不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/05/24
※2024/05/24 更新
マルウェア感染させると考えられるURLを検知（2024/05/24）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://45[.]128[.]232[.]15/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042[.]arm7 hxxp://91[.]92[.]240[.]85/x86_64 hxxp://91[.]92[.]240[.]85/armv5l hxxp://91[.]92[.]240[.]85/i686 hxxp://91[.]92[.]240[.]85/armv6l hxxp://91[.]92[.]240[.]85/mipsel hxxp://91[.]92[.]240[.]85/sh4 hxxp://91[.]92[.]240[.]85/sparc hxxp://91[.]92[.]240[.]85/mips hxxp://91[.]92[.]240[.]85/armv4l hxxp://91[.]92[.]240[.]85/powerpc hxxp://91[.]92[.]240[.]85/m68k hxxp://91[.]92[.]240[.]85/i586 |
Bashlite |
| URL | hxxps://cyclohexylamine[.]top/YWRhZjAxNGM1YjFh/ hxxps://excommunicative[.]cc/YWRhZjAxNGM1YjFh/ hxxps://quinquagenarian[.]xyz/YWRhZjAxNGM1YjFh/ hxxps://juxtaglomerular[.]net/YWRhZjAxNGM1YjFh/ hxxps://juxtaglomerular[.]hk/YWRhZjAxNGM1YjFh/ hxxps://54ggter6ujfgt[.]site/NmFkZTc4YWM3ZTk2/ hxxps://kdehrweuybvfrer4[.]xyz/NmFkZTc4YWM3ZTk2/ hxxps://frewgewhy6fg[.]top/NmFkZTc4YWM3ZTk2/ hxxps://jey6mjdyerh82k[.]online/NmFkZTc4YWM3ZTk2/ |
Coper |
| URL | hxxps://animefestival[.]asia/manual[.]php hxxps://chudywawrzyniec[.]pl/manual[.]php hxxps://cimaq[.]es/manual[.]php hxxps://cambiobolivar[.]com/manual[.]php hxxps://azahar[.]bg/manual[.]php hxxps://blog[.]kappo-mifuku[.]com/manual[.]php |
GootLoader |
| URL | hxxps://womendonotdothat[.]com/cdn-vs/original[.]js hxxps://womendonotdothat[.]com/cdn-vs/cache[.]php hxxps://womendonotdothat[.]com/cdn-vs/2per[.]php hxxps://xga[.]glue[.]oystergardening[.]net/editContent hxxps://wfy[.]glue[.]oystergardening[.]net/editContent hxxps://bvqm[.]glue[.]oystergardening[.]net/editContent hxxps://lfon[.]glue[.]oystergardening[.]net/editContent |
FAKEUPDATES |
| URL | hxxp://194[.]59[.]31[.]163/arm7 hxxp://194[.]59[.]31[.]163/i686 hxxp://194[.]59[.]31[.]163/sh |
Coinminer |
| URL | hxxp://38[.]62[.]245[.]120/XytiEsGVWJPs243[.]bin hxxp://38[.]153[.]61[.]199/QgSCbsMyS221[.]bin |
CloudEyE |
| URL | hxxp://93[.]123[.]39[.]223//atest/retf543[.]bat hxxp://93[.]123[.]39[.]223//atest/s%20-Zn--%20-S[.]exe hxxp://93[.]123[.]39[.]223//atest/754abcd6[.]bat |
XWorm |
| URL | hxxp://34[.]118[.]17[.]38/bot[.]ppc hxxp://34[.]118[.]17[.]38/bot[.]mpsl hxxp://34[.]118[.]17[.]38/bot[.]m68k hxxp://34[.]118[.]17[.]38/bot[.]x86_64 hxxp://34[.]118[.]17[.]38/bot[.]mips hxxp://34[.]118[.]17[.]38/bot[.]spc hxxp://34[.]118[.]17[.]38/bot[.]arm hxxp://34[.]118[.]17[.]38/bot[.]arm6 hxxp://34[.]118[.]17[.]38/bot[.]sh4 hxxp://34[.]118[.]17[.]38/bot[.]arm5 hxxp://103[.]237[.]87[.]24/bot[.]arm5 hxxp://103[.]237[.]87[.]24/bot[.]arm hxxp://103[.]237[.]87[.]24/bot[.]arm7 hxxp://103[.]237[.]87[.]24/bot[.]mips hxxp://103[.]237[.]87[.]24/bot[.]mpsl hxxp://103[.]237[.]87[.]24/bot[.]sh4 hxxp://103[.]237[.]87[.]24/bot[.]m68k hxxp://103[.]237[.]87[.]24/bot[.]arm6 hxxp://103[.]237[.]87[.]24/bot[.]x86_64 hxxp://103[.]237[.]87[.]24/bot[.]spc hxxp://103[.]237[.]87[.]24/bot[.]ppc |
