delete[.]meDomain
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 3 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“The execution of SoftPerfect Netscan can be confirmed by both the SMB traffic as well as the creation of the file delete[.]me, which the tool does when testing a folder’s write-ability.”
-
Cat’s Got Your Files: Lynx Ransomware“During the scan, multiple remote hosts showed file creation events for delete[.]me, as seen in Sysmon Event ID 11.”
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“During the netscan execution on the domain controller, we observed the creation of a file called delete[.]me on the C$ share of the beachhead workstation, logged by Event ID 5145.”
Indicators reported together
named in the same reports- opmanager[.]proin 1 report
Copy this indicator · defanged
Thanks — we review every report.