不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/04/01
※2024/04/01 更新
マルウェア感染させると考えられるURLを検知（2024/04/01）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://wyrfn[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://ezshipsy[.]com/help/zewmrgqnw[.]php hxxps://ezshipsy[.]com/cdn-vs/cache[.]php hxxps://edulokam[.]com/data[.]php hxxps://jsluna[.]com/cdn-vs/cache[.]php hxxps://jsluna[.]com/help/zewmrgqnw[.]php hxxps://iuq[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://fehc[.]caching[.]oysterfloats[.]com/editContent hxxps://ftdt[.]collection[.]aixpirts[.]com/editContent hxxps://xoo[.]catching[.]fishingrealinvestments[.]com/editContent hxxps://flz[.]catching[.]fishingrealinvestments[.]com/editContent |
FAKEUPDATES |
| URL | hxxp://marksidfg[.]ug/asdfg[.]exe hxxp://mistitis[.]ug/asdfg[.]exe hxxp://marksidfgs[.]ug/ghjk[.]exe hxxps://tmpfiles[.]org/dl/4560007/fl[.]exe |
Coinminer |
| URL | hxxp://193[.]233[.]132[.]167/lend/lumma2[.]exe hxxps://petalschanging[.]shop/current[.]exe hxxps://wagonglidemonkywo[.]shop/api hxxp://185[.]172[.]128[.]19/LummaC2[.]exe hxxp://193[.]233[.]132[.]167/lend/koooooo[.]exe hxxp://193[.]233[.]132[.]167/lend/swiiiii[.]exe hxxps://cdn[.]discordapp[.]com/attachments/1018589869167099924/1223663113778364458/AimmyLauncher[.]exe?ex=661aac14&is=66083714&hm=8a6a8eb68439f1e14a9c625ce16c7e41a1104e0a005fed9cf37a481f29d23f7b& hxxps://petalsforchange[.]shop/current[.]exe |
Lumma Stealer |
| URL | hxxp://94[.]156[.]69[.]11/rem[.]exe hxxp://103[.]237[.]87[.]56/xampp/fgh/fg/iwanttounderstandhowmuchilovertokissherwithlotoflovetounderstand___sheismygirlshemylovergirltoseeher[.]doc |
Remcos |
| URL | hxxps://kamalankaranda[.]com/NmVmZmJlZTA2MDNm hxxps://kanardansaydan1[.]com/NmVmZmJlZTA2MDNm/ hxxps://sayankarakam2[.]com/NmVmZmJlZTA2MDNm/ hxxps://prizurisaby[.]com/ODliMzBlMGQ5OGUz/ hxxps://kamanbarsayan[.]com/NmVmZmJlZTA2MDNm/ hxxps://iakyanalica[.]org/ODliMzBlMGQ5OGUz/ |
Coper |
| URL | hxxp://89[.]23[.]98[.]225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync[.]php hxxp://131217cm[.]n9shteam3[.]top/VmtoJsSqldbLinuxTrafficlocal[.]php |
DCRat |
| URL | hxxps://www[.]jongzelfstandig[.]nl/wp-admin/UjNsCkYgnooNVR187[.]bin hxxp://dnvk1[.]info/wp-admin/OrGhPUtRgXmsHA125[.]bin hxxps://www[.]jongzelfstandig[.]nl/wp-admin/Incloser58[.]ttf hxxp://dnvk1[.]info/wp-admin/Letmatros[.]snp hxxp://185[.]255[.]114[.]113/wUmxOTCfvEYzAM225[.]bin hxxp://185[.]255[.]114[.]113/BffWfbKnf0[.]bin hxxp://185[.]255[.]114[.]113/nIVwbalNCj233[.]bin |
CloudEyE |
