不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2024/01/30
※2024/01/30 更新
マルウェア感染させると考えられるURLを検知（2024/01/30）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://blblz[.]shop/BLB41/index[.]php hxxp://damel[.]shop/DA341/index[.]php |
Azorult |
| URL | hxxp://moon[.]spartabig[.]com/order/tuc4[.]exe | Socks5 Systemz |
| URL | hxxps://91[.]92[.]254[.]14/Helpertask[.]exe | Quasar RAT |
| URL | hxxp://47[.]236[.]140[.]86/s/12027[.]exe hxxp://47[.]236[.]140[.]86/s/12028[.]exe hxxp://104[.]168[.]169[.]49/DsGQuIA7[.]bin hxxp://104[.]168[.]169[.]49/DcVmJDZrJUneZEDqhRSyToVzyS121[.]bin hxxp://104[.]168[.]169[.]49/abGyVWrwjXXNTbAXTBKCR12[.]bin hxxp://104[.]168[.]169[.]49/cAEVuWaKi209[.]bin hxxp://34[.]82[.]253[.]169/eRVGTsTvPgrcXCCiH6[.]bin hxxp://34[.]82[.]253[.]169/AqSXBvqEPtqgMbmaxfKWgdcrJ21[.]bin hxxp://96[.]47[.]233[.]26/KYQrMZCWPHv225[.]bin hxxp://34[.]82[.]253[.]169/SWftxdrdE74[.]bin |
CloudEyE |
| URL | hxxp://185[.]196[.]10[.]146/Vbsveuhnjb[.]exe | Amadey |
| URL | hxxp://118[.]26[.]174[.]163/app/view/ta[.]sh hxxp://185[.]172[.]128[.]154/ma[.]exe |
Coinminer |
| URL | hxxp://190[.]123[.]44[.]240/NET/Horpxuoxm[.]exe | BlackNET RAT |
| URL | hxxp://sempersim[.]su/c3/fre[.]php | LokiBot |
| URL | hxxp://109[.]107[.]182[.]3/lego/Kcqqn[.]exe | zgRAT |
| URL | hxxp://109[.]107[.]182[.]3/lego/build1234[.]exe | Warzone RAT |
| URL | hxxp://193[.]233[.]255[.]60/auth/login hxxp://77[.]73[.]131[.]73/auth/login hxxp://77[.]232[.]142[.]8/auth/login hxxp://92[.]246[.]136[.]222/auth/login hxxp://94[.]228[.]168[.]159/auth/login hxxp://85[.]192[.]63[.]57/auth/login hxxp://45[.]141[.]215[.]173/auth/login hxxp://89[.]208[.]106[.]112/auth/login hxxp://141[.]98[.]83[.]242/auth/login hxxp://91[.]103[.]253[.]184/auth/login hxxp://tunel[.]oracle-panel[.]online/auth/login hxxp://89[.]208[.]103[.]177/auth/login |
Meduza Stealer |
| URL | hxxps://draggedline[.]org/1zkzW2Mq hxxps://climedballon[.]org/ytW8d9XY hxxps://waterlinesheet[.]org/bDrVdw9c hxxps://dailytickyclock[.]org/Rz7kFbxJ hxxps://lemonicecold[.]org/cd5fkZwv hxxps://throatpills[.]org/MxLVy9nz hxxps://surelytheme[.]org/ZcqVjVQ1 hxxps://drilledgas[.]org/dpw79r1k hxxps://windowlight[.]org/bXz6bx5C hxxps://atrqp[.]caching[.]oysterfloats[.]com/editContent hxxps://lxa[.]colors[.]usajicgu[.]com/editContent hxxps://ripnoticebook[.]com/cdn-vs/cache[.]php hxxps://ripnoticebook[.]com/cache/ewmrgqnaww[.]php hxxps://ghostcitygames[.]com/data[.]php hxxps://miner[.]eastestsite[.]com/6CdvjJMFDOWMBVW+3hRDrptTCvzKHU38mkIM5I1EBNOCVDDqmkgB+I1VHeOaBUOujVUd45oFVb3EBR2u0gUG6p5fF/6DXxzmkU4Y+pgFEg== hxxps://miner[.]eastestsite[.]com/UUo0FipoV381aA4kZ3kYNCI+UWZzcBZmIy9XfjQpX0k7OWtwIyVaYjQ4RnkjaBg0NDhGeSNoDiR9aEY0a2hYdCcyRXEzOV1nMyVYNCw= hxxps://miner[.]eastestsite[.]com/rpmKpNW76c3Ku7CWmKqmht3t79SMo6jFwPjm3dT81cLeu6aG3Luwhsf9+N3W/f7Hx/Tlysfz8NTf+u2G0w== hxxps://ojjg[.]honors[.]howamerica[.]com/editContent hxxps://alq[.]honors[.]howamerica[.]com/editContent |
