{ "Event": { "analysis": "1", "date": "2021-08-24", "extends_uuid": "", "info": "[Threat Intel] Emerging Ransomware Groups: AvosLocker, Hive, HelloKitty, LockBit 2.0", "protected": false, "publish_timestamp": "1780039619", "published": true, "threat_level_id": "2", "timestamp": "1772901946", "uuid": "2959ad1b-1d10-4406-b3e7-92343e5097d0", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0afe32", "local": false, "name": "misp-galaxy:producer=\"Palo Alto\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#682cad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": "" }, { "colour": "#9dc839", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#70b0b5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"", "relationship_type": "" }, { "colour": "#f28fb8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"OS Credential Dumping - T1003\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#d0b1fd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1471\"", "relationship_type": "" }, { "colour": "#9f5dac", "local": false, "name": "misp-galaxy:target-information=\"Romania\"", "relationship_type": "" }, { "colour": "#66e036", "local": false, "name": "misp-galaxy:target-information=\"Austria\"", "relationship_type": "" }, { "colour": "#4cea11", "local": false, "name": "misp-galaxy:target-information=\"Italy\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#e6caf2", "local": false, "name": "misp-galaxy:target-information=\"Switzerland\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#b990dd", "local": false, "name": "misp-galaxy:target-information=\"Australia\"", "relationship_type": "" }, { "colour": "#915448", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#2afb09", "local": false, "name": "misp-galaxy:target-information=\"Argentina\"", "relationship_type": "" }, { "colour": "#d52b43", "local": false, "name": "misp-galaxy:target-information=\"Mexico\"", "relationship_type": "" }, { "colour": "#4cebc3", "local": false, "name": "misp-galaxy:target-information=\"Lebanon\"", "relationship_type": "" }, { "colour": "#f439e5", "local": false, "name": "misp-galaxy:target-information=\"Spain\"", "relationship_type": "" }, { "colour": "#a7b0e0", "local": false, "name": "misp-galaxy:target-information=\"Belgium\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"AvosLocker\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"HelloKitty\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Hive\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"LockBit\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1736668333", "to_ids": false, "type": "link", "uuid": "1ead9b72-45e0-4a95-8dd5-b6ef93ce2f17", "value": "https://unit42.paloaltonetworks.com/emerging-ransomware-groups/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1736668333", "to_ids": false, "type": "text", "uuid": "b4ff1e9e-fc2c-4c9f-9b4e-6b4b284d06b9", "value": "A look at some of the emerging ransomware groups that are currently affecting organizations and are likely to become more prevalent in the future, according to security firm Palo Alto Networks and its Unit 42 security unit." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1736668333", "to_ids": false, "type": "text", "uuid": "148abf77-f224-45cb-a77e-662165f06fc5", "value": "Name: Emerging Ransomware Groups: AvosLocker, Hive, HelloKitty, LockBit 2.0\nAuthor: AlienVault\nAdversary: \nTags: [\"hive\", \"avoslocker\", \"abcd\", \"hellokitty\", \"lockbit\", \"revil\", \"darkside\"]\nTgtd countries: [\"Romania\", \"Austria\", \"Italy\", \"Germany\", \"Switzerland\", \"Brazil\", \"Australia\", \"Malaysia\", \"Argentina\", \"Mexico\", \"Lebanon\", \"Spain\", \"Belgium\", \"United States of America\"]\nMlwr families: [\"AvosLocker\", \"Hive\", \"LockBit\", \"HelloKitty\", \"ABCD\", \"REvil - S0496\"]\nAttack_ids: [\"T1090\", \"T1021\", \"T1115\", \"T1027\", \"T1110\", \"T1003\", \"T1490\", \"T1471\"]\nIndustries: [\"Healthcare\"]" }, { "category": "Network activity", "comment": "IOC-description:Registrar=Key-Systems GmbH ( https://nic.at/registrar/404 )", "deleted": false, "disable_correlation": false, "timestamp": "1740280992", "to_ids": true, "type": "domain", "uuid": "e5ab9eff-4b4b-47ae-a1a9-3986456b8e91", "value": "bigblog.at", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1740281013", "to_ids": true, "type": "domain", "uuid": "c5ab6183-beb1-46f2-b44c-f656b4d37bb7", "value": "decoding.at", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0 No sample in VT\r\nLast check:23/02/2025", "deleted": false, "disable_correlation": false, "timestamp": "1740280969", "to_ids": true, "type": "sha256", "uuid": "6c74fea1-94e3-415d-b7bc-d9e4850aeb46", "value": "aa727a827c9e978520f5703e9100b52551b97cfc1e15e683cf27ce5212035548", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0 No sample in VT\r\nLast check:23/02/2025", "deleted": false, "disable_correlation": false, "timestamp": "1740280970", "to_ids": true, "type": "sha256", "uuid": "1fd28e52-5f08-45a0-98df-08b28e0685be", "value": "a718c499a7a3c505828f5253862c9b2f3c40e2d80132de96e5cc19e3c161730b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0 No sample in VT\r\nLast check:23/02/2025", "deleted": false, "disable_correlation": false, "timestamp": "1740280971", "to_ids": true, "type": "sha256", "uuid": "395394b1-a158-4a71-b2b7-89007bc6d91a", "value": "b735c0169ecdddba6676c6c490199358f6ab7cc9724391fee2482676a3efc6e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1740281034", "to_ids": true, "type": "domain", "uuid": "c416e515-954d-41eb-aabd-1020d5324a8a", "value": "lockbit-decryptor.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1740281056", "to_ids": true, "type": "domain", "uuid": "4c9f37e2-3b1b-4e35-8437-3923b2ccd8ce", "value": "lockbit-decryptor.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1746475438", "to_ids": false, "type": "mutex", "uuid": "710abaa2-5337-45c4-aa8b-adbad20b5ee1", "value": "HelloKittyMutex" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "565374da-b90a-4ef0-95fe-89946712eaa8", "Attribute": [ { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "23cef323-58f2-4764-99cd-fef99559cbf7", "value": "d285f1366d0d4fdae0b558db690497ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "6f649a0c-53ad-4673-ba72-fdaac6643fec", "value": "f6f94e2f49cd64a9590963ef3852e135e2b8deba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "adcac0ef-6c5f-4d33-9fd6-9719bae2d255", "value": "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278545", "to_ids": true, "type": "ssdeep", "uuid": "8422ae19-a149-4ddb-bf67-dda9d76b791e", "value": "12288:L5rxhWsTDzB6BybYxl+xX4VpMDEvqXHRAS0uayw4HxsNI4j:L5rxhW6PB6BybYxlWX/DEv4eow" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278545", "to_ids": false, "type": "size-in-bytes", "uuid": "633a999a-9776-4b94-a5d2-1d5c36644d44", "value": "412160" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278545", "to_ids": true, "type": "vhash", "uuid": "718cf8f1-add9-4273-a97e-c080cbb4448c", "value": "045056655d15556093z52z57nz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278545", "to_ids": true, "type": "filename", "uuid": "0f7cd75d-b775-46c7-83e1-7fe1eca7298e", "value": "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 21/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278545", "to_ids": false, "type": "text", "uuid": "3c85399d-679b-46a8-83eb-68e699943274", "value": "AvosLocker\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Avaddon\nVT Total Detection:63/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "e902c032-77bd-4921-b390-13c20b592ce1", "Attribute": [ { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "4949b8b9-62f1-4a6f-8c1a-ffac8d921a2e", "value": "76e177a94834b3f7c63257bc8011f60f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "33a07b9b-6f52-40bc-83e6-df287610ae37", "value": "e2bdef45d8dd4b1811396781b0bc94092d268a88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "2d51b555-e406-4ff5-8fc5-cf25a1779bd7", "value": "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278566", "to_ids": true, "type": "ssdeep", "uuid": "b08a7179-a16c-48f6-853f-870f080c55c8", "value": "12288:L5rxhWsTDzB6BybYxl+xX4VpMDEvqXHRAS0uayw4Hg5sNI4j:L5rxhW6PB6BybYxlWX/DEv4eP5w" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278566", "to_ids": false, "type": "size-in-bytes", "uuid": "bad4a31b-7d84-4f03-9fa5-bf36d0bc68ba", "value": "412160" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278566", "to_ids": true, "type": "vhash", "uuid": "35cd9cbe-f66a-4679-8237-9dc56691afcc", "value": "045056655d15556093z52z57nz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278566", "to_ids": true, "type": "filename", "uuid": "8868803d-a182-4612-87c7-bf614880dcce", "value": "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 22/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278566", "to_ids": false, "type": "text", "uuid": "e5ab6e4f-0262-417a-826c-d7be48979453", "value": "AvosLocker\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/AvosLocker.MBK!MTB\nVT Total Detection:65/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1740281119", "uuid": "2393e0ba-0fa0-4d7d-b3be-8c17b40460b4", "Attribute": [ { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1740281119", "to_ids": true, "type": "md5", "uuid": "0e30a420-e47b-4aaa-91c4-5f8e336e20de", "value": "fe977e2028bbb774952df319042e3cab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280829", "to_ids": true, "type": "sha1", "uuid": "9ce6551b-013e-4333-a9f8-4f217b1f13f2", "value": "3305d4e56ee97ff5de6403e0b845ea3929ec2072", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280829", "to_ids": true, "type": "sha256", "uuid": "6aa4db73-dd42-45aa-8714-a414a9e21f0e", "value": "3984968230c96d52d78af1905ea1b224e7de36776a6af398a0462321f3c22020", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278589", "to_ids": true, "type": "ssdeep", "uuid": "eee0f12b-0edb-41af-befa-92764ec5d761", "value": "12288:eg8FZrzxZrGmzyfZ28ZnbDUUHhRDjOs3rdvMKxZZikERDKrmu+mgSFlm0c0xv060:eg8FZrzxZrDefZ28ZnbDrHTOs3lM6ikq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278589", "to_ids": false, "type": "size-in-bytes", "uuid": "642b0930-fcbb-437c-82ee-a66cc1074187", "value": "707584" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278589", "to_ids": true, "type": "vhash", "uuid": "04910528-1986-4f82-ab20-9d9a7712fdd1", "value": "075056655d15556063z42z7cnz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278589", "to_ids": true, "type": "filename", "uuid": "5e293391-ba30-466d-998d-5e0f0d590c03", "value": "potter.