| URL | hxxp://193[.]233[.]132[.]241/0c90d49aae193f2b/freebl3[.]dll hxxp://193[.]233[.]132[.]241/0c90d49aae193f2b/nss3[.]dll hxxp://193[.]233[.]132[.]241/0c90d49aae193f2b/mozglue[.]dll hxxp://193[.]233[.]132[.]241/0c90d49aae193f2b/msvcp140[.]dll hxxp://193[.]233[.]132[.]241/0c90d49aae193f2b/sqlite3[.]dll hxxp://193[.]233[.]132[.]241/0c90d49aae193f2b/softokn3[.]dll hxxp://193[.]233[.]132[.]241/0c90d49aae193f2b/vcruntime140[.]dll hxxp://185[.]172[.]128[.]144/ISetup10[.]exe |
Stealc |
| URL | hxxps://store13[.]gofile[.]io/download/direct/5c5f6a4d-8595-4321-a124-0be842b38135/rh_0[.]6[.]0[.]exe | Rhadamanthys |
| URL | hxxp://193[.]35[.]18[.]56/telnetd hxxp://193[.]35[.]18[.]56/curl hxxp://193[.]35[.]18[.]56/pc hxxp://193[.]35[.]18[.]56/ssh hxxp://193[.]35[.]18[.]56/bashd hxxp://193[.]35[.]18[.]56/nano hxxp://193[.]35[.]18[.]56/tftpd hxxp://193[.]35[.]18[.]56/ps hxxp://193[.]35[.]18[.]56/var hxxp://193[.]35[.]18[.]56/cat hxxp://103[.]35[.]190[.]189/arm6 hxxp://103[.]35[.]190[.]189/ppc hxxp://103[.]35[.]190[.]238/ppc hxxp://103[.]35[.]190[.]238/x86 hxxp://103[.]35[.]190[.]238/arm4 hxxp://103[.]35[.]190[.]189/arm5 hxxp://103[.]35[.]190[.]189/arm4 hxxp://103[.]35[.]190[.]189/x86 hxxp://93[.]123[.]39[.]73/armv5l hxxp://93[.]123[.]39[.]73/i686 hxxp://93[.]123[.]39[.]73/armv4l hxxp://93[.]123[.]39[.]73/i586 hxxp://103[.]35[.]190[.]238/mpsl hxxp://103[.]35[.]190[.]189/sh4 hxxp://103[.]35[.]190[.]238/m68k hxxp://103[.]35[.]190[.]238/sh4 hxxp://103[.]35[.]190[.]238/arm6 hxxp://103[.]35[.]190[.]189/m68k hxxp://103[.]35[.]190[.]189/mpsl hxxp://103[.]35[.]190[.]238/arm5 hxxp://103[.]35[.]190[.]189/mips hxxp://103[.]35[.]190[.]238/mips |
Bashlite |
| URL | hxxp://gammaproject[.]dev/blogs/skinny/bleat/index[.]php hxxp://somakop[.]app/medical/plan/oslo/posting/index[.]php hxxp://muagol[.]com/Traffic/link/posting/index[.]php |
Matanbuchus |
| URL | hxxps://www[.]xss[.]mba:10328/dpixel hxxp://gays[.]egorvlasov[.]ru:8080/jquery-3[.]3[.]1[.]min[.]js hxxp://82[.]157[.]44[.]254/dot[.]gif hxxp://161[.]35[.]168[.]216:4444/load hxxp://101[.]43[.]191[.]108:9998/ca hxxp://43[.]136[.]218[.]157:5555/updates[.]rss hxxps://198[.]251[.]88[.]196/match hxxp://8[.]218[.]29[.]187:8099/updates[.]rss hxxps://averatechsolutions[.]com/faqpage[.]js hxxp://212[.]129[.]223[.]49/dpixel hxxps://3[.]133[.]159[.]129/__utm[.]gif hxxp://47[.]113[.]179[.]177/ipv6test/test hxxps://gays[.]egorvlasov[.]ru:8443/jquery-3[.]3[.]1[.]min[.]js hxxps://170[.]64[.]236[.]133/g[.]pixel hxxp://120[.]25[.]1[.]52/j[.]ad