不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様22社 -
2023/12/05
※2023/12/05 更新
マルウェア感染させると考えられるURLを検知（2023/12/05）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]153[.]184[.]199/az[.]exe hxxps://pasteio[.]com/raw/xRLFvVQQUHlv |
Remcos |
| URL | hxxp://5[.]252[.]176[.]77/SOFT_KNITTING[.]exe hxxp://5[.]252[.]176[.]77/LEGISLATIVE_COUSIN[.]exe |
Sliver |
| URL | hxxp://143[.]110[.]162[.]255:81/demon[.]dll | Havoc |
| URL | hxxp://5[.]252[.]176[.]77/reverse[.]exe | Meterpreter |
| URL | hxxp://45[.]153[.]184[.]199/us[.]exe | Rhadamanthys |
| URL | hxxp://185[.]196[.]8[.]238/Ennytypip[.]exe hxxp://163[.]123[.]142[.]171:8080/file/1701517649-explorer[.]exe |
zgRAT |
| URL | hxxp://45[.]153[.]184[.]199/file[.]exe | SmokeLoader |
| URL | hxxp://185[.]172[.]128[.]121/ma[.]exe | Coinminer |
| URL | hxxps://getwiththelingo[.]com/a3A7qLVn hxxps://getwiththelingo[.]com/fEOV2v/ hxxps://marybskitchen[.]com/a3A7qLVn hxxps://marybskitchen[.]com/fEOV2v/ |
ClearFake |
| URL | hxxps://kalplerderyakadardan[.]net/YjM0YWMzZjQ5YzQz/ hxxps://ahvahetmegelkalda[.]com/YjM0YWMzZjQ5YzQz/ hxxps://sybrailevip[.]com/YjM0YWMzZjQ5YzQz/ hxxps://kalkgelsybradan[.]com/YjM0YWMzZjQ5YzQz/ hxxps://kamalaktandagel[.]com/YjM0YWMzZjQ5YzQz/ hxxps://bukoshmuko[.]top/ZTZkNTJjNTkwYzk3/ hxxps://cmdtoorocto[.]com[.]tr/CfK3ulGypS7Nns81/ hxxps://auxtoorocto[.]com[.]tr/CfK3ulGypS7Nns81/ hxxps://auxocto[.]com[.]tr/CfK3ulGypS7Nns81/ |
Coper |
| URL | hxxp://80[.]66[.]75[.]214/g8djmsaxA/Login[.]php hxxp://77[.]91[.]76[.]37/g8samsA2/Login[.]php hxxp://185[.]196[.]8[.]195/u6vhSc3PPq/Login[.]php |
Amadey |
| URL | hxxp://chairtrainlineadju[.]pw/api hxxp://payfrecklematurei[.]pw/api hxxp://wriggleregisterycos[.]pw/api hxxp://slantrearperiosdew[.]pw/api |
Lumma Stealer |
| URL | hxxp://unzip2[.]xyz/api/3 hxxp://45[.]134[.]225[.]243/ptj hxxp://47[.]236[.]70[.]51/match hxxp://1[.]14[.]92[.]24:10001/activity hxxp://43[.]138[.]30[.]109:8888/load hxxp://134[.]122[.]75[.]115:23/push hxxp://8[.]131[.]118[.]10/match hxxp://101[.]43[.]96[.]246/en_US/all[.]js hxxp://134[.]122[.]75[.]115/IE9CompatViewList[.]xml hxxp://43[.]138[.]66[.]190:8848/pixel hxxp://43[.]138[.]30[.]109:7524/activity hxxp://134[.]122[.]75[.]115:26/ga[.]js hxxp://www[.]hainanwctvme[.]xyz:8080/image/ hxxp://115[.]159[.]50[.]50:8099/image/ hxxp://101[.]43[.]109[.]197/api/getit hxxp://43[.]138[.]30[.]109:9999/ga[.]js hxxp://111[.]229[.]142[.]238:88/c/msdownload/update/others/2022/03/29136388_ hxxp://186[.]64[.]113[.]28/__utm[.]gif hxxps://baidusec[.]top:2053/panel hxxps://esg[.]baidusec[.]top:2053/panel hxxps://dsf[.]baidusec[.]top:2053/RELEASE hxxps://dns[.]baidusec[.]top:2053/RELEASE hxxps://biaozhu[.]baidusec[.]top:2053/FAQ hxxp://124[.]70[.]154[.]188/pixel[.]gif |
Cobalt Strike |
