不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様3社 -
2024/05/08
※2024/05/08 更新
マルウェア感染させると考えられるURLを検知（2024/05/08）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://ejthbia[.]ua/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628efa15c2ec95 hxxp://ejthbia[.]ua/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86e992854d845a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5ef909e39ce6f hxxp://bonpooi[.]com/search/?q=67e28dd83e5cfa2f440afa1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c5eb979832 hxxp://buvhcvn[.]com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628efa18c0ed9d hxxp://buvhcvn[.]com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86e992854d845a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5ef90933bcf67 hxxp://boboibc[.]com/search/?q=67e28dd8650ba020110ffe1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c5e695983d hxxp://erhvhzu[.]ua/search/?q=67e28dd83d5fa62d1358fa4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628ef919c3eb93 hxxp://bxkzvod[.]com/search/?q=67e28dd86f0bfb7b435fa54e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1ee8889b5e4fa9281ae978a371ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c6e796993a hxxp://bxkzvod[.]com/search/?q=67e28dd86f0bfb7b435fa54e7c27d78406abdd88be4b12eab517aa5c96bd86eb968349805a8bbc896c58e713bc90c94b36b5281fc235a925ed3e00d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909a3dc56c9517 hxxp://ezqpoit[.]ua/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628ef817c7ec94 hxxp://bwwrosd[.]com/search/?q=67e28dd83d0ef22d4407ad4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f371ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c7e9929833 hxxp://bwwrosd[.]com/search/?q=67e28dd83d0ef22d4407ad4d7c27d78406abdd88be4b12eab517aa5c96bd86ec90824d885a8bbc896c58e713bc90c91d36b5281fc235a925ed3e50d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909a3ccb68941e hxxp://bnwmjon[.]com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628ef814c8ec94 hxxp://ezzurom[.]ua/search/?q=67e28dd83f0ef37d415cab4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1ee8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c7ea9d9833 hxxp://dieisdm[.]info/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628ef711c6ec90 hxxp://dieisdm[.]info/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12eab517aa5c96bd86ee928244845a8bbc896c58e713bc90c91d36b5281fc235a925ed3e55d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5ef9d9a3dce6a hxxp://ebhxxnp[.]ua/search/?q=67e28dd86c5cf27a4508ad177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c8ef939938 hxxp://ebhxxnp[.]ua/search/?q=67e28dd86c5cf27a4508ad177c27d78406abdd88be4b12eab517aa5c96bd86ec9d814c845a8bbc896c58e713bc90c91836b5281fc235a925ed3e54d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909a33cd699515 hxxp://bxdeovo[.]com/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628ef713c1ec94 hxxp://bdkpuei[.]com/search/?q=67e28dd8650ba020110ffe1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c8ed949832 hxxp://bdkpuei[.]com/search/?q=67e28dd8650ba020110ffe1b7c27d78406abdd88be4b12eab517aa5c96bd86ec90804a845a8bbc896c58e713bc90c91e36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909a33cf6e941f hxxps://gig[.]fastbutters[.]com/style/060[.]exe hxxp://bfwfrcv[.]com/search/?q=67e28dd83d5fa62d1358fa4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628ef617c3e99d hxxp://bxxefuc[.]com/search/?q=67e28dd83d0ef22d4407ad4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f371ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa11c9e9969e32 hxxp://bxxefuc[.]com/search/?q=67e28dd83d0ef22d4407ad4d7c27d78406abdd88be4b12eab517aa5c96bd86ec90824d885a8bbc896c58e713bc90c91d36b5281fc235a925ed3e50d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee909a32cb6c921f |
