不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様17社 -
2023/10/18
※2023/10/18 更新
マルウェア感染させると考えられるURLを検知（2023/10/18）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://185[.]216[.]70[.]222/one[.]exe | RedLine Stealer |
| URL | hxxp://77[.]91[.]68[.]52/fuza/angel[.]exe hxxp://pruvles[.]fun/api hxxp://bulletforx[.]fun/api |
Lumma Stealer |
| URL | hxxps://185[.]81[.]157[.]213/11[.]exe | AsyncRAT |
| URL | hxxp://china[.]dhabigroup[.]top/_errorpages/owenzx[.]exe hxxp://141[.]98[.]10[.]49/w3w/audiodgse[.]exe |
Formbook |
| URL | hxxp://194[.]87[.]31[.]58:8444/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://194[.]87[.]31[.]58:8444/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://194[.]87[.]31[.]58:8444/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://194[.]87[.]31[.]58:8444/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://194[.]87[.]31[.]58:8444/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://194[.]87[.]31[.]58:8444/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://194[.]87[.]31[.]58:8444/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll |
RecordBreaker |
| URL | hxxps://api[.]telegram[.]org/bot6451035249:AAF4aXcjE9hZyAlDoFqRoxDvaCcVNGM1SGQ/sendMessage?chat_id=6527793614 hxxps://api[.]telegram[.]org/bot6675795591:AAHOLjdFZlj5nOPVfUfGykzyEUFz4fRG_10/sendMessage?chat_id=6131056872 hxxps://api[.]telegram[.]org/bot6419786954:AAG-8viGVDoGmC2CrUGDLpxfgdrqnRKve-8/sendMessage?chat_id=6465958501 |
Snake Keylogger |
| URL | hxxp://94[.]130[.]189[.]55:7070/upgrade[.]zip hxxp://49[.]12[.]118[.]149/upgrade[.]zip |
Vidar |
| URL | hxxp://zentrem39[.]xyz/777/skx0EHz[.]exe | SystemBC |
| URL | hxxp://103[.]72[.]68[.]128/M1610T/smss[.]exe hxxp://95[.]214[.]27[.]15/secured/wp/DH[.]exe hxxp://95[.]214[.]27[.]15/secured/wp/aao[.]exe hxxp://45[.]81[.]39[.]123/ezy[.]exe hxxp://23[.]95[.]106[.]4/Tuesday/Tues[.][.][.][.][.]exe hxxp://192[.]3[.]108[.]47/iso/bh[.]txt hxxp://192[.]3[.]108[.]47/iso/HTMLcache[.]dOC hxxp://95[.]214[.]27[.]121/whathaveyou[.]txt hxxp://95[.]214[.]27[.]121/eggoflife[.]vbs hxxp://185[.]147[.]34[.]144/windows/HTMLcache[.]dOC hxxp://192[.]3[.]108[.]47/2114/FF/RBLnetwork[.]vbs hxxps://api[.]telegram[.]org/bot6489103167:AAF1n7kNOA23164w6nqkLEdADOeGZFRdZ4Q/ hxxp://192[.]3[.]108[.]47/2114/UBC[.]txt hxxps://wmat[.]online/document/documentpau[.]exe hxxps://api[.]telegram[.]org/bot6195347596:AAEcfICg0VkZoFx7jSt2F_Rrntf660uyqYU/ hxxps://api[.]telegram[.]org/bot6267507526:AAEu4Qtw-Uavd3XrfyK3tc5MM38JghrSRu8/ hxxp://95[.]214[.]27[.]15/secured/wp/PO[.]pdf[.]exe hxxp://95[.]214[.]27[.]15/secured/wp/raaa[.]exe hxxp://95[.]214[.]27[.]15/secured/wp/txx[.]exe hxxps://api[.]telegram[.]org/bot6169512239:AAG_JVNS6OHxjToe7r8jcI0En2H7E1rTQhs/ |
Agent Tesla |