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 27/12/2023", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278589", "to_ids": false, "type": "text", "uuid": "9d50f4fe-aef1-4b67-9a8c-7a87db9503d1", "value": "AvosLocker\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/AvosLocker.MK!MTB\nVT Total Detection:57/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1740281140", "uuid": "a7be4bb2-c78c-4a13-992e-51629ad399a9", "Attribute": [ { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1740281140", "to_ids": true, "type": "md5", "uuid": "5ed1584e-5a83-475a-b35a-385084f33475", "value": "de6152b2b3a181509c5d71a332a75043", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280830", "to_ids": true, "type": "sha1", "uuid": "8051df0a-1c76-42d6-abb0-8103e1d6a258", "value": "d62c0ad2ec132065c5807c0fe7a4cabcba34cf29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "AvosLocker", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280830", "to_ids": true, "type": "sha256", "uuid": "18a73c05-376b-4887-8746-3c79980c6fe0", "value": "01792043e07a0db52664c5878b253531b293754dc6fd6a8426899c1a66ddd61f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278610", "to_ids": true, "type": "ssdeep", "uuid": "f473d527-7f12-498a-ae6d-5984650e91b9", "value": "12288:L5rxhWsTDzB6BybYxl+xX4VpMDEvqXHRAS0uayw4H5qsNI4j:L5rxhW6PB6BybYxlWX/DEv4eZw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278610", "to_ids": false, "type": "size-in-bytes", "uuid": "d0549cdb-a009-456e-bf2b-58c76b2d26ff", "value": "412160" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278610", "to_ids": true, "type": "vhash", "uuid": "c21c7e7d-d8ae-4712-bcf7-af2a6c6ad845", "value": "045056655d15556093z52z57nz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278610", "to_ids": true, "type": "filename", "uuid": "13e56ea6-af7b-4173-8549-4ff684ebd82c", "value": "Avos_18_07_2021_403KB.bin" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 16/08/2023", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278610", "to_ids": false, "type": "text", "uuid": "9a265a28-6058-48cf-91bd-94983da31254", "value": "AvosLocker\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Avaddon.P!MSR\nVT Total Detection:58/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1740281161", "uuid": "a501d35d-ab16-4bcd-b0f5-974d39a6d39f", "Attribute": [ { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1740281161", "to_ids": true, "type": "md5", "uuid": "9e604574-f2c4-40a3-8d66-c54ce2bbd068", "value": "504bd1695de326bc533fde29b8a69319", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280831", "to_ids": true, "type": "sha1", "uuid": "d93b75fc-f17a-4b2e-8675-fca6ade02e89", "value": "67f0c8d81aefcfc5943b31d695972194ac15e9f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280831", "to_ids": true, "type": "sha256", "uuid": "6d882c1c-b626-4c0e-be50-480243d05f43", "value": "a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278631", "to_ids": true, "type": "ssdeep", "uuid": "7ff470d5-a1bb-4a64-af05-414e0ed51851", "value": "24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278631", "to_ids": false, "type": "size-in-bytes", "uuid": "133e77fe-c54d-46fd-aed5-2021933909d5", "value": "827392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278631", "to_ids": true, "type": "vhash", "uuid": "eab06bf3-c8f0-4866-819d-36e0c1d7ac66", "value": "08503e0f7d1bz4!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278631", "to_ids": true, "type": "filename", "uuid": "524b085f-7608-4333-b07f-ac8323a6a9a7", "value": "567603___43aec934-ec9e-4c35-afd8-2df38294298c.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278631", "to_ids": false, "type": "text", "uuid": "de774de9-52ff-468c-a9c2-cd45d95d1b0d", "value": "Hive Ransomware\r\nType Description: Win32 EXE\n\nMicrosoft: Trojan:MSIL/Cryptor\nVT Total Detection:58/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1740281183", "uuid": "f486ebb7-3687-4378-9ce9-7fe527b56bd8", "Attribute": [ { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1740281183", "to_ids": true, "type": "md5", "uuid": "083a1f91-4e46-4202-939c-e44f1d02df1d", "value": "eb45ff7ea2ccdcceb2e7e14f9cc01397", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280832", "to_ids": true, "type": "sha1", "uuid": "372dec32-7055-4405-adf1-425181ddf923", "value": "2f3273e5b6739b844fe33f7310476afb971956dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280833", "to_ids": true, "type": "sha256", "uuid": "97a03089-2c24-40d8-8ee1-140cfdf57472", "value": "1e21c8e27a97de1796ca47a9613477cf7aec335a783469c5ca3a09d4f07db0ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278653", "to_ids": true, "type": "ssdeep", "uuid": "ecbfc030-0b82-4f03-8aee-51a5f5b86ae0", "value": "12288:4pHprtjDMyIVSeTY4ID0v7fBOjCee/O2e6J8/h2Gbx+E7DLIFMZlgPxKpdAMX5Yf:4pJrtU7GnwTBBdO66sGb04fIFMTgPxKI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278653", "to_ids": false, "type": "size-in-bytes", "uuid": "4faa1b22-35b5-4b5a-b8ef-dcbb86b4b885", "value": "781824" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278653", "to_ids": true, "type": "vhash", "uuid": "bbea8f50-d7f2-482b-8f5b-dde5c32dc2bf", "value": "07503e0f7d1bz4!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278653", "to_ids": true, "type": "filename", "uuid": "e6306c85-04c9-4278-9572-2cfefde9bc0a", "value": "241600___69dfa1ed-be75-46f7-b7a3-8fd31b79939b.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278653", "to_ids": false, "type": "text", "uuid": "d8c016fa-5ed3-46ed-9c84-9f23f5ae44af", "value": "Hive Ransomware\r\nType Description: Win32 EXE\n\nMicrosoft: Trojan:MSIL/Cryptor\nVT Total Detection:61/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1740281204", "uuid": "0c4e2185-378d-4dbb-b3b6-22662ee6ce76", "Attribute": [ { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1740281204", "to_ids": true, "type": "md5", "uuid": "1791f65e-d1d3-42d6-a965-ae044c222a30", "value": "8240d60d83cb7c0248e64389855e29b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280834", "to_ids": true, "type": "sha1", "uuid": "37d1c248-9806-4d93-9d73-3ce65640bb38", "value": "3b40dbdc418d2d5de5f552a054a32bfbac18c5cc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280834", "to_ids": true, "type": "sha256", "uuid": "42743795-9362-4166-b55d-cc5266b93b57", "value": "fdbc66ebe7af710e15946e1541e2e81ddfd62aa3b35339288a9a244fb56a74cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278675", "to_ids": true, "type": "ssdeep", "uuid": "434fa4a5-6f62-4304-8bbb-6901e47b3f61", "value": "12288:as8e1VGfx8Bk489rTOIe6qXlpgq0ojQZzPRIXFkdpFdbEu0e3RZrsANSS5zf9s7I:asD1UU89PMjF0oMlPKqZdA8RZrs8jx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278675", "to_ids": false, "type": "size-in-bytes", "uuid": "b2215fce-e3f9-4e92-9989-a97a55ac91c9", "value": "827392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278675", "to_ids": true, "type": "vhash", "uuid": "b3f960ed-3f41-41b0-b110-1423f49bb40e", "value": "08503e0f7d1bz4!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278675", "to_ids": true, "type": "filename", "uuid": "a3471116-145b-439f-83a3-4e059422c251", "value": "791251___8d599464-8998-4315-b52d-47e77e0a5920.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 24/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278675", "to_ids": false, "type": "text", "uuid": "607669dd-ac34-48b7-bc6c-bc98c89f0adf", "value": "Hive Ransomware\r\nType Description: Win32 EXE\n\nMicrosoft: Trojan:MSIL/Cryptor\nVT Total Detection:59/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "fe617262-392a-4d53-9152-036d9c102ecc", "Attribute": [ { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "ea3e6b93-d0d5-40fd-ad41-063b5013f256", "value": "2f9fc82898d718f2abe99c4a6fa79e69", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "4583597d-e7b5-43eb-942f-cb9e88bff2dc", "value": "9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hive Ransomware", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "81fd2ec0-aba4-464e-a5ed-410ce2b0a728", "value": "88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278696", "to_ids": true, "type": "ssdeep", "uuid": "771baa9e-b7c8-460f-990e-72ad63ebed4c", "value": "12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278696", "to_ids": false, "type": "size-in-bytes", "uuid": "74f9c13d-4734-4cc1-8ca7-0d7f9a7cf7c2", "value": "782394" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278696", "to_ids": true, "type": "vhash", "uuid": "9fde856f-c047-44a5-a69e-69591f74f0ed", "value": "07503e0f7d1bz4!