不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様0社 -
2023/12/18
※2023/12/18 更新
マルウェア感染させると考えられるURLを検知（2023/12/18）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://91[.]92[.]253[.]236/tSV0dUC1pYGjOvI[.]exe hxxp://91[.]92[.]253[.]236/Microsoftprofilecheckedhistorycachecookieeverythingdeletedornotfromthepc[.]Doc hxxp://91[.]92[.]253[.]11/thursdayexploitxla[.]exe |
Agent Tesla |
| URL | hxxp://103[.]116[.]52[.]127/m-6[.]8-k[.]SNOOPY hxxp://103[.]116[.]52[.]127/s-h[.]4-[.]SNOOPY hxxp://103[.]116[.]52[.]127/x-8[.]6-[.]SNOOPY hxxp://103[.]116[.]52[.]127/a-r[.]m-7[.]SNOOPY hxxp://103[.]116[.]52[.]127/i-5[.]8-6[.]SNOOPY hxxp://103[.]116[.]52[.]127/a-r[.]m-5[.]SNOOPY hxxp://103[.]116[.]52[.]127/m-i[.]p-s[.]SNOOPY hxxp://103[.]116[.]52[.]127/a-r[.]m-6[.]SNOOPY hxxp://103[.]116[.]52[.]127/m-p[.]s-l[.]SNOOPY hxxp://103[.]116[.]52[.]127/x-3[.]2-[.]SNOOPY hxxp://87[.]242[.]89[.]170/Demon[.]arm7 hxxp://87[.]242[.]89[.]170/Demon[.]mpsl hxxp://87[.]242[.]89[.]170/Demon[.]mips hxxp://87[.]242[.]89[.]170/Demon[.]arm5 hxxp://87[.]242[.]89[.]170/Demon[.]arm4 hxxp://87[.]242[.]89[.]170/Demon[.]arm6 |
Bashlite |
| URL | hxxp://5[.]42[.]65[.]125/newrock[.]exe hxxp://cream[.]hitsturbo[.]com/order/tuc5[.]exe hxxps://stoon[.]hitsturbo[.]com/order/tuc7[.]exe hxxp://stoon[.]hitsturbo[.]com/order/tuc5[.]exe hxxp://needs[.]hitsturbo[.]com/order/tuc2[.]exe hxxps://stoon[.]hitsturbo[.]com/order/tuc3[.]exe hxxps://needs[.]hitsturbo[.]com/order/tuc5[.]exe hxxps://needs[.]hitsturbo[.]com/order/tuc2[.]exe hxxp://needs[.]hitsturbo[.]com/order/tuc5[.]exe hxxp://needs[.]hitsturbo[.]com/order/tuc4[.]exe hxxp://needs[.]hitsturbo[.]com/order/tuc7[.]exe hxxp://stoon[.]hitsturbo[.]com/order/tuc7[.]exe hxxps://stoon[.]hitsturbo[.]com/order/tuc4[.]exe hxxps://stoon[.]hitsturbo[.]com/order/tuc6[.]exe hxxp://needs[.]hitsturbo[.]com/order/tuc3[.]exe hxxp://stoon[.]hitsturbo[.]com/order/tuc3[.]exe hxxp://stoon[.]hitsturbo[.]com/order/tuc6[.]exe hxxps://needs[.]hitsturbo[.]com/order/tuc6[.]exe hxxps://needs[.]hitsturbo[.]com/order/tuc7[.]exe hxxp://stoon[.]hitsturbo[.]com/order/tuc4[.]exe hxxps://needs[.]hitsturbo[.]com/order/tuc3[.]exe hxxps://needs[.]hitsturbo[.]com/order/tuc4[.]exe hxxps://stoon[.]hitsturbo[.]com/order/tuc5[.]exe hxxp://stoon[.]hitsturbo[.]com/order/tuc2[.]exe hxxp://needs[.]hitsturbo[.]com/order/tuc6[.]exe hxxps://stoon[.]hitsturbo[.]com/order/tuc2[.]exe hxxp://hitsturbo[.]com/order/tuc3[.]exe hxxps://hitsturbo[.]com/order/tuc5[.]exe hxxp://hitsturbo[.]com/order/tuc7[.]exe hxxps://hitsturbo[.]com/order/tuc7[.]exe hxxps://hitsturbo[.]com/order/tuc3[.]exe hxxps://hitsturbo[.]com/order/tuc6[.]exe hxxp://hitsturbo[.]com/order/tuc5[.]exe hxxp://hitsturbo[.]com/order/tuc6[.]exe hxxps://hitsturbo[.]com/order/tuc4[.]exe hxxps://hitsturbo[.]com/order/tuc2[.]exe hxxp://hitsturbo[.]com/order/tuc4[.]exe hxxp://hitsturbo[.]com/order/tuc2[.]exe hxxps://cream[.]hitsturbo[.]com/order/tuc4[.]exe hxxp://cream[.]hitsturbo[.]com/order/tuc4[.]exe hxxp://cream[.]hitsturbo[.]com/order/tuc7[.]exe hxxps://cream[.]hitsturbo[.]com/order/tuc6[.]exe hxxps://cream[.]hitsturbo[.]com/order/tuc3[.]exe hxxps://cream[.]hitsturbo[.]com/order/tuc5[.]exe hxxps://cream[.]hitsturbo[.]com/order/tuc7[.]exe hxxp://cream[.]hitsturbo[.]com/order/tuc6[.]exe hxxps://cream[.]hitsturbo[.]com/order/tuc2[.]exe hxxp://cream[.]hitsturbo[.]com/order/tuc2[.]exe hxxp://cream[.]hitsturbo[.]com/order/tuc3[.]exe |
