不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様2社 -
2024/05/28
※2024/05/28 更新
マルウェア感染させると考えられるURLを検知（2024/05/28）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://atou[.]mg/setup[.]exe hxxps://atou[.]mg/d[.]exe hxxp://193[.]233[.]202[.]219/miner/qrl[.]tar hxxp://193[.]233[.]202[.]219/miner/miner2[.]tar hxxp://193[.]233[.]202[.]219/[.]cache/stak/xmrig |
Coinminer |
| URL | hxxps://juxleq[.]top/MjE2YTczY2MxNjA0/ hxxps://fozkiv[.]xyz/MjE2YTczY2MxNjA0/ hxxps://wemdap[.]top/MjE2YTczY2MxNjA0/ hxxps://zupqel[.]xyz/MjE2YTczY2MxNjA0/ hxxps://rizyat[.]top/MjE2YTczY2MxNjA0/ hxxps://gikmuv[.]xyz/MjE2YTczY2MxNjA0/ hxxps://xotpin[.]top/MjE2YTczY2MxNjA0/ hxxps://werboq[.]xyz/MjE2YTczY2MxNjA0/ hxxps://nevdiz[.]xyz/MjE2YTczY2MxNjA0/ hxxps://hudxap[.]top/MjE2YTczY2MxNjA0/ hxxps://kovjep[.]top/MjE2YTczY2MxNjA0/ hxxps://tupfij[.]xyz/MjE2YTczY2MxNjA0/ hxxps://yiqvux[.]xyz/MjE2YTczY2MxNjA0/ hxxps://qowzef[.]top/MjE2YTczY2MxNjA0/ hxxps://leoyuz[.]top/MjE2YTczY2MxNjA0/ hxxps://xepmeq[.]xyz/MjE2YTczY2MxNjA0/ hxxps://qidvob[.]top/MjE2YTczY2MxNjA0/ hxxps://gufwap[.]xyz/MjE2YTczY2MxNjA0/ hxxps://xulqir[.]top/MjE2YTczY2MxNjA0/ hxxps://lupzod[.]xyz/MjE2YTczY2MxNjA0/ hxxps://sekenmarabatayfabanane[.]shop/ZDQyN2NmOGEzOTlk/ hxxps://kemerdekaradarderler32[.]shop/ZDQyN2NmOGEzOTlk hxxps://karalarlanasa[.]net/ZDQyN2NmOGEzOTlk/ hxxps://hakandakal2[.]shop/ZDQyN2NmOGEzOTlk/ hxxps://manavhakanlar[.]shop/ZDQyN2NmOGEzOTlk/ hxxps://kiremithanedekiler[.]shop/ZDQyN2NmOGEzOTlk/ hxxps://kemerdekaradara123[.]shop/ZDQyN2NmOGEzOTlk/ hxxps://kemerdekaradar[.]shop/ZDQyN2NmOGEzOTlk/ hxxps://massakarada[.]shop/ZDQyN2NmOGEzOTlk/ |
Coper |
| URL | hxxps://signcitysa[.]com/understanding-japanese-weapon-laws-regulations-and-restrictions/ | GootLoader |
| URL | hxxp://sempersim[.]su/d8/fre[.]php | LokiBot |
| URL | hxxps://elbied[.]com/cdn-vs/2per[.]php hxxps://elbied[.]com/cdn-vs/original[.]js hxxps://elbied[.]com/cdn-vs/cache[.]php hxxps://hlik[.]loans[.]fishingreelinvestments[.]com/editContent hxxps://bookmycooks[.]com/cdn-vs/original[.]js hxxps://bookmycooks[.]com/cdn-vs/cache[.]php hxxps://bookmycooks[.]com/cdn-vs/2per[.]php hxxp://ycva887[.]top/data[.]php hxxps://wiz[.]sticky[.]oystergardening[.]name/editContent |
FAKEUPDATES |
| URL | hxxp://47[.]104[.]173[.]216:9876/STHealthUpdate[.]exe hxxp://47[.]104[.]173[.]216:9876/STHealthBQ[.]exe hxxp://47[.]104[.]173[.]216:9876/STHealthUpload[.]exe hxxp://47[.]104[.]173[.]216:9876/GGWS_UPLOAD[.]exe hxxps://transfer[.]adttemp[.]com[.]br/get/XtFVA/12345[.]exe |
RedLine Stealer |