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278696", "to_ids": true, "type": "filename", "uuid": "301925f7-88a2-4127-864a-e190aa9a44f0", "value": "hive.bin_exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 22/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278696", "to_ids": false, "type": "text", "uuid": "b6b90d0d-9f0d-4c60-88fe-9eca072745e2", "value": "Hive Ransomware\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:MacOS/FileCoder\nVT Total Detection:65/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "623a16c8-cb01-4692-be5e-60f8ebc0acc5", "Attribute": [ { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "a319fddd-75e0-4dd0-93cf-f244a4f9b13d", "value": "09c93a2562b5157264a5396048fd8bb5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "7b14829a-0109-4bf4-9017-4e18cb0616c6", "value": "adaf7f8c53d13d37c1af7c7524aa5275045ae157", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "e920e18a-9741-4023-b586-fb7a2af4b609", "value": "16a0054a277d8c26beb97850ac3e86dd0736ae6661db912b8782b4eb08cfd36e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278717", "to_ids": true, "type": "ssdeep", "uuid": "48f7e96b-134e-415c-96e9-99651ba921a5", "value": "384:1Rb8y5yvh0veFPhNaXdJglk5paYW//L5AzFJV1wTvKlzj5ZMywZneg334RQvqXGP:1RgyIhl7K/h/Wq5dgSJpXJ9xFnggkDP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278717", "to_ids": false, "type": "size-in-bytes", "uuid": "4b98ba4e-920d-4171-b297-2a101407a51f", "value": "48824" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278717", "to_ids": true, "type": "vhash", "uuid": "9f32b634-44a4-42c8-b435-57634e502a13", "value": "f189686b0ff64496a8eec86e678fc336" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278717", "to_ids": true, "type": "filename", "uuid": "2dd45a1c-ebaa-423c-9add-54b5fb0a588f", "value": "16a0054a277d8c26beb97850ac3e86dd0736ae6661db912b8782b4eb08cfd36e.elf" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 15/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278717", "to_ids": false, "type": "text", "uuid": "14dc6887-4a5b-4534-be24-171c93d060c7", "value": "Hello Kitty (Linux)\r\nType Description: ELF\n\nMicrosoft: Ransom:Linux/HelloKitty.T!MTB\nVT Total Detection:43/64" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "942d0d3a-0577-4e81-aa46-6bf0f4721489", "Attribute": [ { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "6e512c3c-5119-4c4f-be58-66bd5d327a1b", "value": "f597d74b84929ded948fc42c6f6210e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "a1e7e9bc-90b1-4d8e-87a5-b4aa2b3d34ff", "value": "ce84c75b28f7cde633db0076309c45683029efdf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "b57913b2-bb7a-45ce-bb24-62c5144e2bfa", "value": "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278739", "to_ids": true, "type": "ssdeep", "uuid": "2f398e4c-f785-4396-86b3-3eeafda6e53b", "value": "768:MxHWw88+bmkfRk9gqzCM0CiRgQTcF7onjj7ef/6+e2YahXG+cwuX+9KPlL0+HjMv:MNWJbffRzqzJi3e1Nx+o5V4+nFSDs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278739", "to_ids": false, "type": "size-in-bytes", "uuid": "9913656c-db46-49bb-ba1b-12fbd89c8701", "value": "82384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278739", "to_ids": true, "type": "vhash", "uuid": "84dcf2ef-7814-4cd3-8b34-a1aac18069e3", "value": "0e286fc09fa4eabdd2e462563b41114c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278739", "to_ids": true, "type": "filename", "uuid": "9b391fee-d14f-4d5a-9ee0-dc7e1dec0be6", "value": "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed.elf" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 22/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278739", "to_ids": false, "type": "text", "uuid": "766ffac2-c694-4096-bd5b-732abd470797", "value": "Hello Kitty (Linux)\r\nType Description: ELF\n\nMicrosoft: Ransom:Linux/HelloKitty.A\nVT Total Detection:43/68" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747384989", "uuid": "3458926f-b60a-46f5-8c52-9d10b0675554", "Attribute": [ { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747384989", "to_ids": true, "type": "md5", "uuid": "f49fd195-3995-4137-8268-7c3d8f40399d", "value": "d350067595898151bb776db397871c13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280840", "to_ids": true, "type": "sha1", "uuid": "d2f20739-8381-4261-91d7-e53e35699abf", "value": "2e926f26e85a59a8f67067b193f24cff4fbc864c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280841", "to_ids": true, "type": "sha256", "uuid": "ee07b593-93ab-49c3-b3d4-8add287054fa", "value": "9f82f22c137688d0b3e7912d415605d2bbc56478311fd0b3dc265f8d0006aa8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278760", "to_ids": true, "type": "ssdeep", "uuid": "fcde2763-ebe1-4245-8a26-1c78dc9e330a", "value": "768:E7oXl88FAobVHdZ6TlPqz6MrX2WZdhYcF7onjj7ef/6+e2YahXp+cwuX+9KPlL0+:E7oXldZ6Zqzf2ifee1ex+o5V4OnFCP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278760", "to_ids": false, "type": "size-in-bytes", "uuid": "237451c7-498a-4ac5-bef5-dcb4d0f4ef2b", "value": "82384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278760", "to_ids": true, "type": "vhash", "uuid": "4524423c-9ea1-4b46-854f-2f9bd847a238", "value": "0e286fc09fa4eabdd2e462563b41114c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278760", "to_ids": true, "type": "filename", "uuid": "404a6b03-005f-45a5-bdb4-dad5d5fd67fb", "value": "funny_linux.elf" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278760", "to_ids": false, "type": "text", "uuid": "19bdeb51-e15f-4166-b649-f7328d24d30a", "value": "Hello Kitty (Linux)\r\nType Description: ELF\n\nMicrosoft: Ransom:Linux/HelloKitty.A\nVT Total Detection:35/64" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "ef0d920c-46b9-4259-ab9c-e834bcf369a0", "Attribute": [ { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "cf724d3c-d967-423e-a6d6-61e4a079c04d", "value": "1cd2d73098671253243a8457355b8820", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "75ab19ba-0a41-4809-a57c-1aad8513360b", "value": "05a47a227984eed8d387a4c2b749e3297fd694f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "cc45cfc9-5e52-42bb-b4c7-0e2aa615f68c", "value": "8f3db63f70fad912a3d5994e80ad9a6d1db6c38d119b38bc04890dfba4c4a2b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278782", "to_ids": true, "type": "ssdeep", "uuid": "b91547d9-e6a1-4f37-aba3-83d8e4eacabc", "value": "1536:SVSyjCyggaZsZVZOZ7ZdZ9ZeLZ+ZHNKcMH0aAmZ/qni0t+GWIB9q0D:SVSVyggauZVZOZ7ZdZ9ZeLZ+ZHNKcMH8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278782", "to_ids": false, "type": "size-in-bytes", "uuid": "b7a025a1-9766-4710-9861-11b27b08c66c", "value": "57536" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278782", "to_ids": true, "type": "vhash", "uuid": "ba616d80-f421-4927-a796-13d836a3c852", "value": "5b2f07c7064e199d93c32aac5cdec3e9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278782", "to_ids": true, "type": "filename", "uuid": "3ddb4e34-3a06-4e11-be63-e7c4cbd26ddc", "value": "8f3db63f70fad912a3d5994e80ad9a6d1db6c38d119b38bc04890dfba4c4a2b2.elf" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278782", "to_ids": false, "type": "text", "uuid": "67432725-bdcd-4943-972f-590d7bd24842", "value": "Hello Kitty (Linux)\r\nType Description: ELF\n\nMicrosoft: Ransom:Linux/HelloKitty.A\nVT Total Detection:41/64" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385032", "uuid": "a261cef3-e542-4093-86d1-29859e20d94d", "Attribute": [ { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385032", "to_ids": true, "type": "md5", "uuid": "40f0f969-a511-45e5-8d8c-f20b1c01c575", "value": "88b05c83ce07d0ea716c238598ed083c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280844", "to_ids": true, "type": "sha1", "uuid": "968cf851-4acf-4e33-80b5-15592f271765", "value": "c8987c6756b606a8e2c32d2840958a8005397023", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280844", "to_ids": true, "type": "sha256", "uuid": "ebcd980b-0dc2-4cad-be2f-9aec9602dbc0", "value": "bedf30bbcefc54bc48432674255856f47c0ba2ec46e913d078a53e66ac9dcff8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278803", "to_ids": true, "type": "ssdeep", "uuid": "681ef262-d847-4fb8-a923-0fe3c61b30f7", "value": "768:ys7SyGyaKxEzhgN0l+I3E/wFiBP8MHbib8nN/TiD:ys7SypauehgvEEoiB0M7iIRW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278803", "to_ids": false, "type": "size-in-bytes", "uuid": "624d5097-086d-47b3-8a90-5327a44c8e10", "value": "31120" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278803", "to_ids": true, "type": "vhash", "uuid": "1cc760f6-2408-4bc2-a6f3-26e0538a0f53", "value": "0d831a4879ca77855265074952b88e34" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278803", "to_ids": true, "type": "filename", "uuid": "becb24c4-69ab-4ebd-bfd8-2ac12278fe9a", "value": "funny_linux.elf" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278803", "to_ids": false, "type": "text", "uuid": "e73b7a0e-8920-4687-9ef5-fab6a9923dad", "value": "Hello Kitty (Linux)\r\nType Description: ELF\n\nMicrosoft: Ransom:Linux/ViceSociety.D!MTB\nVT Total Detection:39/63" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "f9086a94-fa07-4b05-b47b-475b06ea448e", "Attribute": [ { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "f2ad2d19-5a67-4823-8684-6d26530b5706", "value": "5716a136538ec546ef591d5aa143c153", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "d306cf5b-63aa-49ff-a7de-28cef47a2c33", "value": "0b3c3402edbed6a7a8530607c4eafcee85184ffe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "de141fac-9b7e-40e3-855e-4afffe8cc4eb", "value": "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278824", "to_ids": true, "type": "ssdeep", "uuid": "04664692-2662-477a-b437-7b292f2e0134", "value": "1536:WcWwC7i3Toh2R/6e1vx+M5V4ynFWlLh0:WcjG21p1vxzaeWlh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278824", "to_ids": false, "type": "size-in-bytes", "uuid": "2021e59f-52df-4b13-89ac-621c2265cd90", "value": "86480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278824", "to_ids": true, "type": "vhash", "uuid": "f0897cff-2d4b-41c6-8796-6825d66ee526", "value": "0e286fc09fa4eabdd2e462563b41114c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278824", "to_ids": true, "type": "filename", "uuid": "7f976f2d-47a6-45f8-9b70-61c9fa0447c9", "value": "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041.elf" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278824", "to_ids": false, "type": "text", "uuid": "6ba4d8d2-6430-428f-b5e0-830c413b787b", "value": "Hello