不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様4社 -
2024/03/06
※2024/03/06 更新
マルウェア感染させると考えられるURLを検知（2024/03/06）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://91[.]92[.]242[.]139/Pneh2sXQk0/Plugins/cred64[.]dll | Amadey |
| URL | hxxp://107[.]174[.]138[.]160/crr/cr/minlovewithsomeoneshecuteandtrulyyoungunluckyshenotundersatnd_howmuchiloveherbutitsallgreatwithtrueloveriamgivingyou[.]doc hxxp://107[.]174[.]138[.]160/crr/iaminlovewithsomeoneshecuteandtrulyyoungunluckyshenotundersatnd_howmuchiloveherbutitsallgreatwithtrueloveriamgivingyou[.]doc hxxps://api[.]telegram[.]org/bot6774856537:AAHZ1W9fPQXjEaTP_7jWaEG-PUz-JJzlt1Y/ hxxps://api[.]telegram[.]org/bot6770768679:AAGEmH6O_SdrlBhWJKpNn8TBf_eUXBt3ADo/ hxxp://xeis[.]io/ZZLq hxxps://xeis[.]io/ZZLq hxxp://172[.]245[.]185[.]30/7500/moh/ilinecreated[.]jpg hxxp://172[.]245[.]185[.]30/7500/moh/OBI[.]txt |
Agent Tesla |
| URL | hxxp://95[.]142[.]35[.]43/Line/Updateflower4External/EternalpacketprocesslongpollprotectbaseWindowstraffictemporary[.]php hxxp://113304cm[.]n9shteam2[.]top/ExternalpollsqlDblinuxgenerator[.]php hxxp://79[.]174[.]94[.]173/Base93/3multibaseTest/3/trackauth/linuxToasync6/longpoll/Cpuserver2Wp/TrackLinux/PhpasyncCentral[.]php |
DCRat |
| URL | hxxps://sempersim[.]su/c12/fre[.]php hxxps://sempersim[.]su/c11/fre[.]php hxxp://91[.]92[.]252[.]146:4002/kioy/five/fre[.]php hxxp://sempersim[.]su/c12/fre[.]php hxxp://91[.]92[.]252[.]146/kioy/five/fre[.]php |
LokiBot |
| URL | hxxp://122[.]51[.]118[.]39:23333/vfO2 hxxp://118[.]194[.]233[.]185/load hxxp://47[.]100[.]229[.]207/dot[.]gif hxxps://60[.]204[.]133[.]143/visit[.]js hxxps://154[.]82[.]81[.]27/gv hxxps://154[.]82[.]81[.]136/as hxxp://43[.]153[.]222[.]28:4646/dot[.]gif hxxp://79[.]124[.]40[.]106:81/en_US/all[.]js hxxps://175[.]197[.]65[.]135/owa/2I00Fa-t5zXoHTU1hSpr hxxps://buy-dnd[.]shop/owa/4ZT2Say1WKoheml0X8bBfa hxxps://firmwarefusion[.]com/dam[.]html hxxp://8[.]219[.]54[.]123/ga[.]js hxxps://81[.]69[.]242[.]185/ca hxxp://117[.]72[.]46[.]146/ga[.]js hxxp://91[.]240[.]118[.]233:9090/beacon[.]exe hxxps://buy-dnd[.]shop/owa/q9dyQU9X6RjWVCdQhUmRMY hxxp://179[.]60[.]150[.]34/preload hxxp://39[.]107[.]70[.]26:8888/dot[.]gif hxxp://121[.]5[.]66[.]186:1082/cm hxxps://43[.]153[.]222[.]28/visit[.]js hxxp://161[.]35[.]186[.]154:8080/pixel hxxps://121[.]5[.]66[.]186:1083/load hxxps://cdn-014[.]epsonupdate[.]uk/push hxxp://194[.]165[.]16[.]55/Understand/v2[.]61/RYLQUPM8LL hxxp://security-socks[.]expert/Understand/v2[.]61/RYLQUPM8LL |
Cobalt Strike |
| URL | hxxps://www[.]sdsoffice[.]fr/test[.]txt | NetSupportManager RAT |
| URL | hxxps://presencewineonnyui[.]shop/api | Lumma Stealer |
| URL | hxxp://60[.]246[.]28[.]219:34035/Mozi[.]m | Mozi |
| URL | hxxps://briefscala[.]com/cdn-vs/cache[.]php hxxps://briefscala[.]com/help/zewmrgqnw[.]php hxxps://briefscala[.]com/data[.]php hxxps://jfxei[.]aus[.]mimico-cooperative[.]org/editContent hxxp://apicachebot[.]com/ui_cache[.]js |
FAKEUPDATES |
| URL | hxxps://blog[.]diu[.]ac/wp-content/plugins/core-plugin/0[.]jpg hxxps://t8n[.]net/03_march_2024_100730[.]html |
DarkGate |
| URL | hxxps://pastebin[.]com/raw/nz2twgyY hxxps://pastebin[.]com/raw/UVcYvb2g |
Metasploit |
| URL | hxxp://62[.]122[.]184[.]95/stabs/win[.]exe | Tinba |
| URL | hxxp://nzaria[.]org/img/marxrwo[.]txt | XWorm |
| URL | hxxps://policequestseries[.]com/Eejebih[.]dat | zgRAT |
