a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92SHA-256 hash

Reported by 1 independent source · first reported 6 Dec 2022 by Elastic Security Labs · last reported 6 Dec 2022

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“By observing the process hash of the stage 1 dropper above (a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92) via the process.hash function within Elastic Security, we can isolate the ransomware alert and analyze the blocked attempt at overwriting the MBR.”

Elastic Security LabsVendor6 Dec 2022
Operation Bleeding Bear

Indicators reported together

named in the same reports

process[.]pein 1 report
111.111.111[.]111in 1 report
dcbbae5a1c61dbbb…9384081c9b78in 1 report
34ca75a8c190f20b…5b61ac7ea907in 1 report
923eb77b3c9e11d6…eeb73d1accd6in 1 report
9ef7dbd3da51332a…a07d716d892din 1 report

Copy these 6 indicators · defanged

6 indicators, defanged, one per line

process[.]pe
111.111.111[.]111
dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907
923eb77b3c9e11d6c56052318c119c1a22d11ab71675e6b95d05eeb73d1accd6
9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d

Thanks — we review every report.

Report a wrong value