autoupdatewinsystem[.]topDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 6 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Fake Installers to Monero: A Multi-Tool Mining Operation“The loader first calls FetchRemoteConfig(), which reaches out to a hardcoded URL (hxxps://autoupdatewinsystem[.]top/MyMNRconfigs/0226.txt).”
Indicators reported together
named in the same reports- 460203070b5a9283…82cf1c157162in 1 report
- b8b7aecce2a4d00f…a97e7d6df291in 1 report
- 9977b9185472c7d4…1994d54c59fcin 1 report
- 9fa23382820b1e78…ab7b9c6b1f5cin 1 report
- 27db41f654b53e41…40a7d410b8d3in 1 report
- 7bb0e91558244bcc…79e27165f1d7in 1 report
- c6c4a9725653b585…f7e64e69f2e4in 1 report
- a3f84aa1d15fd335…833d217308bbin 1 report
- 82c03866670b7004…28c6598fdf86in 1 report
- 542d2267b40c160b…147dae293678in 1 report
- windirautoupdates[.]topin 1 report
- winautordr.itemdb[.]comin 1 report
- winautordr.ydns[.]euin 1 report
- winautordr.kozow[.]comin 1 report
- hxxps://github[.]com/lebnabar198/Hgh5gM99fe3dG/raw/refs/heads/main/MnrsInstllr_240126.exein 1 report
- f84b00fc75f183c5…c5b9a6739049in 1 report
- wndlogon.hopto[.]orgin 1 report
- wndlogon.itemdb[.]comin 1 report
- wndlogon.ydns[.]euin 1 report
- wndlogon.kozow[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.