00b81d1cdb5/vcruntime140[.]dll hxxp://217[.]196[.]96[.]138/063ec44b1db69f0e/vcruntime140[.]dll hxxp://45[.]140[.]147[.]83/0d79b00b81d1cdb5/mozglue[.]dll hxxp://45[.]140[.]147[.]83/0d79b00b81d1cdb5/freebl3[.]dll hxxp://217[.]196[.]96[.]138/063ec44b1db69f0e/freebl3[.]dll hxxp://217[.]196[.]96[.]138/063ec44b1db69f0e/softokn3[.]dll hxxp://45[.]140[.]147[.]83/0d79b00b81d1cdb5/softokn3[.]dll hxxp://217[.]196[.]96[.]138/063ec44b1db69f0e/msvcp140[.]dll hxxp://217[.]196[.]96[.]138/063ec44b1db69f0e/sqlite3[.]dll hxxp://45[.]140[.]147[.]83/0d79b00b81d1cdb5/msvcp140[.]dll hxxp://45[.]140[.]147[.]83/0d79b00b81d1cdb5/nss3[.]dll hxxp://217[.]196[.]96[.]138/063ec44b1db69f0e/mozglue[.]dll hxxp://217[.]196[.]96[.]138/063ec44b1db69f0e/nss3[.]dll hxxp://193[.]201[.]8[.]121/a6d914969291bf07[.]php |
Stealc |
| URL | hxxp://5[.]181[.]80[.]120/skid[.]arm6 | Bashlite |
| URL | hxxp://kelly[.]spencerstuartllc[.]top/_errorpages/kelly/five/fre[.]php hxxp://fresh1[.]ironoreprod[.]top/_errorpages/fresh1/five/fre[.]php hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/chinazx[.]exe |
LokiBot |
| URL | hxxp://85[.]217[.]144[.]143/files/Amadey[.]exe hxxp://77[.]91[.]124[.]1/theme/index[.]php hxxp://77[.]91[.]124[.]1/theme/Plugins/clip64[.]dll hxxp://193[.]42[.]32[.]29/9bDc8sQ/Plugins/cred64[.]dll hxxp://193[.]42[.]32[.]29/9bDc8sQ/Plugins/clip64[.]dll hxxp://77[.]91[.]124[.]1/theme/Plugins/cred64[.]dll hxxp://89[.]208[.]104[.]191/verbose[.]exe hxxp://77[.]91[.]68[.]249/navi/kur90[.]exe |
Amadey |
| URL | hxxps://3f15f[.]diary[.]lojjh[.]com/subscribeEvent hxxps://afcsm[.]2023[.]ebeenj[.]com/editContent hxxps://nilselsholz[.]com/cdn/wds[.]min[.]php hxxps://nilselsholz[.]com/cdn/zwewmrqqgqnaww[.]php hxxps://oiouhvtybh291[.]com/vvmd54/ hxxps://zasexdrc13ftvg[.]com/lander/chrome_1695206714/_index[.]php hxxps://zasexdrc13ftvg[.]com/vvmd54/ hxxps://zasexdrc13ftvg[.]com/ZgbN19Mx hxxps://ioiubby73b1n[.]com/vvmd54/ hxxps://bpjoieohzmhegwegmmuew[.]online/vvmd54/ hxxps://kjniuby621edoo[.]com/vvmd54/ hxxps://pwwqkppwqkezqer[.]site/vvmd54/ hxxps://oekofkkfkoeefkefbnhgtrq[.]space/vvmd54/ hxxps://bookchrono8273[.]com/ZgbN19Mx hxxps://bookchrono8273[.]com/vvmd54/ hxxps://bookchrono8273[.]com/lander/chrome_1695206714/_index[.]php |
FAKEUPDATES |
| URL | hxxp://77[.]91[.]68[.]78/lend/rFXRoh[.]exe | AsyncRAT |
| URL | hxxp://nz[.]fr-address[.]com/bins/2023[.]exe[.]exe | Aurora |
| URL | hxxp://statehaller[.]fun/api hxxp://boothroundupdow[.]fun/api |
Lumma Stealer |
| URL | hxxp://checkblacklistwords[.]eu/c[.]txt | Venom RAT |
| URL | hxxps://maxguenter[.]de/comments[.]php hxxps://marketdriven[.]chevronmarcom[.]com/comments[.]php |
GootLoader |
| URL | hxxp://filwelreg[.]pw/x/qazsaw/remcos-v4[.]9[.]2[.]zip | Remcos |
| URL | hxxp://filwelreg[.]pw/x/qazsaw/Sbkwabthzzcywi[.]scr hxxp://filwelreg[.]pw/x/qazsaw/Owpxkxlhneicvr[.]scr hxxp://filwelreg[.]pw/x/qazsaw/Wemhwwlidxivdd[.]scr |
DBatLoader |
| URL | hxxp://185[.]225[.]74[.]144/files/Umm[.]exe | Fabookie |
| URL | hxxp://congareeegroupsc[.]com/IB/AppleApp[.]dmg | AMOS |