MooBot |
| URL | hxxp://123[.]207[.]29[.]252:55554/pixel[.]gif hxxp://124[.]70[.]99[.]70/assets/css/bootstrap[.]sass hxxp://60[.]204[.]135[.]117/g[.]pixel hxxp://91[.]224[.]92[.]27/cx hxxp://60[.]204[.]217[.]11:9998/match hxxps://182[.]92[.]216[.]171/search/ hxxps://47[.]116[.]33[.]203/j[.]ad hxxps://121[.]40[.]127[.]134:4443/cm hxxps://117[.]72[.]47[.]106:4443/__utm[.]gif hxxp://124[.]71[.]46[.]93:8080/g[.]pixel hxxp://117[.]72[.]35[.]30:2222/cm hxxp://47[.]108[.]137[.]190/ga[.]js hxxp://141[.]98[.]7[.]79/fwlink hxxps://47[.]120[.]67[.]163/push hxxps://118[.]89[.]125[.]171/match hxxp://118[.]25[.]192[.]79/fwlink hxxps://117[.]50[.]179[.]15/aaaaaaaaa hxxp://38[.]207[.]176[.]115:8080/pixel[.]gif hxxp://118[.]31[.]115[.]178:9999/ptj hxxp://118[.]195[.]183[.]6/activity hxxp://154[.]3[.]0[.]70:83/cm hxxp://124[.]220[.]215[.]195:9999/ca hxxp://3[.]145[.]83[.]235:8080/updates[.]rss hxxp://106[.]15[.]62[.]124:2222/push hxxps://www[.]bitdefenders[.]shop/jquery-3[.]3[.]1[.]min[.]js hxxp://124[.]220[.]215[.]195:5555/pixel hxxp://118[.]31[.]115[.]178:4444/ga[.]js hxxps://118[.]195[.]183[.]6/dot[.]gif hxxp://129[.]211[.]215[.]7/dot[.]gif hxxps://202[.]144[.]192[.]44/jquery-3[.]3[.]1[.]min[.]js hxxp://64[.]7[.]198[.]122:666/dot[.]gif hxxps://117[.]72[.]46[.]146:8443/update/version hxxp://38[.]207[.]176[.]115:8081/dpixel hxxps://46[.]101[.]212[.]131/ga[.]js hxxps://159[.]223[.]29[.]112/load hxxps://101[.]91[.]154[.]125:50002/visit[.]js hxxp://101[.]91[.]154[.]125:50001/cm |
Cobalt Strike |
| URL | hxxp://objectiveci[.]top/pythonpacketGamebigloadprivateCentral[.]php hxxp://822987529cm[.]whiteproducts[.]ru/L1nc0In[.]php |
DCRat |
| URL | hxxp://43[.]129[.]250[.]120/2[.]apk hxxp://43[.]129[.]250[.]120/1[.]apk hxxp://43[.]129[.]250[.]120/6[.]apk hxxp://43[.]129[.]250[.]120/66[.]apk hxxp://43[.]129[.]250[.]120/7[.]apk hxxp://43[.]129[.]250[.]120/88[.]apk hxxp://43[.]129[.]250[.]120/3[.]apk hxxp://43[.]129[.]250[.]120/8[.]apk hxxp://45[.]138[.]16[.]250/ready[.]apk hxxp://143[.]92[.]49[.]58/12[.]apk hxxp://45[.]138[.]16[.]52/asdf[.]apk hxxp://45[.]138[.]16[.]52/ready[.]apk hxxp://45[.]138[.]16[.]52/Unprotect[.]apk hxxp://45[.]138[.]16[.]52/GirlSex-CRv[.]7[.]2[.]apk hxxp://45[.]138[.]16[.]52/app-release-unsigned[.]apk hxxp://45[.]138[.]16[.]52/GirlSex%20CR_v7[.]2[.]apk hxxp://13[.]201[.]121[.]143/ready[.]apk hxxp://66[.]235[.]168[.]242/Scorpion[.]apk hxxp://66[.]235[.]168[.]242/Craxs[.]apk hxxps://193[.]222[.]96[.]128:7287/ready[.]apk |
SpyNote |
| URL | hxxp://185[.]225[.]191[.]26/GoogleUpdateTaskMachineQCW[.]exe | Tinba |
