不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様6社 -
2024/03/26
※2024/03/26 更新
マルウェア感染させると考えられるURLを検知（2024/03/26）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://sklw[.]policy[.]donnafrey[.]com/editContent hxxps://hlku[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://cdn-serveq[.]net/async/ hxxps://uft[.]policy[.]donnafrey[.]com/editContent hxxps://eeatgoodx[.]com/gSyTvKB9 hxxps://searchgear[.]pro/257KCwFj hxxps://devqeury[.]org/MXN9MB9H hxxps://sarcoma[.]space/js/min[.]main[.]js hxxps://backendjs[.]org/HVcLbYCK hxxps://eilfq[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://qli[.]collection[.]aixpirts[.]com/editContent hxxps://ropwc[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://ckwxb[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://qmhs[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://meyl[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://ggy[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://kxhu[.]catching[.]fishingrealinvestments[.]com/editContent |
FAKEUPDATES |
| URL | hxxps://api[.]telegram[.]org/bot7087485211:AAGqDmwbcFBhp_CbxxstK6UJ5DJqhNFqois/ hxxps://cdn[.]discordapp[.]com/attachments/1197790886046740510/1221524393180528790/StealLoaderSIAL[.]exe?ex=6612e43e&is=66006f3e&hm=bd69f9718b560b335d13083ea54d734e5ae027309da877356e3ec32327d29427& hxxps://covid19help[.]top/microzx[.]doc hxxps://api[.]telegram[.]org/bot6693087194:AAGVaMmaj-nbZ18iN9Hziin0vFHwn6ZSlYc/ hxxps://api[.]telegram[.]org/bot6388762619:AAH8JnaySQ2VtHauLKVr2Jt3seW2OsmChT8/ hxxps://api[.]telegram[.]org/bot6240128422:AAGfewUxVcQqKio_MV181yAuk31JpsBcgy8/ hxxps://api[.]telegram[.]org/bot7112308801:AAG42J2EeGI9ZvqS3CRrqG5QJGUg-ye_i0s/ hxxp://192[.]210[.]215[.]35/newaboyo[.]exe hxxps://api[.]telegram[.]org/bot7138384685:AAFpv5wddClVKdOI1B8SXAerFFtmIyUahos/ |
Agent Tesla |
| URL | hxxps://designsmith[.]ae/temp/crypted[.]exe | RedLine Stealer |
| URL | hxxp://43[.]138[.]106[.]60/download/1[.]dll | Metasploit |
| URL | hxxp://193[.]233[.]132[.]56/Pneh2sXQk0/index[.]php | Amadey |
| URL | hxxps://profaj[.]com/xmlrpc[.]php hxxps://aphcareerconnect[.]org/xmlrpc[.]php hxxps://passikuvasuomi[.]fi/xmlrpc[.]php hxxps://stamyn[.]com/xmlrpc[.]php hxxps://dermcollective[.]com/xmlrpc[.]php hxxp://samsebeastrolog[.]online/xmlrpc[.]php hxxps://prestigiousmassage[.]com/xmlrpc[.]php hxxps://wakafmu[.]org/xmlrpc[.]php hxxps://ozanisguvenligi[.]com/xmlrpc[.]php hxxps://www[.]celinabostic[.]de/xmlrpc[.]php hxxps://www[.]annehemgard[.]se/xmlrpc[.]php hxxps://nematinuts[.]com/xmlrpc[.]php hxxps://mega-mkv[.]com/xmlrpc[.]php hxxps://somersetpizzamd[.]com/xmlrpc[.]php hxxps://wislah[.]com/xmlrpc[.]php hxxps://cartoongayporn[.]com/xmlrpc[.]php