| URL | hxxps://45[.]62[.]170[.]158/ewazzo[.]txt hxxps://185[.]196[.]8[.]144/bb[.]jpg hxxps://45[.]62[.]170[.]158/3EZI[.]jpg hxxps://185[.]196[.]8[.]144/6n57[.]txt hxxps://185[.]196[.]8[.]144/55n57[.]txt hxxp://45[.]94[.]31[.]103:222/jj[.]jpg hxxp://45[.]94[.]31[.]103:222/ok[.]txt hxxp://185[.]196[.]8[.]144:777/bb[.]jpg |
AsyncRAT |
| URL | hxxp://176[.]123[.]4[.]187/armv4l hxxp://176[.]123[.]4[.]187/x86 hxxp://176[.]123[.]4[.]187/i686 |
Bashlite |
| URL | hxxp://hqt3[.]shop/DBL841/index[.]php | Azorult |
| URL | hxxps://101[.]99[.]75[.]164/cx hxxps://arcade[.]shinjiku[.]xyz/activity hxxps://116[.]114[.]20[.]190/push hxxp://156[.]232[.]186[.]194:2001/cm hxxp://124[.]220[.]6[.]158/__utm[.]gif hxxp://123[.]60[.]90[.]39:9999/ga[.]js hxxps://service-hjsbgio3-1324325235[.]cd[.]tencentapigw[.]com/prod/api/debug hxxp://123[.]60[.]90[.]39:8888/pixel hxxp://shellmanaggggger[.]com/cx hxxp://124[.]70[.]99[.]70/assets/css/font-awesome[.]css hxxp://119[.]45[.]21[.]247:9000/dot[.]gif hxxp://120[.]26[.]46[.]50:8873/dot[.]gif hxxp://103[.]97[.]58[.]61/updates[.]rss hxxp://192[.]252[.]182[.]98:808/pixel[.]gif hxxp://162[.]14[.]102[.]143/assets/lang/en-US/lang[.]js hxxps://120[.]26[.]46[.]50:8879/ptj hxxp://124[.]220[.]6[.]158/fwlink hxxps://42[.]192[.]131[.]115/ca hxxp://60[.]204[.]217[.]11:9998/updates[.]rss hxxp://147[.]78[.]47[.]184:8092/ptj hxxp://47[.]89[.]225[.]2/dpixel hxxp://116[.]114[.]20[.]190:8080/ga[.]js hxxps://112[.]124[.]5[.]135/pixel[.]gif hxxp://147[.]45[.]159[.]99:81/pixel[.]gif hxxp://147[.]45[.]159[.]99:84/pixel[.]gif hxxp://38[.]180[.]146[.]236/cx hxxp://147[.]45[.]159[.]99:82/ga[.]js hxxp://45[.]138[.]157[.]129/IE9CompatViewList[.]xml hxxps://122[.]51[.]85[.]143/dpixel hxxps://123[.]60[.]99[.]12/wp-admin hxxp://147[.]45[.]159[.]99:83/g[.]pixel hxxp://45[.]159[.]211[.]110/en_US/all[.]js hxxp://193[.]233[.]75[.]241:81/mod/v3[.]44/Z2U5LK0C |
Cobalt Strike |
| URL | hxxps://pasteio[.]com/raw/xFEtIZz8VXsh hxxps://pasteio[.]com/raw/xdEY5ZnBU7n0 |
Remcos |
| URL | hxxps://areekat-aldeera[.]com/images/3[.]exe hxxps://appz[.]dieera[.]com/images/3[.]exe hxxps://207[.]180[.]242[.]32/images/3[.]exe hxxps://www[.]areekat-aldeera[.]com/images/3[.]exe |
SmokeLoader |
| URL | hxxps://api[.]telegram[.]org/bot6467693944:AAH7MvmHjqJR_Wxwz0-k8o4JMbzQ53j5jsg/ | Agent Tesla |
| URL | hxxps://transfer[.]adttemp[.]com[.]br/get/wCwF8/kureyonshinchan[.]exe | PurpleFox |
| URL | hxxp://154[.]9[.]26[.]118/linux_arm5 | Kaiji |
| URL | hxxps://logic8[.]io/images/logo2[.]jpg hxxp://65[.]109[.]63[.]69/crypted[.]exe hxxps://www[.]justmake[.]tw/temp/Setup[.]exe |
Stealc |
| URL | hxxps://logic8[.]io/images/logo[.]jpg | Lumma Stealer |
| URL | hxxps://kostumn1[.]ilabserver[.]com/1[.]zip | DarkGate |
| URL | hxxps://pasteio[.]com/raw/xh82irIAMnyY | NjRAT |