Kitty (Linux)\r\nType Description: ELF\n\nMicrosoft: Ransom:Linux/HelloKitty.A\nVT Total Detection:41/64" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "d6698a4d-8d2f-4c2b-bbeb-0fd0f4ac5244", "Attribute": [ { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "3e8be215-5996-48ab-a152-275b8c705734", "value": "9506d2c662e85730d459ee605c316b7e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "abb8bcbf-0a3a-41b2-9499-871eb76e7671", "value": "863d17ddb302f943a52b087f7c0f9fbf656516f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Hello Kitty (Linux)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "1c13a332-39a7-4f89-8c62-986f3a0bc479", "value": "b4f90cff1e3900a3906c3b74f307498760462d719c31d008fc01937f5400fb85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278846", "to_ids": true, "type": "ssdeep", "uuid": "278b771f-312d-4245-9a32-6919ad4a82d5", "value": "1536:6wWwpVfQcYzCpJe1vx+r5V43nFm/bBS77R:6wzlG1vx4a1m/UPR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278846", "to_ids": false, "type": "size-in-bytes", "uuid": "f35b7c91-2f73-4928-9f87-129991c8dc2c", "value": "86480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278846", "to_ids": true, "type": "vhash", "uuid": "7e03e0b8-8227-478c-a9bd-4db6b0750582", "value": "0e286fc09fa4eabdd2e462563b41114c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278846", "to_ids": true, "type": "filename", "uuid": "a3819677-0c1c-4f2e-a431-589cac343cde", "value": "b4f90cff1e3900a3906c3b74f307498760462d719c31d008fc01937f5400fb85.elf" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278846", "to_ids": false, "type": "text", "uuid": "b3dcda14-b0c9-438c-a1f7-0adffd6ac8b1", "value": "Hello Kitty (Linux)\r\nType Description: ELF\n\nMicrosoft: Ransom:Linux/HelloKitty.A\nVT Total Detection:41/64" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385096", "uuid": "f33c81ab-4d87-4a7e-ace1-2be7a4916c1c", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385096", "to_ids": true, "type": "md5", "uuid": "246772df-a5d7-4db5-9053-aa28b8de1e00", "value": "4d25a9242eac26b2240336fb94d62b1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280848", "to_ids": true, "type": "sha1", "uuid": "549bffc2-6392-4df4-ae13-2278c7695299", "value": "c7b2d4a22f788b1b942f993fff33f233dca960ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280848", "to_ids": true, "type": "sha256", "uuid": "a811c95b-c315-4764-a645-588ea2aa6f26", "value": "f32e9fb8b1ea73f0a71f3edaebb7f2b242e72d2a4826d6b2744ad3d830671202", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278867", "to_ids": true, "type": "ssdeep", "uuid": "2aa679f3-235d-4ac3-a325-bc43146e0e27", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QeF:dAfSrWW4g+7Ht+UmxJeN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278867", "to_ids": false, "type": "size-in-bytes", "uuid": "66c5a776-9474-49ca-b4c6-e9b06d806d01", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278867", "to_ids": true, "type": "vhash", "uuid": "bf537011-1e65-4c37-af67-946171faad49", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278867", "to_ids": true, "type": "filename", "uuid": "3fbc44ce-b36a-4ecc-b1df-dc1eb3d49785", "value": "658783___049d84cc-dd0f-4d4e-a35c-5f9cbada11ff.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 21/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278867", "to_ids": false, "type": "text", "uuid": "05b44321-1127-4c35-abae-7c40d207916d", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:65/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385117", "uuid": "e6d73972-22ed-4e0c-b910-a3499c883938", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385117", "to_ids": true, "type": "md5", "uuid": "99a2989b-cb39-4194-8168-ecd148bf7c86", "value": "b7f1120bcff47ab77e74e387805feabe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280850", "to_ids": true, "type": "sha1", "uuid": "ad52d338-9134-48f9-923c-9a03739e1846", "value": "a185904a46b0cb87d38057fc591a31e6063cdd95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280850", "to_ids": true, "type": "sha256", "uuid": "417f0921-a833-4f91-a9bc-c73435e83f35", "value": "4de287e0b05e138ab942d71d1d4d2ad5fb7d46a336a446f619091bdace4f2d0a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278889", "to_ids": true, "type": "ssdeep", "uuid": "c8cfd335-46bb-4f26-a725-cdb059354c20", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QyF:dAfSrWW4g+7Ht+UmxJe5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278889", "to_ids": false, "type": "size-in-bytes", "uuid": "dc3574b2-bd11-4989-a03b-24dc4d1439d8", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278889", "to_ids": true, "type": "vhash", "uuid": "c6065299-b9eb-4c65-9a5f-a10ece047498", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278889", "to_ids": true, "type": "filename", "uuid": "9b46b03f-2859-4700-a14d-c605b312815c", "value": "300820___be3dadf7-7787-4729-8b35-62875dc17320.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278889", "to_ids": false, "type": "text", "uuid": "0f1494f6-ec1e-4ff6-be7d-8d1003cece54", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:66/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "598b47eb-3307-4f98-8913-8954ae8e7277", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "e84a0d63-99cf-4b4e-bc4b-c68d7323b3b6", "value": "af9ff037caca1f316e7d05db86dbd882", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "ab6027fb-87ff-4fa7-9628-9d30f98e7f40", "value": "844e9b219aaecb26de4994a259f822500fb75ae1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "44f4a162-9711-4ba1-a8d8-d77c6e606586", "value": "f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278911", "to_ids": true, "type": "ssdeep", "uuid": "3a078310-094f-4932-8531-ab09ea73499e", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q1F:dAfSrWW4g+7Ht+UmxJeW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278911", "to_ids": false, "type": "size-in-bytes", "uuid": "9aed6d80-21fd-440a-8bcd-6c707589a11a", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278911", "to_ids": true, "type": "vhash", "uuid": "45c17563-26b6-43fc-84d7-a2a30b5d52a2", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278911", "to_ids": true, "type": "filename", "uuid": "a83b383c-8b87-4915-a9e7-b47ae2ea2893", "value": "328787___0dd10c46-e5c7-4028-96cd-6c922d65c5db.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278911", "to_ids": false, "type": "text", "uuid": "7fe50846-0010-4e72-bd04-2f28a8363cdf", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:66/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385159", "uuid": "e885ee5b-7f70-41eb-beed-2f7cd7d70940", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385159", "to_ids": true, "type": "md5", "uuid": "53e0547a-bd7c-4fe2-9456-25ff285a3eec", "value": "d5436df39096935f655022a5ea85066e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280853", "to_ids": true, "type": "sha1", "uuid": "9910861b-72a9-4be8-a342-f8bd421d105b", "value": "07d28a02c99b65db91e69b3f45c12cff7fe72b4d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280853", "to_ids": true, "type": "sha256", "uuid": "7a0c1126-e6bf-4d1e-b0b9-1b797442a9cd", "value": "ea028ec3efaab9a3ce49379fef714bef0b120661dcbb55fcfab5c4f720598477", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278932", "to_ids": true, "type": "ssdeep", "uuid": "3d13a888-4bd0-427d-8e19-cf90d46b683f", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QqF:dAfSrWW4g+7Ht+UmxJe9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278932", "to_ids": false, "type": "size-in-bytes", "uuid": "f38ffea6-4de7-48d7-9986-9877d45141f4", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278932", "to_ids": true, "type": "vhash", "uuid": "2a94d571-2259-47ab-bff6-6679d5e4bcdb", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278932", "to_ids": true, "type": "filename", "uuid": "834b43db-b1b6-41dc-a3a1-21c2d4d280e8", "value": "LockBIT_CC2ADC4990B65CF2.