hxxps://toivolanpiha[.]fi/xmlrpc[.]php hxxps://www[.]anordestdiche[.]com/xmlrpc[.]php hxxps://egylgs[.]info/xmlrpc[.]php hxxps://phoenixair[.]com/xmlrpc[.]php hxxps://gustancho[.]com/xmlrpc[.]php hxxps://ancestralfindings[.]com/xmlrpc[.]php hxxps://arduino-projects4u[.]com/xmlrpc[.]php hxxps://equinox-hotels[.]com/xmlrpc[.]php hxxps://bilgisebili[.]com/xmlrpc[.]php hxxps://egvisaservices[.]com/xmlrpc[.]php hxxps://www[.]atlantabarbellgym[.]com/xmlrpc[.]php hxxps://good2bsocial[.]com/xmlrpc[.]php hxxps://nokohome[.]se/xmlrpc[.]php hxxps://recetascocinaperuana[.]com/xmlrpc[.]php hxxps://www[.]appleluxurycar[.]com/xmlrpc[.]php hxxps://swemed[.]se/xmlrpc[.]php hxxps://thetip[.]co[.]kr/xmlrpc[.]php hxxps://panang[.]se/xmlrpc[.]php hxxp://restaurant-riva[.]net/xmlrpc[.]php hxxps://sirfresh[.]co[.]za/xmlrpc[.]php hxxps://ware2go[.]co/xmlrpc[.]php hxxps://configurelaptop[.]eu/xmlrpc[.]php hxxps://alternative-tibetaine[.]org/xmlrpc[.]php |
GootLoader |
| URL | hxxp://92[.]60[.]39[.]76:9993/wr[.]exe | Coinminer |
| URL | hxxp://193[.]233[.]132[.]197/lumma21[.]exe | Lumma Stealer |
| URL | hxxp://878497cm[.]nyashsens[.]top/EternalpythonpollhttpgamepublicCdnCentral[.]php hxxp://212[.]109[.]198[.]52/pipe2/0Javascript2private/VmgameApi/pythonProcessor/ProviderpollprocessLinuxUploads[.]php |
DCRat |
| URL | hxxps://www[.]10086cn[.]xyz/lib/v2/wcp-consent[.]js hxxp://www[.]10086cn[.]xyz/lib/v2/wcp-consent[.]js hxxp://8[.]222[.]147[.]15:8081/jquery-3[.]3[.]1[.]min[.]js hxxp://121[.]37[.]215[.]238/push hxxps://cs[.]h1ll0[.]cs[.]in:4433/cx hxxp://47[.]113[.]188[.]133:81/ga[.]js hxxp://124[.]71[.]222[.]33:8088/ca hxxp://124[.]222[.]97[.]236:9090/updates[.]rss hxxp://119[.]3[.]12[.]54/etc[.]clientlibs/base[.]min[.]ACSHASH29ccd0207f7ce847c[.]js hxxp://8[.]130[.]48[.]46/dot[.]gif hxxp://81[.]19[.]138[.]57/match hxxps://81[.]19[.]138[.]57/fwlink hxxp://116[.]62[.]242[.]109/pixel[.]gif hxxps://52[.]76[.]173[.]97/en_US/all[.]js hxxp://185[.]130[.]46[.]168/jquery-3[.]3[.]1[.]min[.]js hxxp://1[.]14[.]206[.]72/__utm[.]gif hxxps://47[.]106[.]89[.]225/fwlink hxxps://39[.]106[.]5[.]215/dpixel hxxps://101[.]32[.]37[.]92:4443/fr[.]html hxxps://39[.]100[.]86[.]42:4443/download/20/ZO2XY7A4BOWU hxxp://205[.]185[.]118[.]120:1200/push hxxps://cf907cd9e8f94a93937a6360363420b2[.]apig[.]cn-east-3[.]huaweicloudapis[.]com/static/askbob hxxps://d69b6834b7eb46fcb7bbcaa60f9f0f2d[.]apig[.]cn-east-3[.]huaweicloudapis[.]com/static/askbob hxxps://f6d2b014a8664ddd8d859ce64f3741ad[.]apig[.]cn-east-3[.]huaweicloudapis[.]com/static/askbob hxxps://74[.]249[.]43[.]255/Mod/v2[.]5/PISZ5TOS7V hxxp://121[.]36[.]213[.]92:8888/__utm[.]gif hxxp://52[.]76[.]173[.]97/dot[.]gif hxxps://81[.]17[.]22[.]42/visit[.]js hxxps://195[.]181[.]245[.]38/jquery-3[.]3[.]1[.]min[.]js hxxp://119[.]91[.]209[.]244:6666/cm hxxps://178[.]236[.]46[.]118/dist/css/bootstrap[.]min[.]css hxxp://43[.]240[.]48[.]66:809/dpixel hxxp://8[.]222[.]147[.]15:8080/jquery-3[.]3[.]1[.]min[.]js hxxps://124[.]71[.]75[.]199/dpixel |