| URL | hxxps://h4ck3r[.]ml:8443/jquery-3[.]3[.]1[.]min[.]js hxxp://175[.]178[.]162[.]251/push hxxps://www[.]edittns[.]com/jquery-3[.]3[.]1[.]min[.]js hxxp://47[.]120[.]12[.]203/dpixel hxxp://103[.]39[.]78[.]153/pixel hxxps://82[.]156[.]29[.]211/ptj hxxps://qaq[.]social:8443/api/3 hxxp://124[.]221[.]156[.]245/ga[.]js hxxp://45[.]9[.]74[.]19/updates[.]rss hxxp://154[.]194[.]53[.]168:8080/jquery-3[.]3[.]1[.]min[.]js hxxps://162[.]14[.]98[.]165/push hxxp://8[.]140[.]198[.]4:88/dot[.]gif hxxps://175[.]178[.]162[.]251/match hxxp://47[.]99[.]79[.]203:6666/ca hxxp://124[.]71[.]222[.]33:8088/ga[.]js hxxps://1[.]12[.]69[.]169/jquery-3[.]3[.]1[.]min[.]js hxxps://106[.]14[.]149[.]88:7443/fwlink hxxps://dash[.]dbzjk[.]top:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://ns[.]b1ing[.]com:2087/cm hxxp://47[.]99[.]79[.]203/match hxxps://115[.]159[.]115[.]41/IE9CompatViewList[.]xml hxxps://101[.]35[.]234[.]201:18443/cm hxxp://165[.]227[.]141[.]64/fwlink hxxps://www[.]siriusxm[.]online/xmlconnect hxxp://8[.]134[.]71[.]235/visit[.]js hxxps://www[.]himalware[.]cn/api/3 hxxps://47[.]96[.]116[.]171:8080/cm hxxps://165[.]227[.]141[.]64:4433/ca hxxp://92[.]63[.]196[.]45:81/fwlink hxxp://www[.]siriusxm[.]online/gv hxxps://119[.]3[.]93[.]61/Complete/echannel/W72NUBH3N hxxps://34[.]245[.]217[.]116/css/ hxxp://23[.]251[.]32[.]24/load hxxp://101[.]42[.]44[.]30/image/ hxxp://wordstt182[.]com:8080/develop/v5[.]10/M3HCONPDRLQ hxxp://175[.]178[.]99[.]133/ca hxxps://47[.]97[.]222[.]10:60443/pixel hxxp://8[.]134[.]71[.]235/pixel hxxp://43[.]138[.]30[.]109:7524/j[.]ad hxxps://43[.]138[.]30[.]109:7777/en_US/all[.]js hxxp://8[.]130[.]121[.]136:8888/fwlink hxxp://175[.]178[.]99[.]133:5555/load hxxps://47[.]97[.]222[.]10:30443/push hxxp://47[.]99[.]79[.]203/cx hxxp://165[.]227[.]141[.]64/cx hxxp://54[.]183[.]172[.]133/load hxxp://1[.]13[.]158[.]52:8099/dot[.]gif hxxp://43[.]138[.]30[.]109:8888/pixel hxxp://118[.]89[.]71[.]205:9999/activity hxxp://121[.]40[.]66[.]171:85/IE9CompatViewList[.]xml hxxp://77[.]242[.]250[.]36/match hxxps://51[.]255[.]17[.]167:4433/async/ddljson hxxps://47[.]115[.]215[.]203/__utm[.]gif hxxp://109[.]205[.]56[.]206/visit[.]js hxxps://tadkadfads[.]beauty:2083/api/3 |
Cobalt Strike |
| URL | hxxps://nbvcdrtyup584wd[.]com/lander/edge_1695214167/_index[.]php hxxps://nbvcdrtyup584wd[.]com/ZgbN19Mx hxxps://nbvcdrtyup584wd[.]com/vvmd54/ hxxps://nbvcdrtyup584wd[.]com/lander/chrome_1695206714/_index[.]php hxxps://ral[.]layout[.]oystergardens[.]us/editContent hxxps://oqk[.]layout[.]oystergardens[.]us/editContent hxxps://vvv[.]layout[.]oystergardens[.]us/editContent hxxps://zzona[.]layout[.]oystergardens[.]us/editContent hxxps://yiw[.]layout[.]oystergardens[.]us/editContent hxxps://izmkh[.]layout[.]oystergardens[.]us/editContent |
FAKEUPDATES |
| URL | hxxps://www[.]pubgh4cks[.]com/downloads/Ermnnolfu[.]exe hxxp://185[.]254[.]37[.]80/Qconngovaq[.]exe |
zgRAT |
| URL | hxxp://195[.]201[.]90[.]237/DrDMr/presi hxxp://116[.]203[.]159[.]191/yAGmH/Exped hxxp://140[.]82[.]31[.]164/CKED/Aeros hxxp://45[.]63[.]106[.]193/PmpZ/outcu hxxp://128[.]140[.]102[.]132/iuvinoB/Verva |
Pikabot |
