不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/12/19
※2023/12/21 更新
マルウェア感染させると考えられるURLを検知（2023/12/19）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://217[.]196[.]98[.]10/tool/1[.]exe hxxp://solutionoutlineplaint[.]fun/api |
Lumma Stealer |
| URL | hxxps://lindarealtytulum[.]com/cdn-vs/get[.]php hxxps://lindarealtytulum[.]com/cache/qzwewmrqqgqnaww[.]php hxxps://fulfillityourself[.]com/GetImageData[.]php hxxps://yyzh[.]sync[.]oystergardens[.]club/editContent |
FAKEUPDATES |
| URL | hxxp://630956lm[.]nyashmyash[.]top/JavascriptGamedbwindowstestWpCdn[.]php | DCRat |
| URL | hxxp://23[.]94[.]239[.]93/mj/Updationavailableformisofficetocleanofficfilesandupdationsforclearpcfromthehk[.]Doc hxxp://23[.]94[.]239[.]93/2355/microsoftprofile[.]vbs hxxp://85[.]195[.]105[.]118/2351/wlanext[.]exe hxxp://85[.]195[.]105[.]118/mj/upgradedmicrosfoteverythingwhichusingforupgradingpchealthanddeleteoldhistoryform[.]Doc hxxp://85[.]195[.]105[.]118/msj/Microsoftdecidedtodeleteentirehistorycachecookieeverythingfromthepc[.]Doc hxxp://85[.]195[.]105[.]118/8899/wlanext[.]exe |
Remcos |
| URL | hxxp://172[.]245[.]208[.]4/mj/upgradedtechnologyfordeleteentireoldhistoryfromthecdrivetoboostcomputer[.]Doc hxxp://172[.]245[.]208[.]4/2341/wlanext[.]exe |
CloudEyE |
| URL | hxxp://91[.]92[.]253[.]122/Cleaner_SetupFile[.]exe | XWorm |
| URL | hxxps://api[.]telegram[.]org/bot6348230851:AAHvC-M1EJAOlhyLClppv8SeNpMulHQIavc/ hxxps://fresh1[.]ironoreprod[.]top/_errorpages/plugmanzx[.]exe |
Agent Tesla |
| URL | hxxp://91[.]92[.]247[.]16/vsdjcn3khS/Login[.]php hxxp://freepcgamee[.]com/ybhdjklsS23/Login[.]php |
Amadey |
| URL | hxxp://101[.]35[.]42[.]157/ca hxxp://43[.]153[.]206[.]194:1111/ca hxxp://175[.]178[.]14[.]59:10088/activity hxxp://210[.]87[.]108[.]237/en_US/all[.]js hxxp://47[.]109[.]77[.]9/IE9CompatViewList[.]xml hxxp://47[.]112[.]137[.]119/j[.]ad hxxp://124[.]221[.]145[.]245:8787/cx hxxp://47[.]112[.]137[.]119:88/IE9CompatViewList[.]xml hxxp://metersphere[.]zenmen[.]cloud:88/__utm[.]gif |
Cobalt Strike |
| URL | hxxp://138[.]201[.]196[.]248/10bfb33db816f4b6[.]php hxxp://138[.]201[.]196[.]248/916f02bfcb814726/nss3[.]dll hxxp://138[.]201[.]196[.]248/916f02bfcb814726/vcruntime140[.]dll hxxp://138[.]201[.]196[.]248/916f02bfcb814726/msvcp140[.]dll hxxp://138[.]201[.]196[.]248/916f02bfcb814726/mozglue[.]dll hxxp://138[.]201[.]196[.]248/916f02bfcb814726/softokn3[.]dll hxxp://138[.]201[.]196[.]248/916f02bfcb814726/freebl3[.]dll hxxp://138[.]201[.]196[.]248/916f02bfcb814726/sqlite3[.]dll |
Stealc |
| URL | hxxp://66[.]175[.]212[.]25/pony/gate[.]php hxxp://209[.]59[.]216[.]75/pony/gate[.]php |
Pony |
| URL | hxxps://safarpanda[.]com/xpf/ hxxps://conjureup[.]ca/gd9bp/ |
Pikabot |
| URL | hxxps://china[.]dhabigroup[.]top/_errorpages/somzx[.]exe | Snake Keylogger |
| URL | hxxp://bblx1[.]shop/Bll341/index[.]php hxxp://dbxk[.]shop/M9341/index[.]php |
Azorult |