Cobalt Strike |
| URL | hxxp://92[.]249[.]48[.]114/dc hxxp://92[.]249[.]48[.]114/x86 hxxp://92[.]249[.]48[.]114/arm61 hxxp://92[.]249[.]48[.]114/dss hxxp://92[.]249[.]48[.]114/i686 hxxp://92[.]249[.]48[.]114/ppc hxxp://92[.]249[.]48[.]114/co hxxp://92[.]249[.]48[.]114/sh4 hxxp://92[.]249[.]48[.]114/mipsel hxxp://92[.]249[.]48[.]114/586 hxxp://92[.]249[.]48[.]114/m68k hxxp://reallifehollywood[.]eu/Demon[.]m68k hxxp://paradisecityofficial[.]de/Demon[.]m68k hxxp://45[.]131[.]111[.]159/Demon[.]i586 hxxp://45[.]131[.]111[.]159/Demon[.]arm6 hxxp://45[.]131[.]111[.]159/Demon[.]arm4 hxxp://45[.]131[.]111[.]159/Demon[.]arm7 hxxp://45[.]131[.]111[.]159/Demon[.]i686 hxxp://45[.]131[.]111[.]159/Demon[.]x86 hxxp://45[.]131[.]111[.]159/Demon[.]arm5 hxxp://45[.]131[.]111[.]159/Demon[.]sh4 hxxp://45[.]131[.]111[.]159/Demon[.]mpsl hxxp://45[.]131[.]111[.]159/Demon[.]sparc hxxp://45[.]131[.]111[.]159/Demon[.]m68k hxxp://45[.]131[.]111[.]159/Demon[.]ppc hxxp://92[.]249[.]48[.]114/mips |
Bashlite |
| URL | hxxps://sempersim[.]su/c6/fre[.]php hxxps://sempersim[.]su/c17/fre[.]php hxxp://sempersim[.]su/c19/fre[.]php hxxp://sempersim[.]su/c13/fre[.]php hxxps://sempersim[.]su/c13/fre[.]php |
LokiBot |
| URL | hxxps://www[.]efesmarble[.]com/temp/spp/rf/Installer[.]zip | FakeUpdateRU |
| URL | hxxp://bn[.]networkbn[.]click/henry[.]sh4 hxxp://bn[.]networkbn[.]click/henry[.]m68k hxxp://bn[.]networkbn[.]click/henry[.]ppc hxxp://bn[.]networkbn[.]click/botx86_64 |
MooBot |
| URL | hxxp://167[.]114[.]164[.]249/Br23[.]zip | Grandoreiro |
| URL | hxxps://mararibeachparadise[.]com/sure/Shirtiest[.]aca hxxp://147[.]78[.]103[.]250/jKzQINX250[.]bin hxxp://147[.]78[.]103[.]250/Sprreregel[.]psd hxxps://drive[.]google[.]com/uc?export=download&id=1TkpXOlAmmOzV6R3RTpljfQE8wliGI0eg hxxp://renzoll[.]com/nQTblFMXetDmiBnXTeQX27[.]bin hxxp://103[.]131[.]130[.]54/wPQFhuYwYqn3[.]bin hxxp://103[.]131[.]130[.]54/yhMGLfcrSZLEwAGHkMIG118[.]bin hxxp://103[.]131[.]130[.]54/NOBQBfVQnXy200[.]bin |
CloudEyE |
| URL | hxxp://dnvk1[.]info/wp-admin/Kioway[.]smi hxxp://dnvk1[.]info/wp-admin/WLbkSZoxpvYOvh65[.]bin |
Formbook |
| URL | hxxps://paste[.]ee/d/Hofbw/0 hxxps://paste[.]ee/d/IVNBZ/0 hxxps://paste[.]ee/d/F5jIi/0 hxxps://paste[.]ee/d/7WgIW/0 |
Revenge RAT |
| URL | hxxp://147[.]124[.]212[.]80:222/x[.]jpg hxxp://51[.]89[.]109[.]154:3000/h[.]jpg hxxps://51[.]89[.]109[.]154/h[.]jpg |
AsyncRAT |
| URL | hxxp://193[.]163[.]7[.]20/edf04ce5e57d0f66[.]php | Stealc |