Socks5 Systemz |
| URL | hxxp://93[.]123[.]85[.]94/a-r[.]m-6[.]Sakura hxxp://216[.]250[.]247[.]185/openssh hxxp://216[.]250[.]247[.]185/telnetd hxxp://216[.]250[.]247[.]185/cron hxxp://216[.]250[.]247[.]185/apache2 hxxp://216[.]250[.]247[.]185/ftp hxxp://216[.]250[.]247[.]185/wget hxxp://216[.]250[.]247[.]185/ntpd hxxp://216[.]250[.]247[.]185/tftp hxxp://216[.]250[.]247[.]185/pftp hxxp://216[.]250[.]247[.]185/sparc hxxp://apt[.]daili778[.]org//a-r[.]m-7[.]Sakura hxxp://apt[.]daili778[.]org//m-6[.]8-k[.]Sakura hxxp://apt[.]daili778[.]org//i-5[.]8-6[.]Sakura hxxp://apt[.]daili778[.]org//a-r[.]m-6[.]Sakura hxxp://apt[.]daili778[.]org//m-i[.]p-s[.]Sakura hxxp://apt[.]daili778[.]org//x-8[.]6-[.]Sakura hxxp://apt[.]daili778[.]org//p-p[.]c-[.]Sakura hxxp://apt[.]daili778[.]org//a-r[.]m-4[.]Sakura hxxp://apt[.]daili778[.]org//x-3[.]2-[.]Sakura hxxp://apt[.]daili778[.]org//s-h[.]4-[.]Sakura hxxp://93[.]123[.]85[.]43/keksec[.]armv6l |
Bashlite |
| URL | hxxp://154[.]40[.]47[.]195:9000/winin[.]exe | Coinminer |
| URL | hxxps://libidotechnexus[.]com/cdn-vs/cache[.]php hxxps://libidotechnexus[.]com/cdn-vs/original[.]js hxxps://libidotechnexus[.]com/cdn-vs/per[.]php |
FAKEUPDATES |
| URL | hxxps://trxu[.]xyz/Up/b hxxps://trxq[.]xyz/Up/b hxxps://trxu[.]xyz/Up hxxps://trxq[.]xyz/Up hxxps://trxh[.]xyz/Up/b hxxps://trxh[.]xyz/Up hxxps://trxh[.]xyz/ujs/9adbbdfd-2661-43e4-8280-7f9a9698f912 hxxps://veronicabal[.]com/Up/b hxxps://veronicabal[.]com/Up hxxps://iicc[.]fun/Up/b hxxps://iicc[.]fun/Up hxxps://iicc[.]fun/ujs/10924410-23ef-465e-a794-c614640e2bf2 hxxps://dervinko[.]biz/Up/b hxxps://dervinko[.]biz/ujs/8921e7ad-5b9e-4fca-97e6-c631b2636cc9 hxxps://dervinko[.]biz/Up |
ACR Stealer |
| URL | hxxp://8[.]210[.]106[.]29/wzaa[.]apk hxxp://164[.]155[.]241[.]223/ready[.]apk hxxps://164[.]155[.]241[.]223/ready[.]apk |
SpyNote |
| URL | hxxp://194[.]48[.]251[.]225/UiPkaOmpKXnORfArHC154[.]bin hxxp://172[.]93[.]222[.]124/vvMmXkxeJnMfldkrZMBzsw200[.]bin hxxp://172[.]93[.]222[.]124/cfueFKjoAKfWEEtH149[.]bin hxxp://146[.]70[.]113[.]142/IOldXqHdDSd129[.]bin hxxp://146[.]70[.]113[.]142/oRigCPjHHVWphl17[.]bin hxxp://146[.]70[.]113[.]136/FREMeQJBELSEb225[.]bin hxxp://193[.]239[.]86[.]203/uyRbYoVErtwa130[.]bin hxxp://193[.]239[.]86[.]203/wBowyPGilUyuu145[.]bin hxxp://193[.]239[.]86[.]203/VnPeyQJeQWfOeoSscEDC193[.]bin hxxp://193[.]239[.]86[.]203/JqMjLKsnaEQWd40[.]bin hxxp://45[.]137[.]22[.]179/vFbgyA151[.]bin hxxp://45[.]137[.]22[.]179/HbGlivTFZr68[.]bin hxxp://45[.]137[.]22[.]179/DiLKHqmssH72[.]bin hxxp://45[.]137[.]22[.]179/qPGmnZjwtVSpxaWmrzpWcifncwM103[.]bin |
CloudEyE |
| URL | hxxp://45[.]138[.]16[.]97:222/j[.]jpg hxxp://45[.]138[.]16[.]97:222/gs367[.]rar hxxps://github[.]com/ExeXeam/Test/raw/main/Discord[.]exe |
AsyncRAT |