hxxps://service-b7okr3qc-1300276284[.]nj[.]tencentapigw[.]com/pixel[.]gif hxxp://139[.]198[.]33[.]161:8088/fwlink hxxp://175[.]27[.]137[.]15:8080/match hxxp://112[.]124[.]64[.]105:7894/Pr8c hxxp://124[.]71[.]136[.]141:81/ga[.]js hxxp://47[.]115[.]203[.]204:8080/cm hxxps://service-bjb5aex0-1318428097[.]gz[.]tencentapigw[.]com[.]cn/api/user hxxp://134[.]122[.]75[.]115/visit[.]js hxxp://120[.]46[.]130[.]73:6666/match hxxp://86[.]106[.]20[.]179/ab[.]html hxxp://112[.]124[.]64[.]105:8080/cmd[.]10001[.]exe hxxp://121[.]199[.]0[.]54/api/getit hxxps://45[.]61[.]136[.]169/api/3 hxxps://m[.]old[.]gxjczx[.]gov[.]cn/info hxxps://192[.]236[.]176[.]143/cm hxxp://120[.]46[.]130[.]73:6666/pixel[.]gif hxxp://93[.]185[.]166[.]60/common[.]css hxxp://47[.]94[.]241[.]49:8090/__utm[.]gif hxxps://update[.]360safety[.]xyz:8443/push hxxp://47[.]99[.]177[.]59:6666/pixel hxxps://service-43eyvs26-1312185610[.]gz[.]tencentapigw[.]com[.]cn/dot[.]gif hxxp://service-43eyvs26-1312185610[.]gz[.]tencentapigw[.]com[.]cn/cx hxxp://45[.]93[.]20[.]242/visit[.]js hxxps://chniabank[.]com:2083/j[.]ad hxxps://195[.]123[.]217[.]22/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books hxxps://185[.]236[.]231[.]201/push hxxp://172[.]121[.]5[.]230:81/match hxxps://dockerupdate[.]xyz/jquery-3[.]3[.]1[.]min[.]js |
Cobalt Strike |
| URL | hxxp://sly[.]fishoaks[.]net/data/pdf/june[.]exe hxxp://diiedud[.]info/search/?q=67e28dd83f0fa47b1407ab4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978a271ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6689fe12c5ef90 hxxp://bwukcsn[.]com/search/?q=67e28dd86e0bf32a420fa9187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe16c1ec91933c hxxp://bwukcsn[.]com/search/?q=67e28dd86e0bf32a420fa9187c27d78406abdd88be4b12eab517aa5c96bd86ec978e48885a8bbc896c58e713bc90c91836b5281fc235a925ed3e03d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee949d3ace6b9f11 hxxp://cskunlq[.]net/search/?q=67e28dd8655bfa7a130da94c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f371ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6689fe11c5ea93 hxxp://aqlbvcf[.]ru/search/?q=67e28dd86b5ea42a430af91a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe16c1ef909e32 hxxp://aqlbvcf[.]ru/search/?q=67e28dd86b5ea42a430af91a7c27d78406abdd88be4b12eab517aa5c96bd86eb97854b815a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee949d3acd6a921f |
Socks5 Systemz |