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 29/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278932", "to_ids": false, "type": "text", "uuid": "5c1d38d2-236f-4476-91cf-09bf03ea781b", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.SA\nVT Total Detection:63/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385180", "uuid": "6074e2f0-33d5-4c5f-aaee-455dd2d80a35", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385180", "to_ids": true, "type": "md5", "uuid": "57619cba-f380-42ee-9df3-26e2a1642c40", "value": "0d3058695e559b95910911c4b391d482", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280855", "to_ids": true, "type": "sha1", "uuid": "78be5bbc-0bfc-4b4b-bf23-70dd55694b76", "value": "fb4695af393c4504e800c05bafe114dd4cf36bf2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280855", "to_ids": true, "type": "sha256", "uuid": "18fac765-734a-411f-8fd9-e64485e018b3", "value": "bcdb59232137e570d4afb3c635f8df19ceb03e3f57fe558f4fc69a0be778c6ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278954", "to_ids": true, "type": "ssdeep", "uuid": "22dcf645-641d-4b87-9f1a-d26b1e3e782a", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QRF:dAfSrWW4g+7Ht+UmxJeq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278954", "to_ids": false, "type": "size-in-bytes", "uuid": "35ca927d-d18c-4106-9620-1ca36941347d", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278954", "to_ids": true, "type": "vhash", "uuid": "c494f0f2-c0c1-494a-8878-6568c8098748", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278954", "to_ids": true, "type": "filename", "uuid": "9d2f57b2-00c1-4c85-89cb-e9f6629a05dd", "value": "bcdb59232137e570d4afb3c635f8df19ceb03e3f57fe558f4fc69a0be778c6ab.bin" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 15/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278954", "to_ids": false, "type": "text", "uuid": "3a1a5817-17d1-443e-b08f-d2e05351d3a5", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.SA\nVT Total Detection:65/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747501918", "uuid": "0870c260-a4af-4e32-8d5e-cc7eacfdc4f4", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747501918", "to_ids": true, "type": "md5", "uuid": "8586997b-4b53-4e1e-8612-597e395923b6", "value": "da4ffeaafcd56ed1fb95d1da3645f6c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280856", "to_ids": true, "type": "sha1", "uuid": "be2d9ec6-d8c2-479b-a5a6-d1958575d6b1", "value": "211796fd745b8af9ac81a45c35e50e7c43f4da4d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280856", "to_ids": true, "type": "sha256", "uuid": "5bff9a36-f033-4847-8db8-5a67b5225b6a", "value": "4efcd774d9d224137c5840e9a2d0f9e56c976e8e7a49158e3c15135dd9fbae9c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278975", "to_ids": true, "type": "ssdeep", "uuid": "c58cc2e9-d519-478f-950e-a6abe5aaa047", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QdF:dAfSrWW4g+7Ht+UmxJey" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278975", "to_ids": false, "type": "size-in-bytes", "uuid": "5525fe9d-a9b5-4d59-83bf-8378a35d95d9", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278975", "to_ids": true, "type": "vhash", "uuid": "a0d43861-00ba-47e0-8ed9-38258e67ed7c", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278975", "to_ids": true, "type": "filename", "uuid": "ebb9ece2-b9cc-4fa3-861d-b14b09619ca8", "value": "LockBIT_7838362339462440.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 22/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278975", "to_ids": false, "type": "text", "uuid": "bc29bb53-123d-4a58-8aeb-d0e92e9d6bd1", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.SA\nVT Total Detection:68/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "2f827af4-7ddf-48e9-8663-8a16889cc8cd", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "a868bb8c-c7d8-4552-ae48-9619f3939d3e", "value": "96de05212b30ec85d4cf03386c1b84af", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "15a151b6-a351-4988-be7e-7b200470732d", "value": "dbe5243c6ea5cc4cfb3edf042bd94a59cf9a0e64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "f4aef136-fade-4d15-9607-d1fb46048600", "value": "00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740278996", "to_ids": true, "type": "ssdeep", "uuid": "f765ad56-bdf1-4c65-a350-05ae1040fd7c", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q9F:dAfSrWW4g+7Ht+UmxJe6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740278996", "to_ids": false, "type": "size-in-bytes", "uuid": "9bee2a58-fc04-4789-9976-bf3a8b154e7a", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740278996", "to_ids": true, "type": "vhash", "uuid": "295e9e11-f822-4bba-8eca-8de6f17b0139", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740278996", "to_ids": true, "type": "filename", "uuid": "7d8340a3-a6ff-4ddd-9ab8-537954d3e146", "value": "LockBit_0.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 14/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740278996", "to_ids": false, "type": "text", "uuid": "bd1863e5-2410-4851-9d4a-26232eef99f1", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.SA\nVT Total Detection:65/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385457", "uuid": "64c668ac-ebc6-46ca-8145-bf2b135f8049", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385457", "to_ids": true, "type": "md5", "uuid": "410355ca-b09f-4edb-894a-cbd1c468c02f", "value": "a5434b72fa80d4ed2bef826a36542dbc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280860", "to_ids": true, "type": "sha1", "uuid": "404f9390-99c2-400b-b773-2c94968cd4cf", "value": "d4e3c16a2ffbfc3ed46adeea2f13d21edc332b85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280860", "to_ids": true, "type": "sha256", "uuid": "2b39d16d-5f1a-489f-98d5-55a6adba38c7", "value": "e32dc551a721b43da44a068f38928d3e363435ce0e4d2e0479c0dfdb27563c82", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279017", "to_ids": true, "type": "ssdeep", "uuid": "cb452bd3-be7f-45b6-a25f-7302b45eceea", "value": "196608:DtigKrxQonhPMhfhJfBo1lcWxPclmBtGV7:AgK1QIZUHo2Kz27" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279017", "to_ids": false, "type": "size-in-bytes", "uuid": "718d9d95-e488-4b05-8d37-2a616692d204", "value": "16429293" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279017", "to_ids": true, "type": "vhash", "uuid": "62e159a5-e013-4aea-be4e-614cdf26aa37", "value": "0170866d1c0d5c051565503042z2300167z1025z13z23z29z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279018", "to_ids": true, "type": "filename", "uuid": "1e7dff35-314b-4266-a6a8-89e467a3b7ad", "value": "issa.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279018", "to_ids": false, "type": "text", "uuid": "58e78881-6f9c-46c8-85ae-4ce614250dfc", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit\nVT Total Detection:51/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385479", "uuid": "794a1b01-356c-4241-97a3-984ad904dc62", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385479", "to_ids": true, "type": "md5", "uuid": "61b58f45-d819-4c93-add2-95f5793d5e5c", "value": "548cdd0c2071170c4c87784eb8be84cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280861", "to_ids": true, "type": "sha1", "uuid": "498eb572-8554-481b-b20c-5b415dfd64ea", "value": "c776757e1e0195d996b49bd1124c7baffc462279", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280861", "to_ids": true, "type": "sha256", "uuid": "1df8f181-6e8a-4ec0-b347-848220ca6edc", "value": "16a707a3965ebd71ebc831b68863b855b2c8d60aef8efdef1e0c0a6cc28e9bc7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279039", "to_ids": true, "type": "ssdeep", "uuid": "56dd6a04-21e9-44d7-bbe6-e0d961b798a1", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdoF:Ujrc2So1Ff+B3k796W" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279039", "to_ids": false, "type": "size-in-bytes", "uuid": "b026ff9a-4c40-4f5b-a893-9568cbdaa1e6", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279039", "to_ids": true, "type": "vhash", "uuid": "a9f04437-6b6b-4990-b6d1-f98ef010dd72", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279039", "to_ids": true, "type": "filename", "uuid": "5535e4a2-a707-4483-9813-411e647d58ea", "value": "548cdd0c2071170c4c87784eb8be84cd.virus" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279039", "to_ids": false, "type": "text", "uuid": "978f5783-4190-41b4-8e5b-f17d9280800a", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:67/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385500", "uuid": "83bae5df-782a-4b9a-a2d6-4c56dde4d809", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385500", "to_ids": true, "type": "md5", "uuid": "bdd02c60-37c6-413f-85ff-dadadaa1fc8a", "value": "13baa52d7961db198134763370aa61e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280862", "to_ids": true, "type": "sha1", "uuid": "9d0e3953-7018-49c8-b10a-0b4dd8f471af", "value": "11ff84da7bba56c2eda7efc7a5c6736bf59d1e2d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280862", "to_ids": true, "type": "sha256", "uuid": "743060e8-ac17-4ff2-a522-c3193610bb54", "value": "bc0b54c19949f407da972f0bedf7f429c0fe25181564d1fb6d053b989925898f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279060", "to_ids": true, "type": "ssdeep", "uuid": "3e744b5b-3d55-4ec4-afee-3407e32b897b", "value": "24576:+nvgeA4Co2Wxr5+MKvB+5QyOT2y8gsMEqhzqBlHXCBQXGY5s9ZMNjAG:mv5dxrsv7T2yqKhzq3DXF5sIh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279060", "to_ids": false, "type": "size-in-bytes", "uuid": "e6167186-37a5-4356-92b7-0977ddfcff35", "value": "1218048" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279060", "to_ids": true, "type": "vhash", "uuid": "e0d58622-67e5-4cbc-8336-6e5daa37ca26", "value": "2160367565136076a39e8594" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279060", "to_ids": true, "type": "filename", "uuid": "fdc19782-fdf0-4482-b2d8-73da7c4b8d3f", "value": "ExtensibleClassFacto.