| URL | hxxp://sro3ga[.]net/bot[.]arm7 hxxp://sro3ga[.]net/wget[.]sh hxxp://sro3ga[.]net/bot[.]arm6 hxxp://sro3ga[.]net/c[.]sh hxxp://sro3ga[.]net/w[.]sh hxxp://103[.]174[.]73[.]185/bulon[.]mips hxxp://103[.]174[.]73[.]185/bulon[.]m68k hxxp://103[.]174[.]73[.]185/bulon[.]mpsl hxxp://103[.]174[.]73[.]185/bulon[.]ppc hxxp://103[.]174[.]73[.]185/bulon[.]arm7 hxxp://103[.]174[.]73[.]185/bulon[.]x86 hxxp://103[.]174[.]73[.]185/bulon[.]arm hxxp://103[.]174[.]73[.]185/bulon[.]sh4 hxxp://103[.]174[.]73[.]185/bulon[.]arm5 hxxp://103[.]174[.]73[.]185/bulon[.]x86_64 hxxp://103[.]174[.]73[.]185/bulon[.]arm6 hxxp://103[.]174[.]73[.]185/hentaic[.]sh |
MooBot |
| URL | hxxp://912648[.]aioc[.]qbgxl[.]com/aioc_5[.]0[.]0[.]63_it[.]exe | NjRAT |
| URL | hxxp://124[.]220[.]62[.]60/push hxxp://120[.]53[.]249[.]27/en_US/all[.]js hxxp://otomotif[.]kumbaraan[.]biz[.]id/dhl hxxps://38[.]147[.]170[.]150:8443/fwlink hxxp://52[.]190[.]15[.]163/dot[.]gif hxxp://38[.]147[.]170[.]150:5555/fwlink hxxp://a2ef406e2c2351e0b9e80029c909242d[.]melonhack[.]top/api/get hxxps://62[.]204[.]41[.]11/pixel[.]gif hxxp://62[.]204[.]41[.]11/j[.]ad hxxp://88[.]214[.]26[.]29:8001/ga[.]js hxxp://79[.]124[.]40[.]106:81/dpixel hxxp://mystoreanandhelens[.]online/cx hxxp://43[.]128[.]113[.]251/ptj hxxp://47[.]236[.]52[.]108/fwlink hxxp://8[.]219[.]204[.]94/g[.]pixel hxxps://139[.]159[.]183[.]48/googleapi/affiliation/v1/affiliation:lookupByHashPrefix hxxp://134[.]122[.]75[.]115:26/ptj hxxp://60[.]204[.]217[.]11:9998/__utm[.]gif hxxp://1[.]117[.]232[.]76:4880/updates[.]rss hxxp://134[.]122[.]75[.]115:23/load hxxp://175[.]178[.]242[.]75:50001/j[.]ad hxxps://175[.]178[.]242[.]75:50002/dot[.]gif hxxp://134[.]122[.]75[.]115/ga[.]js hxxp://117[.]72[.]8[.]192/c/msdownload/update/others/2024/05/9Dv7AyHg1Ag2KwO30_ hxxp://74[.]91[.]29[.]102:389/Display/chan/IB61I7MYA hxxps://91[.]92[.]249[.]122/updates hxxps://111[.]230[.]12[.]238/updates[.]rss hxxps://113[.]31[.]106[.]106/preserve/Extranet/LFF00FQ6U2H0 hxxp://74[.]91[.]29[.]102:18080/Display/chan/IB61I7MYA hxxp://148[.]135[.]119[.]4:9999/artifact[.]exe hxxp://54[.]244[.]147[.]176/load hxxp://proya[.]cyou:8880/jquery-3[.]3[.]3[.]min[.]js hxxps://54[.]244[.]147[.]176/cm hxxps://www[.]testtttt[.]com/__utm[.]gif hxxp://110[.]41[.]21[.]173/cm hxxp://79[.]132[.]142[.]65/live/content/stream-9a42d411-e060-49be-8cd9-9a15d111ea30/f29df6de-5918-46d2-a4b8-157990ed06ab hxxp://172[.]81[.]132[.]113/pixel[.]gif hxxp://54[.]82[.]65[.]203/c/msdownload/update/others/2016/12/29136388_ hxxp://otomotif[.]kumbaraan[.]biz[.]id/ee |
Cobalt Strike |
| URL | hxxps://2moneycsasfasfh[.]net/MmExODA3MDAzZjA5/ hxxps://2moneycsasfasfh[.]com/MmExODA3MDAzZjA5/ hxxps://3moneycsasfasfh[.]com/MmExODA3MDAzZjA5/ |
Coper |
| URL | hxxp://filesclubspot[.]com/Wasabi-2[.]0[.]7[.]msi | CryptoShuffler |
| URL | hxxps://api[.]telegram[.]org/bot6553114829:AAEMlA1qr5Yr1FBMmFOzGJ4u1I7pe8Q3fFE/ hxxps://api[.]telegram[.]org/bot7067377332:AAF1Z69djrINdckbERjctdNVVFMZKwtEd3A/ hxxps://api[.]telegram[.]org/bot6244975505:AAGeeUix_vdcFjXj6Faq-TEvsRJb49svKGk/ hxxps://api[.]telegram[.]org/bot6240128422:AAGLQbyR3zUrBSC7L4vc4gkYyOSOKuxj8fw/ |
Agent Tesla |
| URL | hxxp://193[.]163[.]7[.]82/722c81812703a73d[.]php hxxp://193[.]233[.]132[.]234/files/Isetup2[.]exe hxxp://193[.]233[.]132[.]234/files/newexe[.]exe |
Stealc |
| URL | hxxp://77[.]75[.]230[.]59/share/MS_EXCEL_DOCUMENT_HELPER[.]hta | DarkGate |
| URL | hxxp://117[.]200[.]176[.]50:36338/Mozi[.]m hxxp://117[.]212[.]101[.]199:57681/Mozi[.]m |
Mozi |
| URL | hxxps://chunkylopsidedwos[.]shop/api | Lumma Stealer |
| URL | hxxp://5[.]42[.]96[.]7/doka/candy[.]exe | Amadey |