Socks5 Systemz |
| URL | hxxps://bufetesanchezabogados[.]com/wp-content/uploads/1/Voice-Ai-beta[.]exe hxxp://178[.]236[.]247[.]164/files/c2[.]exe hxxp://occupytapsessijk[.]pw/api hxxps://lummaaass[.]site/2[.]exe hxxp://tidyrespectexpow[.]fun/api hxxp://lingerescapecleanwja[.]fun/api hxxp://leaffountainla[.]fun/api hxxp://idealruinrewardesw[.]fun/api hxxp://silveraquariumjwu[.]fun/api hxxp://twinconstellationjkal[.]fun/api hxxp://attachmentartikidw[.]fun/api hxxp://217[.]196[.]98[.]10/tool/qwe[.]exe |
Lumma Stealer |
| URL | hxxp://23[.]94[.]0[.]77:7733/svchost[.]exe hxxp://188[.]120[.]254[.]27/GeoSecure/Cpu/Http4voiddbPrivate/6PhpDownloadsPoll/videovmLineprocessAuthgameProtectBasetrackuploads[.]php hxxp://743823cm[.]nyashtech[.]top/JsRequestwindowsTraffictestdatalife[.]php hxxp://546346346dod[.]whiteproducts[.]ru/L1nc0In[.]php hxxp://650602cm[.]nyashtech[.]top/authapiWindows[.]php hxxp://714745cm[.]nyashland[.]top/nyashsupport[.]php |
DCRat |
| URL | hxxp://154[.]92[.]16[.]100/Admin/Mpclient[.]dll hxxps://carthagefire[.]net/uploads/1/4/2/5/TierDiagnosis[.]exe hxxps://carthagefire[.]net/uploads/1/4/2/5/last[.]hta |
AsyncRAT |
| URL | hxxps://146[.]70[.]87[.]70:8443/css3/index2[.]shtml hxxp://152[.]89[.]198[.]233/broadcast hxxp://31[.]44[.]184[.]232/fwlink hxxps://85[.]208[.]109[.]15/jquery-3[.]3[.]1[.]min[.]js hxxp://107[.]172[.]0[.]62:8873/questions/32251816/c-sharp-directives-compilation-error hxxp://45[.]136[.]14[.]51/fwlink hxxp://163[.]5[.]169[.]2/visit[.]js hxxp://139[.]224[.]188[.]165/__utm[.]gif hxxp://121[.]40[.]69[.]150:8001/__utm[.]gif hxxp://182[.]92[.]102[.]71:6666/load hxxp://110[.]41[.]11[.]72/match hxxp://103[.]176[.]178[.]88:8080/dot[.]gif hxxp://163[.]5[.]64[.]65/push hxxp://60[.]204[.]139[.]246/ga[.]js hxxp://8[.]222[.]162[.]81/match hxxp://147[.]78[.]47[.]183:82/en_US/all[.]js hxxp://147[.]78[.]47[.]183:81/pixel hxxp://5[.]188[.]183[.]171/ca hxxp://103[.]146[.]140[.]99/visit[.]js hxxp://121[.]40[.]254[.]24/cm hxxp://hahnevohjoo[.]spenserfitolife[.]com:8880/doFor/Credentials/76STLDEX hxxps://124[.]220[.]59[.]220/visit[.]js hxxp://77[.]242[.]250[.]36/jquery-3[.]3[.]1[.]min[.]js hxxp://42[.]193[.]178[.]194/api/x hxxp://152[.]136[.]128[.]162:12345/g[.]pixel hxxp://147[.]78[.]47[.]183:82/load hxxp://47[.]94[.]221[.]227/activity hxxp://43[.]153[.]222[.]28:4646/en_US/all[.]js hxxp://147[.]78[.]47[.]183:81/pixel[.]gif hxxp://192[.]124[.]176[.]11/Detect/remove/90J6CLSKNAIII hxxp://60[.]205[.]115[.]92:8080/pixel hxxp://186[.]64[.]113[.]28/ga[.]js hxxps://148[.]135[.]18[.]94/load hxxps://107[.]172[.]81[.]115/push hxxp://170[.]130[.]55[.]206/jquery-3[.]3[.]1[.]min[.]js hxxp://5[.]188[.]86[.]24/Produce/txt/RDI34HRI85 hxxp://microsoftsyst3m[.]com/Produce/txt/RDI34HRI85 hxxps://43[.]143[.]225[.]93/load hxxps://120[.]48[.]96[.]69/updates[.]rss hxxps://ruggioil[.]com/communicate/v1[.]13/FKGMJLRN hxxps://torusdt[.]vvvvvbeng[.]com/www/handle/doc hxxp://5[.]78[.]41[.]126/communicate/v1[.]13/FKGMJLRN hxxps://5[.]188[.]86[.]24/Produce/txt/RDI34HRI85 hxxps://microsoftsyst3m[.]com/Produce/txt/RDI34HRI85 hxxp://23[.]251[.]32[.]24/j[.]ad hxxp://47[.]120[.]37[.]45/pixel[.]gif hxxps://8[.]219[.]228[.]210/pixel[.]gif hxxps://47[.]106[.]235[.]23/ptj |
