不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/01/24
※2024/01/24 更新
マルウェア感染させると考えられるURLを検知（2024/01/24）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://192[.]3[.]176[.]145/2356/conhost[.]exe | Formbook |
| URL | hxxp://109[.]107[.]182[.]3/lego/gold1234[.]exe hxxp://109[.]107[.]182[.]3/lego/pixelcloudnew2[.]exe hxxp://109[.]107[.]182[.]3/lego/crypted[.]exe hxxps://cdn[.]discordapp[.]com/attachments/1187460488292995144/1199260679979409438/crypted[.]exe hxxp://109[.]107[.]182[.]3/lego/pixellslsss[.]exe hxxps://45[.]15[.]156[.]13/index[.]php/s/LyLSp57pLBSWgLJ/download/red[.]exe hxxp://78[.]138[.]46[.]125/uche[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]172[.]128[.]19/FirstZ[.]exe hxxp://109[.]107[.]182[.]3/lego/moto[.]exe hxxp://185[.]172[.]128[.]19/new/Miner-XMR1[.]exe hxxp://193[.]149[.]129[.]9/rdpcllp[.]exe hxxp://193[.]233[.]132[.]160/rdpcllp[.]exe |
Coinminer |
| URL | hxxps://suezey[.]com/cdn-cs/cache[.]php hxxps://appboltonik[.]com/data[.]php hxxps://suezey[.]com/cache/ewmrgqnaww[.]php hxxps://suezey[.]com/cdn-vs/cache[.]php hxxps://ivh[.]colors[.]usajicgu[.]com/editContent hxxps://qgh[.]colors[.]usajicgu[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://94[.]156[.]66[.]159/m-p[.]s-l[.]GHOUL hxxp://45[.]128[.]232[.]143/m-p[.]s-l[.]GHOUL |
Bashlite |
| URL | hxxp://77[.]246[.]104[.]70/5777786423[.]exe | Rhadamanthys |
| URL | hxxp://139[.]99[.]153[.]82/pp/fre[.]php | LokiBot |
| URL | hxxps://124[.]220[.]164[.]254/fwlink hxxp://124[.]220[.]164[.]254/__utm[.]gif hxxps://175[.]178[.]225[.]71/www/handle/doc hxxps://microsoftwindows[.]one/api/3 hxxp://124[.]222[.]82[.]248:6666/cx hxxp://122[.]51[.]68[.]179/pixel hxxps://accessservicesonline[.]com/setup_wm[.]exe hxxp://47[.]109[.]58[.]205:81/updates[.]rss hxxp://120[.]55[.]12[.]41:6666/dot[.]gif hxxps://dig[.]fuli-oa[.]cn:8443/fwlink hxxps://buy-dnd[.]shop/jquery-3[.]3[.]1[.]min[.]js hxxps://124[.]71[.]5[.]199/dpixel hxxps://www[.]xiongge[.]space:8443/__utm[.]gif hxxp://124[.]71[.]5[.]199:6666/en_US/all[.]js hxxps://114[.]115[.]220[.]199/activity hxxps://zx[.]reg32[.]com/remove hxxps://as[.]reg32[.]com/profile hxxps://qw[.]reg32[.]com/profile |
Cobalt Strike |
| URL | hxxp://joxy[.]ayazprak[.]com/order/adobe[.]exe hxxp://tiny[.]ayazprak[.]com/order/tuc5[.]exe |
Socks5 Systemz |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1199282868489297971/1199283757312643072/PREPAID_DEALER_CREDIT_NOTE[.]pdf[.]js | BlackShades |
| URL | hxxp://193[.]149[.]129[.]9/Install[.]exe hxxp://109[.]107[.]182[.]3/lego/flesh[.]exe |
zgRAT |
| URL | hxxp://31[.]41[.]244[.]146/Downnnnloads/23[.]exe | Laplas |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1197859064667979828/1199306238102605904/7887987898_PDF[.]IMG hxxp://aineommall[.]com/dd/dd[.]exe hxxps://api[.]telegram[.]org/bot5245141025:AAGoJr8mwUxCz0600J7yOoPKkUt-JB73Qqo/ |
Agent Tesla |
| URL | hxxp://109[.]107[.]182[.]3/lego/kskskfsf[.]exe | Lumma Stealer |
| URL | hxxps://core-click[.]net/TVFrontend/NSM[.]zip hxxps://core-click[.]net/TVFrontend/remcmdstub[.]zip hxxps://core-click[.]net/TVFrontend/DLAA1view[.]zip hxxps://core-click[.]net/TVFrontend/mock/ hxxps://hsdiagnostico[.]com/readme[.]php |
NetSupportManager RAT |
| URL | hxxp://user[.]compdatasystems[.]com:443/clientlibs/contentDoor[.]ico | Metasploit |
| URL | hxxp://185[.]172[.]128[.]125/u6vhSc3PPq/index[.]php hxxp://5[.]42[.]66[.]0/f7Vkbh7X/index[.]php hxxp://second[.]amadgood[.]com/jd9dd3Vw/index[.]php hxxp://dot[.]tipinfolist[.]com/f5dkvdSbC/index[.]php |
Amadey |
| URL | hxxp://195[.]20[.]16[.]46/download/gate3_64[.]exe | PrivateLoader |
| URL | hxxps://zcasscasszcasz[.]site/MTBiYTAyMTk0NzJj/ hxxps://cascsasacsacascasca[.]pics/MTBiYTAyMTk0NzJj/ hxxps://qweqweqweqweqweq[.]tech/MTBiYTAyMTk0NzJj/ hxxps://asdasdasdasdasad[.]pw/MTBiYTAyMTk0NzJj/ hxxps://aysgduyasgduyas[.]store/MTBiYTAyMTk0NzJj/ hxxps://aksjdhsakdhakjshd[.]online/MTBiYTAyMTk0NzJj/ hxxps://cascacascascascascas[.]hk/MTBiYTAyMTk0NzJj/ hxxps://qweqweqweqweqwewww[.]hk/MTBiYTAyMTk0NzJj/ |
Coper |
| URL | hxxp://ji[.]alie3ksgbb[.]com/ef/rty37[.]exe | Fabookie |
| URL | hxxp://185[.]17[.]40[.]133/ba91ff2f6a996325[.]php | Stealc |