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 03/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279060", "to_ids": false, "type": "text", "uuid": "c9df390d-2465-456a-9f8b-140bd5d98457", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Trojan:MSIL/AgentTesla.CGP!MTB\nVT Total Detection:55/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "9183e80b-0cc3-41b3-9363-74099eac4962", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "473a8bbb-c888-4281-a1ec-e22d4ab53dc2", "value": "84866fca8a5ceb187bca8e257e4f875a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "14d756f5-b28f-4685-81f9-cf83c2cc484d", "value": "038bc02c0997770a1e764d0203303ef8fcad11fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "d2efedde-2cd2-4afb-b6e2-cd659c386936", "value": "acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279081", "to_ids": true, "type": "ssdeep", "uuid": "246e7de1-13f1-4319-ad8a-8ac49b17a39f", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdFF:Ujrc2So1Ff+B3k796v" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279081", "to_ids": false, "type": "size-in-bytes", "uuid": "033c0a92-d085-497f-8ee7-ee594fe39385", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279081", "to_ids": true, "type": "vhash", "uuid": "66795088-dbc6-4746-aa70-2f677be3b19a", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279081", "to_ids": true, "type": "filename", "uuid": "9dad49c9-92e5-4fb8-8e21-090addced64e", "value": "acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 21/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279081", "to_ids": false, "type": "text", "uuid": "e6434452-1564-4b8b-b205-baf119d1a8b1", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:67/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "66a254ed-9d20-4ec7-9256-7c8a79218cb1", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "515d1e6c-5a00-408b-a41b-cdbbd3687df5", "value": "6fc418ce9b5306b4fd97f815cc9830e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "62e8ed6d-fb3f-4927-b1b6-6d637b57fb8d", "value": "95838a8beb04cfe6f1ded5ecbd00bf6cf97cd564", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "5ac33cfc-f3bc-4144-ae2c-4fc39a400fbb", "value": "0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279103", "to_ids": true, "type": "ssdeep", "uuid": "0dd736c5-7569-419e-a6be-6cc29f6beb2c", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdLF:Ujrc2So1Ff+B3k796l" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279103", "to_ids": false, "type": "size-in-bytes", "uuid": "f618cf87-4185-49c7-87e1-be6a86c0c302", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279103", "to_ids": true, "type": "vhash", "uuid": "4e169e46-d146-4f38-8a3f-4c99caff0119", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279103", "to_ids": true, "type": "filename", "uuid": "ce06b676-83d8-4eaf-a445-8948095c306a", "value": "ransomware_test sample. bin" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279103", "to_ids": false, "type": "text", "uuid": "e505ed50-63c2-40d9-a62c-46ee8c9b480c", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:69/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385569", "uuid": "418ebf38-c43c-4f29-8e8a-66f143b22fe9", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385569", "to_ids": true, "type": "md5", "uuid": "d0647e4f-1c96-49b1-adb7-4e7c668f4467", "value": "1e43127237176bf49f1647140602f190", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280867", "to_ids": true, "type": "sha1", "uuid": "9f654916-fa3c-4169-98b4-fb409bc978dd", "value": "e66d12bdddf55e1cb2b2a3228a28877a292c28b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280868", "to_ids": true, "type": "sha256", "uuid": "18bdf51d-cf0d-4f97-809f-a271731b2925", "value": "bcbb1e388759eea5c1fbb4f35c29b6f66f3f4ca4c715bab35c8fc56dcf3fa621", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279124", "to_ids": true, "type": "ssdeep", "uuid": "413190f5-89a5-4c45-8583-ac580631023f", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdKF:Ujrc2So1Ff+B3k796Y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279124", "to_ids": false, "type": "size-in-bytes", "uuid": "2c02a309-05e5-4e0e-bd26-f65e7c45cbff", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279124", "to_ids": true, "type": "vhash", "uuid": "afe65541-a5db-4ec8-85f1-c82459007297", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279124", "to_ids": true, "type": "filename", "uuid": "e72d28b5-a1fd-4755-b047-3e5ba19517ad", "value": "LockBit_628ED0D6A076AED2.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279124", "to_ids": false, "type": "text", "uuid": "dc94419b-23b9-4aab-aa63-e68f4bc57213", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:68/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385590", "uuid": "7335e750-c2d6-4878-8416-5aa4069477a1", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385590", "to_ids": true, "type": "md5", "uuid": "40eb88e1-9ba5-4d40-82d0-6030ad418405", "value": "f91095ae0e0632b0f630e0c4eb12ba10", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280869", "to_ids": true, "type": "sha1", "uuid": "510cfd22-a276-429b-a329-b5589a72f7d6", "value": "6c4040f2a76e61c649e1ff4ac564a5951c15d1fa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280869", "to_ids": true, "type": "sha256", "uuid": "2643fae3-dc84-448f-9bf7-de7e3fa55f55", "value": "717585e9605ac2a971b7c7537e6e311bab9db02ecc6451e0efada9b2ff38b474", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279145", "to_ids": true, "type": "ssdeep", "uuid": "f8cb8fbb-f0ca-4193-9a14-94791bb986ca", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdPF:Ujrc2So1Ff+B3k796R" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279145", "to_ids": false, "type": "size-in-bytes", "uuid": "055788c2-92cc-4602-8db5-dcf64aa56ed3", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279145", "to_ids": true, "type": "vhash", "uuid": "c9c28335-c8c5-4c69-8cfe-08c43321481d", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279145", "to_ids": true, "type": "filename", "uuid": "b7780cad-dbc9-4e88-a9ca-fd164b9fc4f0", "value": "704624___b4186d87-4efd-4ee0-9f07-6c5ebd04a97e.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279145", "to_ids": false, "type": "text", "uuid": "b35b4875-eeac-4716-a22a-6b0f5d31bead", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:70/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "b2fd45e6-34fd-43df-aef2-aaa8af41590c", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "87eb6b07-3918-49a9-875a-ac04a07e36eb", "value": "a4b9a65f57b2312b44038d0a1909ba73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "1cb5e806-bf85-4965-9dca-d7be5e6a0af3", "value": "5e4b23f3dd6c043bf1dcab7bc406e7a6335d674d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "05ea4d46-fe70-4b39-9e62-3e47e3f48da9", "value": "73406e0e7882addf0f810d3bc0e386fd5fd2dd441c895095f4125bb236ae7345", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279166", "to_ids": true, "type": "ssdeep", "uuid": "d90e5764-4828-4407-8c6f-368e334352e6", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QrF:dAfSrWW4g+7Ht+UmxJeU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279167", "to_ids": false, "type": "size-in-bytes", "uuid": "600c1d80-55d8-4f37-a720-4e22f439b14d", "value": "883227" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279167", "to_ids": true, "type": "vhash", "uuid": "4069b7b9-98e3-4ab5-872b-ad1cf4de6ded", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279167", "to_ids": true, "type": "filename", "uuid": "3b49cb50-c510-4212-b880-9bdecc89d9ce", "value": "a4b9a65f57b2312b44038d0a1909ba73.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279167", "to_ids": false, "type": "text", "uuid": "77e5af0c-3502-4988-b30d-12397a74b3b3", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.SA\nVT Total Detection:64/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385636", "uuid": "85c52bb9-74ca-4d8d-bec1-3b9b0a4b1e29", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385636", "to_ids": true, "type": "md5", "uuid": "cc6e921d-dae7-4bbb-9774-635e8ed7d687", "value": "ce5d09832339eb7ef86f2c22b4904a20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280872", "to_ids": true, "type": "sha1", "uuid": "2de7cb78-75ed-4585-bb16-31235cf099b4", "value": "e2db01d0a5572f580f5b7b28b4c9f1a04b35dc06", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280872", "to_ids": true, "type": "sha256", "uuid": "f5d77e8f-3ce4-426f-a563-3107700f59cf", "value": "90af3848d5a0c5eb9c6ddc1ee2e6c539dd6cb5ec5a433d00a6dae22fb221c446", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279190", "to_ids": true, "type": "ssdeep", "uuid": "9f5225da-e636-404e-82b7-410eee855fd3", "value": "196608:XPGZKb8E7BxbZaUitrRyiGbzYtdWH9p0UHFjfLZTlWr:+orZaEPYtdwrHFjLZMr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279190", "to_ids": false, "type": "size-in-bytes", "uuid": "56674961-8009-4191-b38b-9ffddff0c6ef", "value": "7881514" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279190", "to_ids": true, "type": "vhash", "uuid": "7a7da9c6-0cf8-4fce-b7fa-9602097017c4", "value": "076056655d15551028z51hz13z8fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279190", "to_ids": true, "type": "filename", "uuid": "d87c703c-c909-46b6-b010-55f3c1108119", "value": "suf_launch.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 03/08/2022", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279190", "to_ids": false, "type": "text", "uuid": "d98a3434-9fcf-4a71-94ea-432323455ac5", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Trojan:Win32/CryptInject!MSR\nVT Total Detection:42/70" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "bf4f080b-e0e4-439c-9acd-7d6d1cc6e982", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "242dee6e-4ee1-47a6-a854-9865e528866c", "value": "b0916724ff4118bf213e31cd198c0afd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "1de27a25-49ca-43bc-babd-cb67193caae7", "value": "12ac32d012e818c78d6db790f6e11838ca75db88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "c3b219ba-e733-4f08-b6aa-a4c7b07085fe", "value": "4bb152c96ba9e25f293bbc03c607918a4452231087053a8cb1a8accb1acc92fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279211", "to_ids": true, "type": "ssdeep", "uuid": "4ccf0bdf-61a1-4bd4-adae-382526d5706f", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdKF:Ujrc2So1Ff+B3k796U" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279211", "to_ids": false, "type": "size-in-bytes", "uuid": "381a9dde-39ac-4ca3-be0c-911367c17728", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279211", "to_ids": true, "type": "vhash", "uuid": "f188857e-9a7b-4910-91e7-6af5c754595b", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279211", "to_ids": true, "type": "filename", "uuid": "d21db57d-90c8-4e80-8377-e5853a9ae222", "value": "412063___15e29e25-7496-44d9-9e98-85036c12de8e.