| URL | hxxp://91[.]92[.]255[.]93/MartDrum[.]exe hxxp://91[.]92[.]255[.]93/costs[.]zip hxxp://91[.]92[.]255[.]93/start[.]exe hxxp://91[.]92[.]255[.]93/regasms[.]exe hxxp://162[.]244[.]210[.]227/taher[.]txt hxxp://162[.]244[.]210[.]227/kosom3losh[.]jpg hxxp://66[.]235[.]168[.]242/Testing[.]exe hxxp://66[.]235[.]168[.]242/new%20loader[.]rar hxxp://66[.]235[.]168[.]242/WinDefend[.]rar hxxps://142[.]202[.]242[.]176/a[.]jpg hxxp://104[.]243[.]40[.]225:222/HHAMMOFATHEATBBDNN[.]jpg hxxp://104[.]243[.]40[.]225:222/sfsffgeytrfyhbb[.]txt hxxps://2[.]58[.]56[.]30/noka[.]txt hxxps://2[.]58[.]56[.]30/hids[.]txt hxxps://2[.]58[.]56[.]30/gxae[.]jpg hxxp://85[.]203[.]4[.]146/csrss[.]exe hxxp://85[.]203[.]4[.]146/Bypass3_Pure_Mode[.]exe |
AsyncRAT |
| URL | hxxp://91[.]92[.]255[.]93/rem[.]exe hxxp://198[.]46[.]178[.]154/550033/bitmaplionjungleimageforview[.]bmp hxxps://paste[.]ee/d/NhBmA hxxps://paste[.]ee/d/j5TgA hxxp://198[.]12[.]81[.]178/43411/UHHF[.]txt hxxp://198[.]46[.]177[.]156/xampp/kw/KWIK[.]txt hxxp://198[.]46[.]178[.]154/550033/LLTC[.]txt hxxp://198[.]12[.]81[.]178/43411/lionisthekingofjungleimageshere[.]bmp hxxp://198[.]46[.]177[.]156/xampp/kw/rulethejunglewithnewlionkingimage[.]bmp hxxps://paste[.]ee/d/W7VfG hxxp://198[.]46[.]177[.]156/xampp/kw/k/lionisthekingofjunglewhoruletheentirejungletounderstandhowpowerfulkingofjungleheisattitudeismakingentirethinggreattounderstand___lionkingrulethejunglefors[.]doc hxxp://198[.]46[.]178[.]154/xampp/hmss/lionsarekingbitmapimagesarebeautiuflandlionsareveryamazingcharacterandbehavinggreatattitudetounerstandthelionsaregreatandverynice___lionsarekingofjungle[.]doc hxxp://198[.]12[.]81[.]178/43411/nbv/lionisthekingbuttigertrytobecomeakingofthejunglewhowanttocontrolthejungleentireworldireallywantkiglionunderstand___heisthepoweroflionskig[.]doc hxxps://pasteio[.]com/raw/xCjIO3SCur0S |
Remcos |
| URL | hxxp://185[.]196[.]10[.]81/vax[.]exe hxxp://66[.]235[.]168[.]242/CLients/Client[.]exe |
Venom RAT |
| URL | hxxp://66[.]235[.]168[.]242/CLients/Infected[.]exe hxxps://www[.]vibrantbhutan[.]com/wp-content/plugins/real/udEgjlWWrglqRbBznmPo245[.]bin hxxp://20[.]86[.]128[.]223/room/rooma[.]exe hxxp://20[.]86[.]128[.]223/room/room4[.]hta |
Formbook |
| URL | hxxp://144[.]76[.]219[.]54:8081/raw_stageless_8000[.]hta hxxp://144[.]76[.]219[.]54:8081/s_8000[.]hta hxxp://joyofcoding[.]de:8081/s_8000[.]hta hxxp://joyofcoding[.]de:8081/raw_stageless_8000[.]hta hxxp://144[.]76[.]219[.]54:8081/lins2[.]ps1 hxxp://joyofcoding[.]de:8081/lins2[.]ps1 |
Metasploit |
| URL | hxxps://api[.]telegram[.]org/bot6708321519:AAH9WPgZQN8mlLl2zn6ccUEu4DYMqGCeTcQ/ hxxps://api[.]telegram[.]org/bot6521856051:AAE_VqJACYh8GJnmBCYkrp8n7Ax0fW5fJ5s/ hxxps://api[.]telegram[.]org/bot6814314158:AAEkRl6H9QdGzzoVC6YfWI-wFLiqXO8LEls/ |
Agent Tesla |
| URL | hxxp://sssteell-com[.]asia/sht/fre[.]php hxxps://universalmovies[.]top/sharonzx[.]exe |
LokiBot |
| URL | hxxp://45[.]84[.]0[.]173/download_22/server[.]exe hxxp://94[.]232[.]249[.]161/download/svc[.]exe |
SmokeLoader |
| URL | hxxp://5[.]42[.]96[.]7/lend/fileosn[.]exe | RedLine Stealer |
