不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様10社 -
2023/11/30
※2023/11/30 更新
マルウェア感染させると考えられるURLを検知（2023/11/30）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://178[.]128[.]238[.]137/index[.]php/Pjq5DkYz3n65Ucz8kt60u2Y0Stf6QR hxxp://sempersim[.]su/a20/fre[.]php hxxp://china[.]dhabigroup[.]top/_errorpages/B13zx[.]exe hxxps://sempersim[.]su/b13/fre[.]php |
LokiBot |
| URL | hxxps://52[.]91[.]10[.]228/build[.]exe | RedLine Stealer |
| URL | hxxps://doctorkiki[.]me/X4282h hxxps://delaneymc[.]com/fEOV2v/ hxxps://delaneymc[.]com/a3A7qLVn hxxps://delaneymc[.]com/X4282h |
ClearFake |
| URL | hxxps://informativosatelital[.]com/GetImageData[.]php hxxps://nelubelei[.]com/cdn-vs/get[.]php hxxps://nelubelei[.]com/cache/qzwewmrqqgqnaww[.]php hxxps://hrpg[.]sync[.]oystergardens[.]club/editContent hxxps://powvj[.]sync[.]oystergardens[.]club/editContent hxxps://dece[.]sync[.]oystergardens[.]club/editContent |
FAKEUPDATES |
| URL | hxxp://floozielyhowevermist[.]pw/api hxxp://glovesslave[.]fun/api hxxp://loogsporus[.]pw/api |
Lumma Stealer |
| URL | hxxp://phoenixexec[.]icu/40d570f44e84a454[.]php hxxp://5[.]42[.]64[.]41/2a7743b8bbd7e4a7/sqlite3[.]dll hxxp://5[.]42[.]64[.]41/2a7743b8bbd7e4a7/nss3[.]dll hxxp://5[.]42[.]64[.]41/2a7743b8bbd7e4a7/mozglue[.]dll hxxp://5[.]42[.]64[.]41/2a7743b8bbd7e4a7/freebl3[.]dll hxxp://5[.]42[.]64[.]41/2a7743b8bbd7e4a7/vcruntime140[.]dll hxxp://5[.]42[.]64[.]41/2a7743b8bbd7e4a7/msvcp140[.]dll hxxp://5[.]42[.]64[.]41/2a7743b8bbd7e4a7/softokn3[.]dll hxxp://91[.]242[.]229[.]100/1ee6f9dfba0b4782/mozglue[.]dll hxxp://91[.]242[.]229[.]100/1ee6f9dfba0b4782/sqlite3[.]dll hxxp://91[.]242[.]229[.]100/1ee6f9dfba0b4782/freebl3[.]dll hxxp://91[.]242[.]229[.]100/1ee6f9dfba0b4782/nss3[.]dll hxxp://91[.]242[.]229[.]100/1ee6f9dfba0b4782/msvcp140[.]dll hxxp://91[.]242[.]229[.]100/1ee6f9dfba0b4782/softokn3[.]dll hxxp://91[.]242[.]229[.]100/1ee6f9dfba0b4782/vcruntime140[.]dll hxxp://91[.]242[.]229[.]100/9cb3d6163ee69f03[.]php |
Stealc |
| URL | hxxp://95[.]164[.]22[.]193/toSecurePacketGameProtectDatalifeCentral[.]php hxxp://195[.]20[.]16[.]116/imagejavascriptSecureUpdateServerlinuxWindowsDle[.]php hxxp://37[.]220[.]86[.]210/db/serverprocessor/testpacket/PhpUpdatelongpoll[.]php hxxp://89[.]23[.]101[.]210/Flower/EternalPipegenerator[.]php |
DCRat |
| URL | hxxp://37[.]49[.]230[.]152/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://37[.]49[.]230[.]152/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://37[.]49[.]230[.]152/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://37[.]49[.]230[.]152/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://37[.]49[.]230[.]152/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://37[.]49[.]230[.]152/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://37[.]49[.]230[.]152/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll |
RecordBreaker |
| URL | hxxp://94[.]131[.]207[.]194:83/webplugin[.]exe | DarkComet |
| URL | hxxps://gons32cl[.]top/build[.]exe | Vidar |
| URL | hxxps://amtri[.]ma/opc/ | IcedID |
| URL | hxxps://101[.]42[.]4[.]81/ga[.]js hxxps://starinteriordesigns[.]com/design/query/9X5M3SOE0F hxxps://47[.]104[.]179[.]218/dot[.]gif hxxp://118[.]89[.]71[.]205:9999/ca hxxp://147[.]78[.]47[.]231:7777/fwlink hxxp://124[.]71[.]205[.]116:801/push hxxps://146[.]185[.]22[.]148/__utm[.]gif hxxps://114[.]115[.]185[.]63/IE9CompatViewList[.]xml hxxp://39[.]107[.]123[.]144:81/pixel[.]gif hxxp://116[.]196[.]106[.]249:801/load hxxp://43[.]198[.]94[.]41:800/cm hxxp://134[.]122[.]75[.]115:26/en_US/all[.]js hxxp://39[.]101[.]198[.]2:8444/g[.]pixel hxxp://129[.]226[.]83[.]129:9999/j[.]ad hxxp://134[.]122[.]75[.]115:23/cm hxxp://42[.]193[.]14[.]173:3333/cx hxxp://8[.]222[.]155[.]61/fwlink hxxps://cmtscbt[.]bsnl[.]wiki:2087/Contact/termsofuse/ITU8UYG7 |
Cobalt Strike |
| URL | hxxp://china[.]dhabigroup[.]top/_errorpages/zackzx[.]exe | Formbook |
| URL | hxxp://94[.]156[.]71[.]74/hjk[.]exe hxxp://94[.]156[.]71[.]74/eta[.]exe |
zgRAT |
| URL | hxxps://pasteio[.]com/raw/xGm2okFRNqtP | XWorm |
| URL | hxxp://194[.]38[.]20[.]106/kinsing hxxp://194[.]38[.]20[.]106/kinsing_aarch64 |
Kinsing |
| URL | hxxp://194[.]5[.]249[.]115/files/3[.]exe hxxp://185[.]172[.]128[.]19/ghsdh39s/index[.]php |
Amadey |
| URL | hxxp://cynorix[.]com/netTimer[.]exe | Agent Tesla |
| URL | hxxps://jz520[.]top/wp-includes/iQFIlIrWoaVFrbG0[.]bin | Azorult |
| URL | hxxps://pasteio[.]com/raw/x50sq16M5tmr | Remcos |