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279211", "to_ids": false, "type": "text", "uuid": "765bec9c-2cb2-4db8-b616-7e81c2ad4ce7", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:69/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747385678", "uuid": "b58a8681-4cf8-4792-9988-c9d1a29445b0", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747385678", "to_ids": true, "type": "md5", "uuid": "c2bdf8e9-cbef-4f0f-a49d-eddd592cd719", "value": "ed935c13170a4af0649cfada8d076c9c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280876", "to_ids": true, "type": "sha1", "uuid": "c56d4008-73ee-4b66-b968-d683f372df74", "value": "c872616f0a2fc40becca0628bfd51550957de750", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280876", "to_ids": true, "type": "sha256", "uuid": "2ce36442-ed23-4f3a-8baf-a5f783a63a3a", "value": "21879b5a8a84c5fe5e009c85744caf74b817c57203020bf919037d7ccb6b6a58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279233", "to_ids": true, "type": "ssdeep", "uuid": "afaa513b-eb3a-4087-83aa-4a881bc8288f", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279233", "to_ids": false, "type": "size-in-bytes", "uuid": "badcc61f-e476-4b40-a635-54169187c919", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279233", "to_ids": true, "type": "vhash", "uuid": "eb30e458-6d0c-4f1c-854d-6dfbd970d68f", "value": "015036656d51e3z12z3b0302231z37z60600165zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279233", "to_ids": true, "type": "filename", "uuid": "7044713a-ee3b-4755-85a2-6e7114131088", "value": "Lockbit2.0 (2).exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 30/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279233", "to_ids": false, "type": "text", "uuid": "a2e22d84-8a51-45c8-8c02-e696c9741bc1", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:67/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747501908", "uuid": "ee309f3a-0398-4680-8984-ea62c8fbb547", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747501908", "to_ids": true, "type": "md5", "uuid": "1f8d9363-ad93-4e5e-8b92-8b9b542404f0", "value": "4cab5f246a14bc558a80aef99065561c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280877", "to_ids": true, "type": "sha1", "uuid": "8fb95e22-4b66-4d57-8b95-9491c59c528d", "value": "288ee2dc432838c9dcca617e091e060de9bf3a28", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280877", "to_ids": true, "type": "sha256", "uuid": "f891018d-a620-4179-b076-c3c11e16ebc3", "value": "56fd91787c641c2329a86813497d0e6ff219c81a4d61ac10fedef9cd68c3baed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279254", "to_ids": true, "type": "ssdeep", "uuid": "374a3d6f-e4b8-4e31-a440-9eabe9f39f91", "value": "24576:Lv2HrnBPu1f3r/Bf++5kRzFxk7rMxTDpwGWMFg:T2HrBMVf+B3k7M2km" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279254", "to_ids": false, "type": "size-in-bytes", "uuid": "0911ea3c-60fe-4105-a243-efdfaa611b75", "value": "989696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279254", "to_ids": true, "type": "vhash", "uuid": "8cc37808-e9c1-451e-8964-c4877e9e45f4", "value": "0950366d651029z67z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279254", "to_ids": true, "type": "filename", "uuid": "cf4c010d-f95e-478f-acd7-95dc786224df", "value": "v2c.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 27/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279254", "to_ids": false, "type": "text", "uuid": "6f18237a-1e52-4948-8fa7-864f8a8e4a3b", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:63/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747501962", "uuid": "a12a59e2-20b1-4498-a500-0e4b23642ed6", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747501962", "to_ids": true, "type": "md5", "uuid": "03bc0218-d0ef-49a5-b234-1f5e85fadce0", "value": "6d301e3f4ef753b961e86673e3c2c59c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280878", "to_ids": true, "type": "sha1", "uuid": "8e5fa6ee-4bd5-47c5-80e4-9c0b47fc2bb3", "value": "6872704c7e2f9e2ca47fc40d22c146f66441daf9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280879", "to_ids": true, "type": "sha256", "uuid": "22280ccc-ba8a-47ff-a7ba-6e5729c96ce4", "value": "9dd6cc25b2f920b825e15682a4d06435a42b281674ba6e99c8e2b2222c9d638f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279275", "to_ids": true, "type": "ssdeep", "uuid": "6c5c92ea-2030-4b44-9230-0fcb1cd61d42", "value": "24576:PbqIi4vsu1NQ9+aubOj+vCVCdN/4yMdkzkxwccmDF:DqIiW7Qoau174IkxwVe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279275", "to_ids": false, "type": "size-in-bytes", "uuid": "6e28d4f7-cebf-4e83-8ac3-eb7bf67d33ae", "value": "992768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279275", "to_ids": true, "type": "vhash", "uuid": "d6e045ef-6006-4be9-a58b-b39b55755616", "value": "0950366d651029z57z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279275", "to_ids": true, "type": "filename", "uuid": "7f03adf2-7179-415b-9daf-78f5263b60b0", "value": "808FE5.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 05/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279275", "to_ids": false, "type": "text", "uuid": "23079be8-414a-4517-a29e-46c8ef985251", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:64/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747501986", "uuid": "06928c1f-cd6b-4764-a467-9abb328873dd", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747501986", "to_ids": true, "type": "md5", "uuid": "e8503db8-e46b-4202-973c-7c5cf195fbb1", "value": "dd318eeba5df256422d6c871879a64f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280880", "to_ids": true, "type": "sha1", "uuid": "1d8c4ee3-f5dd-4b59-830a-8514f8be92f7", "value": "3c1b760adafc464da99920a69215f6c42ff2d30f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280880", "to_ids": true, "type": "sha256", "uuid": "3e9fb13b-9cd0-41d1-96b4-20218ced6f66", "value": "23984141a918be3345296bb6bf50d8d356229cb832c726833499fbb950037d00", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279296", "to_ids": true, "type": "ssdeep", "uuid": "e8e0f4c3-4522-43c4-8b99-1d1d076a3fe6", "value": "24576:rb0Qev8u1c5PAvbOj+vCVCdN/4yMdkJLh+T8GfFb:/0QEOYv1742Lh+waV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279296", "to_ids": false, "type": "size-in-bytes", "uuid": "09840749-986c-4225-b079-b37737937acc", "value": "989184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279296", "to_ids": true, "type": "vhash", "uuid": "e31cc652-f2e2-4c44-9212-05a4aef6239b", "value": "0950366d651029z57z29z2jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279296", "to_ids": true, "type": "filename", "uuid": "7b7c79a4-4625-42a9-854d-37d2ede2a0a9", "value": "dd318eeba5df256422d6c871879a64f8.virus" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2023", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279296", "to_ids": false, "type": "text", "uuid": "25a974d2-1af6-422e-b3c9-650ebe2b4e50", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SB\nVT Total Detection:54/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502007", "uuid": "d5b7f68d-190c-4e04-8a07-365c9deda600", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502007", "to_ids": true, "type": "md5", "uuid": "fb40f8cc-1465-42c2-8c33-f386f363a6c3", "value": "388eafffcc96c71c317cf0908d3a133b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280881", "to_ids": true, "type": "sha1", "uuid": "11920a45-a449-42e6-8b29-33da1aed5cf9", "value": "16e5c5a81a88cb73464d92edf5bec7199907afb9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280881", "to_ids": true, "type": "sha256", "uuid": "e34407b7-b352-47ac-8f9a-3ddb7bbb59a1", "value": "91d1ab6c305552685996f4d80c44cc1c694355ae7d09243df027827d1df61631", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279318", "to_ids": true, "type": "ssdeep", "uuid": "6a194c69-127e-48f9-ad6c-cf23fff0b8c0", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279318", "to_ids": false, "type": "size-in-bytes", "uuid": "e925f825-1a9e-4e07-9bb4-7ce1ee35e57d", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279318", "to_ids": true, "type": "vhash", "uuid": "234f5b98-cfab-438e-ac3c-77b496c14a58", "value": "015036656d51e3z12z3b0302231z37z60600165zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279318", "to_ids": true, "type": "filename", "uuid": "ce335a97-415a-48c6-bb4a-6eea622dfcac", "value": "A94ED07AA2CAF6C8.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 28/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279318", "to_ids": false, "type": "text", "uuid": "6aefacb7-0b9e-4d5e-ba43-c08baf521641", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:66/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502028", "uuid": "d16795b1-e170-4726-87f9-761041be634e", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502028", "to_ids": true, "type": "md5", "uuid": "a230918b-1a85-4773-ba14-7e16fbc5306c", "value": "4de69c226426a742a17ade81cde8d1f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280883", "to_ids": true, "type": "sha1", "uuid": "afb280e3-1c48-471f-89e5-54411d498305", "value": "ea10e601a2fb81362687421bc0b8f9d6238d7dfa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280883", "to_ids": true, "type": "sha256", "uuid": "e04bd72c-8059-4081-8d27-5f7ca589299c", "value": "1dbe9f956514460774290197ffccb11d817d1a5a5aeab81877ae7b74daa1b592", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279339", "to_ids": true, "type": "ssdeep", "uuid": "928920c2-3aaa-4fb9-aa44-20235d8773d1", "value": "6144:DpeR+KBiFmRCPxGiVpAPtL4Kc/4rj8IydT3tm5zDy:DponOmMPNV1/4rj8IydTdj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279339", "to_ids": false, "type": "size-in-bytes", "uuid": "e1a34acf-4b93-4a68-b606-e76eea5436c7", "value": "323760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279339", "to_ids": true, "type": "vhash", "uuid": "2bf60a84-2287-4389-bfe3-304335663a00", "value": "035046651d551061z100131z51f5z4cz1afz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279339", "to_ids": true, "type": "filename", "uuid": "688ffb12-7d6e-4802-bbd4-281280559e02", "value": "SMSvcHost.