Cobalt Strike |
| URL | hxxps://beqweb[.]com/kgwn/ hxxps://ricc[.]in/xoigro/ hxxps://snaveenkumar[.]in/21p7vl/ hxxps://wisewriters[.]co[.]uk/wie/ hxxps://covelseminovos[.]com[.]br/xfnyaa/ hxxps://mathewwill[.]com/1kovfc/ hxxps://buckstile[.]co[.]zw/uyq/ hxxps://fixist[.]de/mvve16/ hxxps://noithatbod24h[.]com/r6ujw0/ hxxps://monitorperkaraktp[.]id/mkf/ hxxps://dreamkarts[.]com/o5punk/ hxxps://ec-habilitar[.]com/kvpe/ hxxps://khushheart[.]com/pkhz/ hxxps://aopolo[.]vn/xrt/ hxxps://andronikidis[.]gr/3nxw1/ hxxps://austerra[.]org/2lqj5/ hxxps://zamilcp[.]com/h26wo4/ hxxps://emprotel[.]net[.]bo/phh4/ hxxps://radteknoloji[.]com/zaoap/ hxxps://wiseeworld[.]com/ghhqg/ hxxps://shahab[.]pk/her/ hxxps://mishal[.]be/rbjc/ hxxps://travelkoja[.]net/vzo/ hxxps://jvelectromech[.]com/rstqrt/ hxxps://uniqueschoolbetul[.]com/tzvfr/ hxxps://highskyshipping[.]com/bpcqo1/ hxxps://trevcoproductions[.]com/aavqw/ hxxps://amc-fc[.]net/cqw5y/ hxxps://ekswood[.]com/fvncf/ hxxps://belafans[.]com[.]br/vfcb/ hxxps://metrokita[.]com/avhvgt/ hxxps://bosco[.]co[.]in/ieh7/ hxxps://vozimx[.]site/awb/ hxxps://jomsapotlokal[.]com[.]my/qpq8/ hxxps://nurelfalah[.]or[.]id/yzccdw/ hxxps://laptoprepairnearme[.]in/yozy8q/ hxxps://allday[.]co[.]id/f45k3c/ hxxps://fundacionsantasofiadeasis[.]com/3ph6/ hxxps://citvcharacato[.]com/one/ hxxps://enpozos[.]com/wyogz/ hxxps://cadnextbd[.]com/q9qqi/ hxxps://kemalak[.]com[.]my/szz/ hxxps://copacee-ges21[.]mx/jzs8zt/ hxxps://phoenixduran[.]com/fxanm/ hxxps://rsums[.]co[.]id/nxl1/ hxxps://itnsolution[.]co[.]in/hsdnv/ hxxps://smartstay[.]co[.]ke/l8bxtu/ hxxps://naessship[.]co[.]uk/jbixl/ hxxps://trumnapgame[.]online/alikbn/ hxxps://bharatakonstruksi[.]com/jy1or/ hxxps://lapetitesansebastian[.]com/xs7/ hxxps://tokoalkes-online[.]com/aankt/ hxxps://elecarb[.]com/wpctj9/ hxxps://jfao-ca[.]org/0cm/ hxxps://nextgen-surveillence[.]ca/6xptkk/ hxxps://ingeniadyd[.]com/ano0/ hxxps://eetiongmotorsports[.]com/sjzg/ hxxps://5thpillarpakistan[.]com[.]pk/vtncd/ hxxps://healthcareprofessionals[.]ca/wloogs/ hxxps://emgers[.]pe/biqqb/ hxxps://hrd[.]jkb[.]co[.]id/05c/ hxxps://martendigitals[.]com/ti9/ hxxps://directoriocreativo[.]site/rzi/ hxxps://cascade-wow[.]eu/tura27/ hxxps://kashishguptafitness[.]com/1ycey/ hxxps://birkelseeds[.]com/cdb/ hxxps://comunidadinclusiva[.]cl/jrxi/ hxxps://naessships[.]com/uzla4/ hxxps://uniquepainters[.]in/itxl6/ hxxps://zueem[.]com/lcpo/ hxxps://freshdew[.]org[.]ng/hf7tsr/ hxxps://given-itm[.]com/el1yt/ hxxps://elaphonline[.]com/f00/ hxxps://littlestarcasting[.]com/1atz/ hxxps://lpba-ils[.]com/cdeow/ hxxps://anando[.]xyz/w6i/ hxxps://panindiab2bdatabase[.]in/gdd/ hxxps://sector7[.]fun/x4m81/ hxxps://nmfakhry[.]com/sjh/ hxxps://ar2shop[.]com/wfmi/ hxxps://dvc[.]edu[.]vn/zaf/ hxxps://rasadnik-vocne-sadnice[.]rs/bvf/ hxxps://raziya[.]co[.]ke/v5yp/ hxxps://scaindia[.]co[.]in/xuu/ hxxps://carseatscomparison[.]com/nfc/ hxxps://amcolabora[.]or[.]id/rfh8nd/ hxxps://tkjnetid[.]biz[.]id/uwk1k/ hxxps://letsmanage[.]online/dchtt/ hxxps://minimarketivanita[.]com/gghst/ hxxps://educakolping[.]cl/fwttl/ hxxps://samathaspupusas[.]com/qrj/ hxxps://letsmanage[.]in/edc318/ hxxps://healthforyoualways[.]com/as0x/ hxxps://nkbshipping[.]com/e60sci/ hxxps://primetv[.]online/u0sc/ hxxps://phonefixers[.]com[.]au/ccry/ hxxps://fltstore[.]pk/gfpnsz/ hxxps://nexusfm[.]uk/07i/ hxxps://aryaninterior[.]co[.]in/sdwal/ hxxps://stairrunners[.]ca/7zdyt/ hxxps://imanifestnow[.]net/6vlb/ hxxps://edukarya[.]net/mnjf/ hxxps://kangarookids[.]ae/os9uz2/ hxxps://creditepentrutoti[.]ro/7iavv/ hxxps://geneqo[.]co[.]ke/h59/ hxxps://mustasharcom[.]ae/9zzlyf/ hxxps://iesanisidrodechocho[.]edu[.]co/pxijtn/ hxxps://taurusprotection[.]co[.]za/ckxoey/ hxxps://dipafood[.]com/fmac0/ hxxps://handytechnik[.]net/mtf2j/ hxxps://kojekkoja[.]com/kav/ hxxps://salarut[.]com/mdydjw/ hxxps://cragency[.]net/6ytqy/ hxxps://estudiointegraldearte[.]com/g7c/ hxxps://studiopro[.]com[.]br/5ir/ hxxps://baydevs[.]com/ajoy/ hxxps://swipeverse[.]in/vip8/ hxxps://soyradioapps[.]com/tf1ez/ hxxps://georgica[.]ro/gfq/ hxxps://tgagua[.]mx/cd20/ hxxps://alhashim-ac[.]com/u8l8/ hxxps://pdiboss[.]in/rxlyy/ hxxps://husk[.]ro/hgyy/ hxxps://cunmotor[.]co[.]id/3ff6tr/ hxxps://miningassociates[.]co[.]in/rjc/ hxxps://keenanholding[.]com/nimb/ hxxps://zamzamhotelbatu[.]com/xdw3j/ hxxps://senpaicontent[.]com/lv2xxp/ hxxps://powerpal[.]app/hmw/ hxxps://titikakamining[.]pe/hlxctk/ hxxps://viralbuzzcafe[.]com/snv/ hxxps://achgal[.]ma/veombq/ hxxps://tejaratbd[.]com/lbp/ hxxps://voguetales[.]com/biutyr/ hxxps://theshopnkart[.]com/auuqdw/ hxxps://prateektapes[.]com/a7zd/ hxxps://indohcf[.]com/gysmjj/ hxxps://egyptfurniture[.]org/kpuufj/ hxxps://neurosteo[.]net/gj5d/ hxxps://arewamirror[.]com[.]ng/hslps/ hxxps://eratek[.]co[.]id/wczylh/ hxxps://nextleveltranscription[.]com/kmiym/ hxxps://astroseyyah[.]com[.]tr/4vao/ hxxps://luwer[.]by/tam/ hxxps://socialwiki[.]com[.]br/fjwhn/ hxxps://medialive[.]stream/y8a/ hxxps://tradesspots[.]com/qpp/ hxxps://parmaradvisory[.]in/hcn/ hxxps://cofetariefocsani[.]ro/3uotc/ hxxps://nexskill[.]com/ijv/ hxxps://hobitronik[.]com/orekv2/ hxxps://myown[.]ng/8jp4f/ hxxps://whitevivid[.]com[.]my/uiwtw/ hxxps://sergiologan[.]com[.]br/uuh/ hxxps://royalbetwinner[.]in/puk/ hxxps://sirius[.]supplies/8sl/ hxxps://apkikoishow[.]com/ira/ hxxps://unanihealth[.]in/llhz/ hxxps://turftextile[.]com/cb80r/ hxxps://ethiotechaddis[.]com/n4r/ hxxps://nadianeonadv[.]com/oqngru/ hxxps://majortravelegypt[.]com/bhkl/ hxxps://staqssecurity[.]com/yozjm9/ hxxps://deviambarwati[.]com/sdd/ hxxps://yare[.]africa/w4ou/ hxxps://elaichiwala[.]com/ixlgc/ hxxps://100techhausa[.]com[.]ng/obihkv/ hxxps://hacc[.]com[.]sa/hbbgx/ hxxps://supersyntheticsbd[.]com/xa2bo/ hxxps://ktm-digit-innov[.]com/nvmyuf/ hxxps://tenshimarketing[.]com/mgqck/ hxxps://alexafurnitech[.]com/6val/ hxxps://acorrea[.]com[.]br/3uctzw/ hxxps://perfectwheels[.]com[.]sg/9kv8t/ hxxps://zebisama[.]pk/jhm8lu/ hxxps://speedymedia[.]com[.]br/wyg/ hxxps://hauli[.]co[.]tz/tat/ hxxps://3rt[.]site/lvh8i7/ hxxps://crevinut[.]com/joc/ hxxps://smkpgri2pasuruan[.]sch[.]id/q4vgqo/ hxxps://optimacosmetics[.]rs/axvbsp/ hxxps://eurologistic[.]am/nwzzjy/ hxxps://talkbali[.]com/kell6x/ hxxps://simpangbaramobile[.]com/7hpkn/ hxxps://jagrukmumbainews[.]com/tkbx/ hxxps://desatempur[.]id/eznuuc/ hxxps://ondemandservice[.]shop/ful9/ hxxps://fixist[.]net/d3cxg/ hxxps://linusco[.]com/mgh7qb/ hxxps://u-security[.]mx/w9z2w/ hxxps://timelesseleganttours[.]com/zj9/ hxxps://domusnostra-studio[.]ro/cbmjjv/ hxxps://santara[.]site/xxgtq3/ hxxps://threadsvideodownloaders[.]net/pc6/ hxxps://timbuktu[.]co[.]id/mupg/ hxxps://nypixie[.]com/uum47/ hxxps://tepee[.]com[.]tr/6f0yfl/ hxxps://catinadingradina[.]ro/swqb3r/ hxxps://jambismart[.]com/b5x/ hxxps://rifei[.]online/qbzgyz/ hxxps://ciptransfer[.]com/mr427y/ hxxps://fuchsia-sa[.]com/ggubnt/ hxxps://nasws[.]org[.]np/qlk/ hxxps://doorstepcarmechanic[.]com/vixe/ hxxps://trimedianet[.]com/tdn/ hxxps://maulana[.]web[.]id/j5mqkz/ hxxps://ekitag[.]com/wqsuil/ hxxps://achave[.]es/jmwx/ hxxps://axxagrup[.]ro/qgcd/ hxxps://tiqani[.]com/sjcv7l/ hxxps://cmmsec[.]co[.]uk/mkbbg/ hxxps://mktrading[.]co[.]za/j5m0zn/ hxxps://finaxio[.]co/nrd/ hxxps://ame[.]co[.]id/srr/ hxxps://dkmtechsolution[.]com/lb5/ hxxps://ppski[.]or[.]id/ke1zhm/ hxxps://grandeurconsult[.]com/q7za/ hxxps://lumosconsultant[.]com/dc8/ hxxps://espacioakana[.]cl/f6t/ hxxps://aaipi[.]or[.]id/wgu/ hxxps://thefirstabudhabiscrap[.]site/qew/ hxxps://assyafaah[.]sg/0xtd/ hxxps://sridgeauto[.]co[.]za/haag4/ hxxps://vikingos[.]site/vtou1/ hxxps://khyyril[.]com/9tmmqc/ hxxps://jinjadiocese[.]com/pie4lb/ hxxps://villalaconcepcion[.]com/u3o/ hxxps://thenewthing[.]ro/fbxfle/ hxxps://remdiswap[.]com/kdlwok/ hxxps://lilgrowshop[.]cl/9rdvy/ hxxps://panfactory[.]com[.]co/hrjbtp/ hxxps://ghsartex[.]com[.]br/tv5/ hxxps://s5agencyworld[.]co[.]uk/c2ayg/ hxxps://cmmconsultant[.]co[.]uk/jruto/ hxxps://enfyhub[.]com/f7g/ hxxps://happyhookercrocheter[.]com/p2q8tf/ hxxps://ferrecondorla44[.]com/sppfq/ hxxps://accioncomunalcolombia[.]org/pxupx6/ hxxps://lkj[.]co[.]in/wrso/ hxxps://modack[.]com/0ad/ hxxps://jioexert[.]online/euyd9/ hxxps://hotelaromakalaw[.]com/ls3/ hxxps://consultingedge[.]ae/pr5jtr/ hxxps://dilisaperu[.]com/6rclsp/ hxxps://carragheen[.]com/8s5f/ hxxps://migracionexpress[.]com/fgro/ hxxps://pattoverascienza[.]com/0vwh9/ hxxps://gpdiregion1usa[.]com/wl2/ hxxps://strainernozzle[.]com/lhl/ hxxps://pictogram[.]mx/gkks7/ hxxps://ysoal[.]com/qej0/ hxxps://mallikarjunautomobiles[.]com/uk23l7/ hxxps://urbanhood[.]pk/m6c/ hxxps://sapnokiyatra[.]live/5d2r/ hxxps://ultuarc[.]cl/lqa/ hxxps://anugerahberkatsarana[.]com/6xwk/ hxxps://comercialwindsor[.]cl/7khoqi/ hxxps://classic-construct[.]com/uswhyk/ hxxps://shahadotonline[.]net/90r/ hxxps://chidoqr[.]site/7f2a/ hxxps://javaseven[.]co[.]id/ah6/ hxxps://olympicdocs[.]com/4d31oh/ hxxps://image-nation[.]org/amf/ hxxps://syakiraartdesign[.]com/mmj/ hxxps://najdroads[.]com[.]sa/7mxpc2/ hxxps://losabuelos[.]com[.]mx/fkt4/ hxxps://kmes[.]com[.]pk/ksp4v/ hxxps://regalosconsentidos[.]cl/gzkr/ hxxps://babzenata[.]ma/cbh1/ hxxps://hanbichnepal[.]com/gpe/ hxxps://tecnologiah3[.]com[.]br/f0xlae/ hxxps://tecnoconsulting[.]cl/w2fa6/ hxxps://exclusive-inter[.]com/knct/ hxxps://edesireshop[.]com/obfo/ hxxps://briezkalni[.]lv/nbd9w/ hxxps://thelaundryday[.]com/ohw/ hxxps://partamayasa[.]web[.]id/nbu/ hxxps://ozitrainings[.]com/nyrgdm/ hxxps://thesquarefeet[.]in/bzyo/ hxxps://shariquemanzer[.]com/ozn/ hxxps://comtexaco[.]com[.]co/oumw/ hxxps://navimumbaicarcare[.]com/dan/ hxxps://pro-steam[.]eu/azakys/ hxxps://tedlogisticinc[.]com/ypj/ hxxps://zafaraliphotography[.]com/tcr2/ hxxps://colegioignacioallende[.]edu[.]mx/odf/ hxxps://shahabians[.]com/iey/ hxxps://sahidserpong[.]com/hfjc/ hxxps://ceronimo[.]com[.]tr/k46e38/ hxxps://perfilestival[.]pt/cfc/ hxxps://ifilsa[.]com[.]mx/fed/ hxxps://faif[.]in/b9o/ hxxps://stiletto-sa[.]com/jdl/ hxxps://morajtravel[.]com/r0rels/ hxxps://de-luxclothing[.]com/qsb/ hxxps://ckpartners[.]co[.]ke/uw3jvm/ hxxps://qrpay[.]co[.]id/70aamx/ hxxps://lifemedicinaintegral[.]com/2oth/ hxxps://orianix[.]com/oiz/ hxxps://guptahandloom[.]com/84gpvq/ hxxps://ldon[.]org/qfff9/ hxxps://buscasa[.]com[.]mx/x4j/ hxxps://jvpowertech[.]com/mxtruu/ hxxps://spinnerhigh[.]com/2emit/ hxxps://zenithdentaire[.]com/hmlqr/ hxxps://hospitalvirgendefatima[.]gob[.]pe/dy3c43/ hxxps://iptvstre[.]com/g5b/ hxxps://happybiz[.]id/6v5rjf/ hxxps://maaranee[.]co[.]in/nf5k/ hxxps://skkl[.]in/3dxk/ hxxps://ionister[.]com/TS1m/0[.]9664885522260009[.]dat hxxps://baumbachers[.]com/WDmfb/0[.]3471177474760533[.]dat hxxps://keebling[.]com/Y0j85XT/0[.]4035500292244842[.]dat hxxps://voto-telematico[.]com/oaw/ hxxps://sre-vn[.]com/vyugv/ hxxps://institutoagroambiental[.]com[.]br/xhi/ hxxps://apurnomo[.]com/yytn8/ hxxps://rayyantechnology[.]com/yow/ hxxps://jinjadiocese[.]com/wgm3/ hxxps://justiceaing[.]my[.]id/teu/ hxxps://hrms[.]dif[.]co[.]id/9i5/ hxxps://kaabrehman[.]com/1kdy/ hxxps://zegaponsel[.]site/cazyh/ hxxps://stellamobilya[.]com/ytju/ hxxps://3070[.]store/btv/ hxxps://mavrosdrive[.]gr/0tfq1/ hxxps://nsicon2022[.]com/gevk/ hxxps://pindjagatpur[.]com/bdvy/ hxxps://seyso[.]org/mct/ hxxps://juliusramos[.]com/6wp/ hxxps://sleepwell[.]cl/wlq/ hxxps://disturbnot[.]com/7rsg/ hxxps://almadarfortrading[.]com/q2tuf/ hxxps://techcaresolutions[.]org/ccfo/ hxxps://firstrepairsltd[.]com/fgg/ hxxps://newsaero[.]info/ap3/ hxxps://fawezi[.]org/kmx/ hxxps://meridianparkestate[.]com/kmkah/ hxxps://mastertiresgroup[.]com/qpv7/ hxxps://cercdev[.]ro/aoscb/ hxxps://bellebutik[.]com[.]tr/hqm/ hxxps://gnncoautoparts[.]com/sudcf/ hxxps://cmbc-formations[.]fr/fwh/ hxxps://coldnhottek[.]com/o7wa/ hxxps://galiniseaview[.]gr/yco/ hxxps://perichile[.]cl/8r6/ hxxps://nasuhbeyakademi[.]com/vml/ hxxps://tbilgi[.]com/gt0/ hxxps://classicroverstravel[.]com/ct5ue/ hxxps://laraii[.]com/2ji/ hxxps://azharconstruction[.]com/qa9/ hxxps://supersyntheticsbd[.]com/shkuw/ hxxps://patisserie[.]co[.]ke/bka/ hxxps://adam-app[.]com/dyr/ hxxps://primasaga[.]co[.]id/yhg/ hxxps://markgov[.]id/p9iu/ hxxps://silveracre[.]com/xlbt/ hxxps://naked-truth[.]uk/suh/ hxxps://creditcaretech[.]com/haw/ hxxps://drogueriagd[.]org/upc/ hxxps://mactcare[.]com/sp9/ hxxps://lombokoriginal[.]com/j8lo/ hxxps://cahierdujour[.]fr/3jcp3/ hxxps://sisfo[.]cgl[.]co[.]id/eouop/ hxxps://swarf[.]pk/426/ hxxps://cruzfunezlopez[.]com/wtwcl/ hxxps://webshopseotrukkok[.]hu/klxa/ hxxps://warungsatekeluarga[.]com/y46j/ hxxps://agrifarmequip[.]com/luy/ hxxps://tecrux[.]net/mpe1w/ hxxps://dti[.]lk/xwz/ hxxps://qiom[.]center/por/ hxxps://mycalltaxi[.]com/9w0el/ hxxps://haraki[.]co[.]id/x0ryy/ hxxps://mohyudinwebdesigns[.]com/6vswk/ hxxps://taxntax[.]in/3ge/ hxxps://activerbd[.]com/axerd/ hxxps://bfacilityservice[.]com/rds/ hxxps://desirelandscapes[.]com[.]au/id0/ hxxps://23116277[.]com/uv2/ hxxps://fms[.]oiu[.]edu[.]sd/qy7v/ hxxps://dbest[.]ro/zjc2/ hxxps://brandscompanion[.]co[.]ke/gyd/ hxxps://lemorgandesigns[.]co[.]ke/1jg/ hxxps://dignityallianceinternational[.]org/1xh/ hxxps://bagro[.]ir/wpz/ hxxps://chiroterapi[.]com/c1c/ hxxps://landing[.]cgl[.]co[.]id/fcezq/ hxxps://daughtersofmotherindia[.]com/crs/ hxxps://darearwa[.]pk/ywr/ hxxps://58dukkan[.]com/7tvvw/ hxxps://foa[.]oiu[.]edu[.]sd/jl2qj/ hxxps://akaplanners[.]com/gpn/ hxxps://dinamicus[.]com[.]br/wv4ww/ hxxps://sivashekimevi[.]com/a9v76/ hxxps://mucitplastik[.]com/ftmle/ hxxps://superbird[.]com[.]pk/7yn4/ hxxps://m3ntalz[.]net/nor6/ hxxps://jatel[.]co[.]ke/m0zh/ hxxps://objetivosexy[.]com/gmdr/ hxxps://kameleonprinting[.]com/wohp/ hxxps://wesender[.]shop/kxlc/ hxxps://jobmandate[.]com/wvb/ hxxps://tahfiz[.]my[.]id/cgg/ hxxps://otom-services[.]com/r64bc/ hxxps://praisinggod[.]org/j49d/ hxxps://islamocity[.]co[.]uk/pmki/ hxxps://mrsouk[.]com/00fms/ hxxps://ncl[.]com[.]bd/ougfc/ hxxps://minainn[.]com/kfnhq/ hxxps://kivucloud[.]com/t0wc/ hxxps://sofirefiesta[.]com/qagu4/ hxxps://honestgroup[.]pk/daftz/ hxxps://nowmkt[.]com[.]br/wckne/ hxxps://svbcttd[.]org/wac/ hxxps://luminatelier[.]com/ffmqk/ hxxps://arsey[.]in/uv6/ hxxps://ed-cons[.]com/b1i/ hxxps://classic-construct[.]com/vvn/ hxxps://neofitness[.]co[.]id/xuokt/ hxxps://lasertechmedia[.]com/d4uc/ hxxps://hurricaneclaimsfl[.]com/5p1/ hxxps://izmirdekoltukyikama[.]com/9mdu/ hxxps://alnahyantrust[.]com[.]bd/eietu/ hxxps://montepaolo[.]it/uq0a9/ hxxps://amali-maison[.]com/gwd/ hxxps://aikpc[.]com/7znv/ hxxps://lastcastlemeuble[.]com/hy0j/ hxxps://unoolo[.]com/4mpur/ hxxps://3inkadvertising[.]com/iaiz/ |
Pikabot |
| URL | hxxps://xwxqw[.]settings[.]oysterfloats[.]org/editContent hxxps://leir[.]settings[.]oysterfloats[.]org/editContent hxxps://ixg[.]settings[.]oysterfloats[.]org/editContent hxxps://buif[.]settings[.]oysterfloats[.]org/editContent |
FAKEUPDATES |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/985945243516035152/1185203015167262801/RawSupport_ffg_easy[.]exe?ex=658ec152&is=657c4c52&hm=c2ac374f66e20807e7ba39cc71969fa9f9d698bba8ed2ca2fa102b514baa75e5& hxxp://193[.]42[.]33[.]65/3535[.]exe hxxp://193[.]42[.]33[.]65/razdva[.]exe hxxp://185[.]172[.]128[.]8/hv[.]exe hxxp://185[.]172[.]128[.]113/hv[.]exe hxxp://185[.]172[.]128[.]160/hv[.]exe hxxp://185[.]172[.]128[.]154/hv[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]228[.]72[.]8/venom/venom[.]txt | Venom RAT |