| URL | hxxp://103[.]186[.]65[.]80/79/audiodgse[.]exe hxxp://103[.]186[.]65[.]80/ijc/2/HTMLcache[.]doc |
Remcos |
| URL | hxxp://101[.]99[.]75[.]183/MfoGYZkxZIl205[.]bin | CloudEyE |
| URL | hxxp://103[.]30[.]11[.]15/6u6/sihost[.]exe hxxp://185[.]28[.]39[.]18:7777/185[.]28[.]39[.]18/officialzx[.]exe |
LokiBot |
| URL | hxxp://zentrem39[.]xyz/777/mtxzfSd[.]exe | Phobos |
| URL | hxxp://185[.]228[.]1[.]41/nonsilent[.]zip hxxp://185[.]228[.]1[.]41/payload[.]zip hxxp://185[.]228[.]1[.]41/mips[.]bruh hxxp://185[.]228[.]1[.]41/silent[.]exe hxxp://185[.]228[.]1[.]41/sh4[.]bruh hxxp://185[.]228[.]1[.]41/x32[.]bruh hxxp://185[.]228[.]1[.]41/ppc[.][.]bruh hxxp://185[.]228[.]1[.]41/ss/arm7[.]bruh hxxp://185[.]228[.]1[.]41/arm7[.]bruh hxxp://185[.]228[.]1[.]41/ppc[.]bruh hxxp://185[.]228[.]1[.]41/m68k[.]bruh hxxp://185[.]228[.]1[.]41/arm5[.]bruh hxxp://185[.]228[.]1[.]41/mipsel[.]bruh hxxp://185[.]228[.]1[.]41/arm6[.]bruh hxxp://185[.]228[.]1[.]41/i586[.]bruh hxxp://185[.]228[.]1[.]41/arm4[.]bruh hxxp://185[.]228[.]1[.]41/xmr[.]ino hxxp://185[.]228[.]1[.]41/troll[.]ino hxxp://185[.]228[.]1[.]41/bruh[.]sh |
XMRig |
| URL | hxxp://185[.]228[.]1[.]41/x86[.]bruh hxxp://104[.]168[.]24[.]242/Ayedz[.]Armv61 hxxp://104[.]168[.]24[.]242/Ayedz[.]mipsel hxxp://104[.]168[.]24[.]242/Ayedz[.]mips hxxp://104[.]168[.]24[.]242/Ayedz[.]i686 hxxp://104[.]168[.]24[.]242/Ayedz[.]i586 |
Bashlite |
| URL | hxxp://143[.]92[.]58[.]180:8000/d-8/ | Nitol |
| URL | hxxp://5[.]42[.]92[.]88/loghub/master | Mystic Stealer |
| URL | hxxps://r[.]rewdio[.]fun/port04/log[.]php hxxps://r[.]rewdio[.]fun/port04/web[.]txt hxxps://remote[.]mynameisnavid[.]site/config hxxps://remote[.]mynameisnavid[.]site/config/-1001969964453 hxxps://remote[.]mynameisnavid[.]site/api hxxps://remote[.]mynameisnavid[.]site/api/-1001969964453 hxxps://saerveradf[.]lol/amir/web[.]txt hxxps://saerveradf[.]lol/amir/log[.]php hxxps://saerveradf[.]lol/amir hxxps://bopun[.]fun/hiro hxxps://bopun[.]fun/hiro/web[.]txt hxxps://bopun[.]fun/hiro/log[.]php hxxps://nwsee[.]bond/fane/app[.]apk hxxps://appfinez[.]hair/vvip12 hxxps://appfinez[.]hair/vvip12/web[.]txt hxxps://appfinez[.]hair/vvip12/phone[.]txt hxxps://appfinez[.]hair/vvip12/log[.]php hxxps://remote[.]mynameisnavid[.]site/config/-1001980633491 hxxps://remote[.]mynameisnavid[.]site/api/-1001980633491 hxxps://remote[.]mynameisnavid[.]site/config/-10018973037478 hxxps://remote[.]mynameisnavid[.]site/api/-1001897303747 hxxps://nima[.]alureza0021[.]xyz/nima hxxps://nima[.]alureza0021[.]xyz/nima/log[.]php hxxps://nima[.]alureza0021[.]xyz/nima/web[.]txt hxxps://saerveradf[.]lol/Fikow/phone[.]txt hxxps://saerveradf[.]lol/Fikow/web[.]txt hxxps://saerveradf[.]lol/Fikow/log[.]php hxxps://saerveradf[.]lol/Fikow hxxps://remote[.]mynameisnavid[.]site/api/-1001944075895 hxxps://edsahamir[.]com/%F0%9D%90%9C%E2%80%8C%E2%80%8C/app[.]php hxxps://remote[.]mynameisnavid[.]site/config/-1001944075895 hxxps://edsahamir[.]com//app[.]php |
IRATA |
