不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/10/31
※2023/10/31 更新
マルウェア感染させると考えられるURLを検知（2023/10/31）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://jsj[.]result[.]garrettcountygranfondo[.]org/editContent hxxps://poibvyctm21e[.]com/vvmd54/ hxxps://xmqpj[.]result[.]garrettcountygranfondo[.]org/editContent hxxps://ehm[.]result[.]garrettcountygranfondo[.]org/editContent |
FAKEUPDATES |
| URL | hxxps://ourladyfatima[.]org/cbse/dhaaxmjsdKiF174[.]bin hxxp://ourladyfatima[.]org/cbse/yFXlj171[.]bin hxxp://ourladyfatima[.]org/cbse/knHMXiJ33[.]bin |
CloudEyE |
| URL | hxxp://bidbur[.]com/494fac8b0beb96d3/freebl3[.]dll hxxp://bidbur[.]com/494fac8b0beb96d3/nss3[.]dll hxxp://bidbur[.]com/494fac8b0beb96d3/msvcp140[.]dll hxxp://bidbur[.]com/494fac8b0beb96d3/mozglue[.]dll hxxp://bidbur[.]com/494fac8b0beb96d3/sqlite3[.]dll hxxp://bidbur[.]com/494fac8b0beb96d3/vcruntime140[.]dll hxxp://bidbur[.]com/494fac8b0beb96d3/softokn3[.]dll hxxp://dl2-broomcleaner[.]online/timeSync[.]exe hxxp://michaelcoleman[.]icu/timeSync[.]exe |
Stealc |
| URL | hxxp://146[.]190[.]157[.]174/f5wBqfdsw44C35W hxxp://146[.]190[.]157[.]174/SY55xQoxsn8jUEveKzYo |
LokiBot |
| URL | hxxp://pois[.]in:8010/_az/ hxxp://37[.]72[.]175[.]157:8080/chi/index[.]php hxxp://149[.]56[.]173[.]78:8080/break/ hxxp://209[.]61[.]195[.]213:8080/cass/index[.]php hxxp://209[.]61[.]195[.]213:8080/naz/index[.]php hxxp://work[.]wrklantc[.]in:9050/_az/ hxxp://104[.]152[.]185[.]198:8080/calm/index[.]php hxxp://178[.]216[.]50[.]18:8080/007/index[.]php hxxp://104[.]171[.]121[.]51:8080/cool/index[.]php hxxp://ruiw[.]shop/ML341/index[.]php |
Azorult |
| URL | hxxp://goodlocka[.]pw/api hxxp://guhomush[.]pw/api hxxp://volkstera[.]fun/api hxxp://kowersize[.]fun/api |
Lumma Stealer |
| URL | hxxp://134[.]195[.]211[.]181:987/ExOQ hxxps://setrester[.]com/stop/v6[.]62/B6B0LQMJ hxxp://101[.]43[.]170[.]225:7777/IE9CompatViewList[.]xml hxxp://databasewebdevelopment[.]com:1080/ku[.]js hxxp://194[.]26[.]135[.]137/cx hxxp://175[.]178[.]3[.]16:8000/jquery-3[.]3[.]1[.]min[.]js hxxp://106[.]54[.]227[.]251:5000/ga[.]js hxxps://110[.]40[.]184[.]247/dot[.]gif hxxp://106[.]14[.]75[.]240:8099/__utm[.]gif hxxp://124[.]220[.]215[.]247/dpixel hxxp://101[.]43[.]165[.]220/activity hxxp://123[.]207[.]20[.]16:7777/IE9CompatViewList[.]xml hxxp://viapaths[.]co[.]uk/resources/main[.]js hxxps://cs[.]10011[.]fun/match hxxp://118[.]89[.]125[.]171:6536/axCA |
Cobalt Strike |
| URL | hxxp://www[.]clinkccaddress[.]com/index[.]php/ hxxp://www[.]fidgetiesout[.]com/index[.]php/ hxxp://www[.]frivoloument[.]com/index[.]php/ hxxp://www[.]influenceted[.]com/index[.]php/ hxxp://www[.]infoanalysiser[.]com/index[.]php/ hxxp://www[.]irritabletion[.]com/index[.]php/ hxxp://www[.]likewisemeticulous[.]com/index[.]php/ hxxp://www[.]sblinfo[.]pw/index[.]php/ hxxp://www[.]tendenctioned[.]com/index[.]php/ hxxp://www[.]zhxxjs[.]pw/Info/ |
Socelars |