FAKEUPDATES |
| URL | hxxps://bb2wexx2x2aa[.]com/MjU0MjdiMTZmNDVh/ hxxps://wexx2x11x2aa[.]com/MjU0MjdiMTZmNDVh/ hxxps://x2313xsdx2a[.]com/MjU0MjdiMTZmNDVh/ hxxps://babawwe2aa[.]com/MjU0MjdiMTZmNDVh/ hxxps://wexx2x2aa[.]com/MjU0MjdiMTZmNDVh/ hxxps://xex2napggq[.]com/MjU0MjdiMTZmNDVh/ hxxps://193[.]222[.]96[.]16/MjU0MjdiMTZmNDVh/ |
Coper |
| URL | hxxp://23[.]224[.]95[.]13/linux_mips hxxp://23[.]224[.]95[.]13/linux_386 hxxp://23[.]224[.]95[.]13/linux_arm7 hxxp://23[.]224[.]95[.]13/linux_mipsel hxxp://23[.]224[.]95[.]13/linux_arm5 hxxp://23[.]224[.]95[.]13/linux_arm6 hxxp://23[.]224[.]95[.]13/download[.]sh |
Kaiji |
| URL | hxxp://139[.]155[.]0[.]238:8094/match hxxp://47[.]108[.]137[.]190/pixel[.]gif hxxp://20[.]2[.]223[.]43/g[.]pixel hxxp://47[.]108[.]137[.]190:50050/j[.]ad hxxps://175[.]178[.]73[.]141:6180/cm hxxp://ns[.]chrome-crash[.]com:2086/jquery-3[.]3[.]1[.]min[.]js hxxp://108[.]165[.]113[.]54:8081/ptj hxxp://124[.]223[.]52[.]82/bootstrap-5[.]3[.]1[.]min[.]js hxxp://81[.]68[.]210[.]91/api/x |
Cobalt Strike |
| URL | hxxp://107[.]175[.]243[.]133/3151/conhost[.]exe hxxp://192[.]3[.]176[.]145/458/conhost[.]exe hxxps://discord[.]com/api/webhooks/1197853242999197757/GiP3FvPLWO4DCO5AQ7p2xSRazpswX_GeUHNIfDsCo5gjtTLWG64TOkaNzaXUzbPc2LM1 hxxps://kalnet[.]top/_errorpages/ugorichzx[.]exe hxxps://api[.]telegram[.]org/bot6702604510:AAHhqcLx9PnHKK0GHfjoUU1QRG5B5kHI1FI/ |
Agent Tesla |
| URL | hxxp://194[.]36[.]209[.]243/lineJsrequestdbDle[.]php hxxp://46[.]174[.]52[.]97/Downloads/securePacketgamedbtrack[.]php hxxp://185[.]244[.]51[.]120/1Poll/3External/50provider0/windows/Windowslongpoll/0externaljavascriptjs/phpPhp/0Async7/61gameVoiddb/TolongpollWindowsPrivate[.]php |
DCRat |
| URL | hxxp://185[.]172[.]128[.]109/InstallSetup7[.]exe hxxp://185[.]172[.]128[.]19/workforroc[.]exe |
Stealc |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1201471140456046605/1201471177969897552/crypted[.]exe?ex=65c9f03b&is=65b77b3b&hm=6353fb6ad77cd1f8c9c2d92dd1d23122c41fa36d16fab62c530b0ec162cc3f96& hxxps://gearboomchocolateowfs[.]site/api hxxps://negliganceassumeruew[.]site/api hxxp://braidfadefriendklypk[.]site/api hxxp://acquisitionfinancej[.]shop/api hxxp://cooperatecliqueobstac[.]site/api hxxp://racerecessionrestrai[.]site/api hxxp://carvewomanflavourwop[.]site/api hxxp://vesselspeedcrosswakew[.]site/api hxxp://retainfactorypunishjkw[.]site/api hxxp://communicationinchoicer[.]site/api hxxp://brickabsorptiondullyi[.]site/api hxxps://brickabsorptiondullyi[.]site/api |
Lumma Stealer |
| URL | hxxp://109[.]107[.]182[.]3/lego/mrk1234[.]exe | RedLine Stealer |
