hxxp://50.19.48[.]59:82/me2.batURL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Critical Vulnerabilities in PaperCut Print Management Software“…dows Defender and remove various cryptominer applications if they are installed, then downloads and executes the next stage (hxxp://50.19.48[.]59:82/me2.bat) which attempts to deploy a Monero crypto miner with the wallet ID of 43DTEF92be6XcPj5Z7U96g4oGeebUxkFq9wyHcNTe1otM2hUrfvdswG…”
Indicators reported together
named in the same reports- hxxp://upd488.windowservicecemter[.]com/download/setup.msiin 1 report
- upd488.windowservicecemter[.]comin 1 report
- f9947c5763542b31…42641983aabbin 1 report
- gmx[.]comin 1 report
- windowservicecemter[.]comin 1 report
- c0f8aeeb2d11c6e7…8738b6cc4125in 1 report
- anydeskupdate[.]comin 1 report
- anydeskupdates[.]comin 1 report
- netviewremote[.]comin 1 report
- updateservicecenter[.]comin 1 report
- windowcsupdates[.]comin 1 report
- windowservicecentar[.]comin 1 report
- windowservicecenter[.]comin 1 report
- winserverupdates[.]comin 1 report
- hxxp://50.19.48[.]59:82/me1.batin 1 report
- 50.19.48[.]59in 1 report
- hxxps://cdn.papercut[.]com/web/products/ng-mf/installers/ng/$_version_prefix/pcng-setup-$pkgver.$_build.shin 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2023-27351, CVE-2023-27350
Thanks — we review every report.