| URL | hxxp://141[.]98[.]6[.]91/1903/1/k/HTMLhistoryClearner[.]dOC hxxp://141[.]98[.]6[.]91/1903/2/m/HTMLHisotoryCleaner[.]dOC hxxp://141[.]98[.]6[.]91/1903/1/KEW[.]txt hxxp://141[.]98[.]6[.]91/1903/2/MAW[.]txt hxxps://api[.]telegram[.]org/bot6871248669:AAHeH0Pt2_xQzqpk-Y-yYzlE0-6gMnOq9LY/ hxxps://api[.]telegram[.]org/bot6844391207:AAEoYEcquhCHcS6v4KgTHwbMtmke4qhItRo/ hxxps://atelierzolotas[.]com/work/83461806[.]IMG |
Agent Tesla |
| URL | hxxp://178[.]218[.]146[.]89/x-8[.]6-[.]Sakura hxxp://178[.]218[.]146[.]89/m-p[.]s-l[.]Sakura hxxp://178[.]218[.]146[.]89/p-p[.]c-[.]Sakura hxxp://178[.]218[.]146[.]89/a-r[.]m-4[.]Sakura hxxp://178[.]218[.]146[.]89/x-3[.]2-[.]Sakura hxxp://178[.]218[.]146[.]89/m-6[.]8-k[.]Sakura hxxp://178[.]218[.]146[.]89/a-r[.]m-6[.]Sakura hxxp://178[.]218[.]146[.]89/i-5[.]8-6[.]Sakura hxxp://178[.]218[.]146[.]89/s-h[.]4-[.]Sakura hxxp://178[.]218[.]146[.]89/a-r[.]m-5[.]Sakura hxxp://178[.]218[.]146[.]89/a-r[.]m-7[.]Sakura hxxp://178[.]218[.]146[.]89/m-i[.]p-s[.]Sakura |
Bashlite |
| URL | hxxps://api[.]telegram[.]org/bot6156533308:AAGhZIuuJLmTGWzMUHA3YxFXCaiT_llfToI/sendMessage?chat_id=5986156290 hxxps://api[.]telegram[.]org/bot6491126749:AAEgYHjfebL8yDkuzneMucym5CaT8YIRGJE/sendMessage?chat_id=5262627523 |
Snake Keylogger |
| URL | hxxp://194[.]169[.]175[.]118/trafico[.]exe | RedLine Stealer |
| URL | hxxp://5[.]45[.]85[.]201/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://5[.]45[.]85[.]201/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://5[.]45[.]85[.]201/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://5[.]45[.]85[.]201/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://5[.]45[.]85[.]201/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://5[.]45[.]85[.]201/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://5[.]45[.]85[.]201/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll |
RecordBreaker |
| URL | hxxps://otcworldmedia[.]com/DOC757869856647[.]zip | STRRAT |
| URL | hxxp://albertwashington[.]art/timeSync[.]exe | Mars Stealer |
| URL | hxxps://uc2785eef775b6a9355a2f0073ea[.]dl[.]dropboxusercontent[.]com/cd/0/get/CGnzdSBC_XkSHX4UDeyuC07L6UT_Xertz6RwNm53KggdbLrv226vXsz9AZ0-fxH8gACfQSDIdh1LniWcJZhjbmjeA78Vn85NILpX0tVngD4q0YmG3OObpxofwn3ztLYyvXQOw_e3aohf6iU1DzApOW5-/file?dl=1 | Metamorfo |
| URL | hxxp://mail[.]treeoflifeadventures[.]com/wp-content/plugins/70d5e28f51c1438d94e3e6dc84b95311/xt/mmd/shell/jujukhanis2[.]1[.]exe | Formbook |
| URL | hxxp://zamned5342[.]xyz/777/skxtweF[.]exe | SystemBC |
| URL | hxxp://zamned5342[.]xyz/777/mtxOXW0[.]exe | Phobos |
| URL | hxxp://188[.]34[.]192[.]184/76DKN6/Unpat | Pikabot |
| URL | hxxp://345727892cm[.]whiteproducts[.]ru/L1nc0In[.]php | DCRat |
| URL | hxxps://onedrive[.]live[.]com/download?resid=5966EA597906CF8B%21114&authkey=!AEXnhW17iJnuIr0&em=2 | Xloader |
| URL | hxxp://5[.]75[.]209[.]4/getfiles[.]zip hxxp://195[.]201[.]249[.]33:2083/getfiles[.]zip |
Vidar |