| URL | hxxp://185[.]242[.]86[.]164/365c1d12[.]php hxxp://004242cm[.]nyashland[.]top/PythonGeoflowergeneratorTrackdatalifewpcdncentral[.]php hxxp://666541cm[.]nyashland[.]top/eternalJslowProcessflowergeneratordownloads[.]php hxxps://textbin[.]net/raw/ld17s2rgt9 hxxp://www[.]zubareff[.]site/L1nc0In[.]php |
DCRat |
| URL | hxxp://64[.]188[.]18[.]200/kQSBXpzGP82[.]bin hxxp://107[.]150[.]18[.]101/UtceFfBVBj247[.]bin hxxp://185[.]255[.]114[.]18/buRosV251[.]bin hxxp://185[.]255[.]114[.]18/XZaKPIFpdX212[.]bin hxxp://185[.]255[.]114[.]18/tVUnLufZDSWdfmZBWtcolpoPlKY173[.]bin hxxp://185[.]255[.]114[.]18/saAQTwAhhbIgiymZXhrDV202[.]bin hxxp://185[.]29[.]11[.]62/CsIXdKbJ230[.]bin hxxp://185[.]29[.]11[.]62/ODwBVLCKeulToWA204[.]bin hxxp://91[.]92[.]251[.]244/OIxKuyvWHgyVxJcMEKZ157[.]bin hxxp://34[.]82[.]253[.]169/xemAI197[.]bin hxxp://34[.]82[.]253[.]169/uyWiH22[.]bin |
CloudEyE |
| URL | hxxp://193[.]233[.]132[.]15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://193[.]233[.]132[.]15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://193[.]233[.]132[.]15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://193[.]233[.]132[.]15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://193[.]233[.]132[.]15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://193[.]233[.]132[.]15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll |
RecordBreaker |
| URL | hxxps://api[.]telegram[.]org/bot6439280362:AAFxJ6Gm_hfG3MYnjXvw0e4QQEIFTsOjkuk/ hxxps://discord[.]com/api/webhooks/1154163108810588211/AgBZL7rJGi1lCJ3uO1rvgKfc1qmRuByZTYoR6aW5Mhtyib0G80WMYTnWUdgK97WvE8rG hxxps://discord[.]com/api/webhooks/1179499222463168573/PVUpZ1J1JtDuKSWVcXWilMvIlKb2Qchu7QhEEb_1sKVtTXLAEfM5aRMADIF1EWL0ZjkF hxxp://91[.]92[.]242[.]91/boltman[.]vbs hxxp://192[.]3[.]179[.]162/263/wlanext[.]exe hxxp://91[.]92[.]250[.]236/saVTU[.]exe hxxp://192[.]3[.]179[.]162/sbg/microsofttoldemetheywanttodeletehistorycatchcookiefrommypc[.]doc |
Agent Tesla |
| URL | hxxp://23[.]227[.]196[.]198/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://94[.]103[.]93[.]70/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://178[.]20[.]41[.]15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll |
Raccoon |
| URL | hxxp://91[.]92[.]245[.]76/autorun[.]exe | RedLine Stealer |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1180644855395926076/1180644973209727026/RuntimeBroker[.]exe | Hancitor |
| URL | hxxp://91[.]92[.]250[.]161/files/InstallSetup2[.]exe | Glupteba |
| URL | hxxp://91[.]92[.]250[.]161/files/Umr[.]exe | Stealc |
| URL | hxxps://cnt[.]sync[.]oystergardens[.]club/editContent hxxps://fyj[.]sync[.]oystergardens[.]club/editContent hxxps://gewji[.]sync[.]oystergardens[.]club/editContent |
FAKEUPDATES |
| URL | hxxp://91[.]92[.]250[.]161/files/Random[.]exe | Socks5 Systemz |
| URL | hxxps://darklight[.]website/port1/ hxxps://darklight[.]website/port1/Received[.]php hxxps://darklight[.]website/port1/link[.]txt |
IRATA |