| URL | hxxp://103[.]173[.]178[.]208/bot[.]x86_64 hxxp://103[.]173[.]178[.]208/bot[.]arm7 hxxp://103[.]173[.]178[.]208/bot[.]mips hxxp://103[.]173[.]178[.]208/bot[.]m68k hxxp://103[.]173[.]178[.]208/bot[.]sh4 hxxp://103[.]173[.]178[.]208/bot[.]mpsl hxxp://103[.]173[.]178[.]208/bot[.]arm6 hxxp://103[.]173[.]178[.]208/bot[.]ppc hxxp://103[.]173[.]178[.]208/bot[.]x86 hxxp://103[.]173[.]178[.]208/bot[.]arm hxxp://103[.]173[.]178[.]208/bot[.]arm5 |
MooBot |
| URL | hxxps://cdn[.]discordapp[.]com/attachments/1222879802491670611/1222880785674141826/Akh_2[.]exe?ex=6617d37b&is=66055e7b&hm=e6b6f7f337946ff24f1a2ef970c346c4884a616aac3ae01e41ead24eac3b34db& hxxp://193[.]233[.]132[.]167/lend/Akh[.]exe |
Glupteba |
| URL | hxxp://185[.]149[.]146[.]222/DemagogicAlewife[.]exe hxxp://185[.]149[.]146[.]227/Titanium[.]exe |
RedLine Stealer |
| URL | hxxp://185[.]196[.]10[.]233/dffgfgdf[.]exe hxxp://185[.]196[.]10[.]233/fuufdfs[.]exe hxxp://185[.]196[.]10[.]233/bestbuild[.]exe hxxp://185[.]196[.]10[.]233/hghghdg[.]exe hxxp://185[.]196[.]10[.]233/dfgfgds[.]exe hxxp://185[.]196[.]10[.]233/Client-built4[.]exe hxxp://185[.]196[.]10[.]233/hghgfhjfhmain[.]exe |
Quasar RAT |
| URL | hxxp://185[.]196[.]10[.]233/GoogleCrashHandler[.]exe hxxp://185[.]196[.]10[.]233/gfhghfdg[.]exe |
Agent Tesla |
| URL | hxxp://185[.]196[.]10[.]233/Yjtqssgb[.]exe hxxps://transfer[.]adttemp[.]com[.]br/qa1ca/crypted[.]exe |
zgRAT |
| URL | hxxp://ww[.]wowapplecar[.]com/config[.]rar hxxp://104[.]218[.]236[.]48/11[.]txt |
XOR DDoS |
| URL | hxxp://27[.]215[.]123[.]243:41040/Mozi[.]m hxxp://115[.]49[.]156[.]167:53874/Mozi[.]m |
Mozi |
| URL | hxxps://www[.]donquichottedeladendre-ath[.]be/xmlrpc[.]php hxxps://stanta[.]co[.]uk/xmlrpc[.]php hxxps://juststories[.]se/xmlrpc[.]php hxxps://kemilektioner[.]se/xmlrpc[.]php hxxps://support[.]dotregis[.]com/xmlrpc[.]php hxxps://www[.]cantinalandi[.]com/xmlrpc[.]php hxxps://exceloffthegrid[.]com/xmlrpc[.]php hxxps://hitech-us[.]com/xmlrpc[.]php hxxps://eatech[.]uk/xmlrpc[.]php hxxps://seiji-folk[.]com/xmlrpc[.]php hxxps://ww4[.]amazila[.]cz/xmlrpc[.]php hxxps://wielkopolskamagazyn[.]pl/xmlrpc[.]php hxxps://tanya-tanya[.]com/xmlrpc[.]php hxxps://baaghitv[.]com/xmlrpc[.]php hxxps://192-168-1-1-admin-admin[.]ru/xmlrpc[.]php hxxps://lasantaespina[.]cat/xmlrpc[.]php hxxps://mepiu[.]it/xmlrpc[.]php hxxps://vipaco[.]vn/xmlrpc[.]php hxxps://www[.]beeldvorm[.]eu/xmlrpc[.]php hxxps://www[.]8ktv-test[.]de/xmlrpc[.]php hxxps://mlwmlw[.]org/xmlrpc[.]php hxxps://seorongdaiduong[.]com/xmlrpc[.]php |
GootLoader |
| URL | hxxp://ipdore[.]org/ipd/index[.]php | SmokeLoader |
| URL | hxxp://185[.]196[.]10[.]233/ytgytftf[.]exe | AsyncRAT |