| URL | hxxps://cccpakunataslasclass2[.]net/MTQ4MmUxODBhMTVi/ hxxps://cccpakunataslasclass3[.]net/MTQ4MmUxODBhMTVi/ hxxps://cccpakunataslasclass4[.]net/MTQ4MmUxODBhMTVi/ hxxps://cccpakunataslasclass5[.]net/MTQ4MmUxODBhMTVi/ hxxps://cccpakunataslasclass6[.]net/MTQ4MmUxODBhMTVi/ hxxps://vilnodumci[.]top/ZTZkNTJjNTkwYzk3/ hxxps://163[.]5[.]169[.]22/hntfixedfolderpath/ hxxps://163[.]5[.]169[.]35/hntfixedfolderpath/ hxxps://163[.]5[.]210[.]86/hntfixedfolderpath/ hxxps://6r0yncqzffklht1[.]com/hntfixedfolderpath/ hxxps://i7s67moz66xl1zz[.]com/hntfixedfolderpath/ hxxps://xssjtuc2ncu8xx1[.]com/hntfixedfolderpath/ hxxps://83[.]97[.]73[.]144/MTI5OGNmYWJkYTU1/ hxxps://a1b2c3d4e5f6g7h8i9[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://j1k2l3m4n5o6p7q8r9[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://s1t2u3v4w5x6y7z8[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://o1p2q3r4s5t6u7v8w9[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://x1y2z3a4b5c6d7e8f9[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://g1h2i3j4k5l6m7n8o9[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://v1w2x3y4z5a6b7c8d9[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://k1l2m3n4o5p6q7r8[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://m1n2o3p4q5r6s7t8[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://u1v2w3x4y5z6a7b8[.]xyz/MTI5OGNmYWJkYTU1/ hxxps://a1b2c3d4e5f6g7h8i9[.]ru/MTI5OGNmYWJkYTU1/ hxxps://j1k2l3m4n5o6p7q8r9[.]ru/MTI5OGNmYWJkYTU1/ hxxps://s1t2u3v4w5x6y7z8[.]ru/MTI5OGNmYWJkYTU1/ hxxps://g1h2i3j4k5l6m7n8o9[.]ru/MTI5OGNmYWJkYTU1/ hxxps://o1p2q3r4s5t6u7v8w9[.]ru/MTI5OGNmYWJkYTU1/ hxxps://x1y2z3a4b5c6d7e8f9[.]ru/MTI5OGNmYWJkYTU1/ hxxps://v1w2x3y4z5a6b7c8d9[.]ru/MTI5OGNmYWJkYTU1/ hxxps://m1n2o3p4q5r6s7t8[.]ru/MTI5OGNmYWJkYTU1/ hxxps://k1l2m3n4o5p6q7r8[.]ru/MTI5OGNmYWJkYTU1/ hxxps://u1v2w3x4y5z6a7b8[.]ru/MTI5OGNmYWJkYTU1/ hxxps://macavalaesl485[.]xyz/YzFmMjgxNDFkNDE0/ hxxps://movlysanems296[.]xyz/YzFmMjgxNDFkNDE0/ hxxps://tenchroouslam248[.]xyz/YzFmMjgxNDFkNDE0/ hxxps://bountyhlsena45[.]xyz/YzFmMjgxNDFkNDE0/ hxxps://archevlasmenes8[.]xyz/YzFmMjgxNDFkNDE0/ hxxps://condeansleksmsnf87[.]xyz/YzFmMjgxNDFkNDE0/ hxxps://akksdkmmfsak2[.]net/fixedfolderpath/ hxxps://vanced[.]xyz/fixedfolderpath/ hxxps://fjasodfjmoas32[.]net/fixedfolderpath/ hxxps://qwojqkwefpok324[.]net/fixedfolderpath/ hxxps://qppwefpeqwpepap25[.]net/fixedfolderpath/ |
Coper |
| URL | hxxp://172[.]245[.]208[.]4/3456/wlanext[.]exe hxxp://85[.]209[.]176[.]46/BtnyH95[.]bin hxxp://ecox[.]pt/PfEHVXHMUrQ218[.]bin hxxp://198[.]46[.]178[.]135/3590/wlanext[.]exe |
CloudEyE |
| URL | hxxp://sempersim[.]su/b13/fre[.]php | LokiBot |
| URL | hxxp://164[.]155[.]231[.]101:16/DNS1[.]exe hxxp://164[.]155[.]231[.]101:16/DNS2[.]exe |
Redosdru |
| URL | hxxp://www[.]bcmnursing[.]com/marcopack2[.]1[.]exe hxxp://www[.]bcmnursing[.]com/konordbox2[.]1[.]exe |
Warzone RAT |
| URL | hxxps://pasteio[.]com/raw/x2H2co6Gs8xf hxxp://23[.]94[.]239[.]93/3855/wlanext[.]exe |
Remcos |
| URL | hxxps://garinka[.]com/819/32/5/GuestsListVegas[.]svg | QakBot |
| URL | hxxp://94[.]156[.]71[.]160/carsalepanel/api/endpoint[.]php hxxp://94[.]156[.]71[.]160/updater[.]exe |
Coinminer |
| URL | hxxp://91[.]92[.]250[.]149/gate[.]php | Arkei Stealer |
| URL | hxxp://91[.]92[.]246[.]39/1992 hxxp://91[.]92[.]246[.]39/915 |
Mars |