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 05/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279339", "to_ids": false, "type": "text", "uuid": "1998c62e-21d6-4804-ab7d-c466bc57587b", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Avaddon.PB\nVT Total Detection:60/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "ccb7094a-a7bb-4e0c-8293-1548eeeaab43", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "f54446cf-32cf-449f-9950-83c4b586773e", "value": "9fe9f4ee717bae3a5c9fdf1d380e015d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "5c2860e9-f4f5-478c-b81e-1dd6618c770f", "value": "7df22f2fbe86a07070f262f94e233860b6ae66b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "c25f4d88-3368-4cb2-b535-dd81baf7023e", "value": "1e3bf358c76f4030ffc4437d5fcd80c54bd91b361abb43a4fa6340e62d986770", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279361", "to_ids": true, "type": "ssdeep", "uuid": "b32ecccb-0c5f-4a20-bfa7-67c51e74790b", "value": "1536:e/0JJMzS/5uJup2KN/Z9SQ2illYOcJngsxmZ50fBbjpAeuwC:e/qJMq5uJupjSQ2+1ctgY5bjpp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279361", "to_ids": false, "type": "size-in-bytes", "uuid": "71ef630f-187d-40d5-a2e0-bfdda0407e96", "value": "69120" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279361", "to_ids": true, "type": "vhash", "uuid": "ae196057-6784-44bc-a6a2-4d104fd5b2fe", "value": "06403e0f7d1013z13z60101011z17z1011z15z17z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279361", "to_ids": true, "type": "filename", "uuid": "a898770e-156b-4d53-a044-5b0cf88c17d7", "value": "LockBit_23.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 19/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279361", "to_ids": false, "type": "text", "uuid": "87e2ff47-4391-4b26-9983-8c61a632e6ac", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA!MTB\nVT Total Detection:66/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502072", "uuid": "1dee9e05-9190-4528-8a35-a9a61305605d", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502072", "to_ids": true, "type": "md5", "uuid": "4d373265-889e-44fb-afb0-06a096aa02e3", "value": "49250b4aa060299f0c8f67349c942d1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280886", "to_ids": true, "type": "sha1", "uuid": "7abb2b51-c991-46f6-9f05-f3c342de43c7", "value": "4d0e6d7af9a5edece5273f3c312fdd3b9c229409", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280886", "to_ids": true, "type": "sha256", "uuid": "4279fb47-d4dd-482c-8b67-e619e0cb9fcd", "value": "69d9dd7fdd88f33e2343fb391ba063a65fe5ffbe649da1c5083ec4a67c525997", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279382", "to_ids": true, "type": "ssdeep", "uuid": "e1e79561-1edf-4a8f-bbe3-529a7d71832a", "value": "3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/:pq/1VP1OyysNmJyXsqqD/ls/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279382", "to_ids": false, "type": "size-in-bytes", "uuid": "0cb058b2-6a1f-45be-85b8-7346d0c88387", "value": "154112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279382", "to_ids": true, "type": "vhash", "uuid": "96350996-daf5-4ba7-b817-0b49dfe61519", "value": "015036656d1223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279382", "to_ids": true, "type": "filename", "uuid": "21d0c1a5-d085-4cf7-96ec-8758971af7f7", "value": "lockbit.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279382", "to_ids": false, "type": "text", "uuid": "9180c7c0-bd08-4972-993a-bc1c3d1e4de8", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA!MTB\nVT Total Detection:67/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "9904a34a-2db1-4244-8abe-b61b1e2955fe", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "72092ebe-999a-4759-a718-6f85b7d3d22e", "value": "207718c939673a5f674ce51f402cfc06", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "1b7f24cf-f931-40a4-b529-36ccf980e929", "value": "791f60a24f9b6589a2afed48b3ec17fad43bc1db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "a6ece4de-0039-48a9-b4c1-02f2951f397c", "value": "26b6a9fecfc9d4b4b2c2ff02885b257721687e6b820f72cf2e66c1cae2675739", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279404", "to_ids": true, "type": "ssdeep", "uuid": "004ca4be-e07d-4538-9b39-11788bc6eff5", "value": "3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/:pq/1VP1OyysNmJyXsqqD/ls/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279404", "to_ids": false, "type": "size-in-bytes", "uuid": "32d423b8-2e5c-414d-8999-45a967b81b8f", "value": "154112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279404", "to_ids": true, "type": "vhash", "uuid": "fbdf65a1-98d9-40f9-ae07-d36216f3c4a2", "value": "015036656d5223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279404", "to_ids": true, "type": "filename", "uuid": "77c9badd-e689-4ae5-92fc-9db00accfdcb", "value": "LockBit_27.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279404", "to_ids": false, "type": "text", "uuid": "f267124b-b76f-43ae-b261-d8568bcafa10", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA!MTB\nVT Total Detection:66/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "9f341794-7bf0-4f33-824f-9982cf19cf37", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "28ab1370-6d8b-40dc-9735-d731147c4260", "value": "e4179bca5bf5b1fd51172d629f5521f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "cfcefed5-ecbf-433b-8be6-010bd86f4514", "value": "488e532e55100da68eaeee30ba342cc05810e296", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "de059b2b-621b-4c1e-8505-29ac8bc4e026", "value": "ca57455fd148754bf443a2c8b06dc2a295f014b071e3990dd99916250d21bc75", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279425", "to_ids": true, "type": "ssdeep", "uuid": "475d0ae8-ecbc-43b5-9e0b-1329fc702c93", "value": "12288:eE+eJEf0D+DKSu2eyFS5QBjzLHbhlCKCyTHxTwztt0v93aOy1032Du4IafBEqJX:KC8bbE0wFH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279425", "to_ids": false, "type": "size-in-bytes", "uuid": "15027036-6d5a-41c3-a419-1cfabeaa918f", "value": "559104" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279425", "to_ids": true, "type": "vhash", "uuid": "1692b140-05da-43fa-aa02-314811ac410c", "value": "2550361515115081440010" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279425", "to_ids": true, "type": "filename", "uuid": "7496d6b4-bd1a-4978-84e1-2c43330642e9", "value": "rs35.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 22/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279425", "to_ids": false, "type": "text", "uuid": "d057a465-be06-4016-b251-55c3dea0e837", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit\nVT Total Detection:62/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502143", "uuid": "a7c2a466-30d3-4557-b53f-b618bc53eafe", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502143", "to_ids": true, "type": "md5", "uuid": "40edd6c3-4e74-4e25-8c8e-9bc743c1f64d", "value": "8ab0375228416b89becff72a0ae40654", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280892", "to_ids": true, "type": "sha1", "uuid": "5505ad8e-373f-41c4-b02b-d6b7fabc97d3", "value": "75f06b636efe53360287c0ff1f51ea7de1e7c8b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280892", "to_ids": true, "type": "sha256", "uuid": "685361b1-43d1-4890-ab5d-f25da8c4b659", "value": "5072678821b490853eff0a97191f262c4e8404984dd8d5be1151fef437ca26db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279446", "to_ids": true, "type": "ssdeep", "uuid": "82892baa-9195-4deb-b64d-a4ade6b2dfdf", "value": "12288:+SEQeJEf0D+DKSu2eyFS5QBjzLHbhlCKCyTHxTwztt0v93aOy1032Du4IafBEqJX:+gC8bbE0wFH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279446", "to_ids": false, "type": "size-in-bytes", "uuid": "256f81d6-aaa7-4c06-bdde-fd64b5f96e93", "value": "559616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279446", "to_ids": true, "type": "vhash", "uuid": "aca16ec6-8772-4489-855f-7648dc6b634a", "value": "2550361515116081440010" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279446", "to_ids": true, "type": "filename", "uuid": "808c97db-afa0-48d9-832d-53a521afc288", "value": "rs40.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 07/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279446", "to_ids": false, "type": "text", "uuid": "40109d93-b4ba-4d34-b4b2-2614dfd29f99", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit\nVT Total Detection:60/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502180", "uuid": "db435d04-1a32-4cf7-a5de-d03449d00ec8", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502180", "to_ids": true, "type": "md5", "uuid": "e9ff6a40-1014-4f7f-8139-3c5559f45885", "value": "ec273b5841eadfc43b1908c9905e95a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280893", "to_ids": true, "type": "sha1", "uuid": "163fdf11-7bd7-4712-9196-371a108abc0e", "value": "71e7990c8c81ef6c4e265eae11030886c40cc8b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280893", "to_ids": true, "type": "sha256", "uuid": "df9befac-b89f-467c-bd53-a25058fd8322", "value": "410c884d883ebe2172507b5eadd10bc8a2ae2564ba0d33b1e84e5f3c22bd3677", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279468", "to_ids": true, "type": "ssdeep", "uuid": "4d79bbfb-bbd8-4b9a-a5ee-06c7f084e9bd", "value": "3072:LmB81yVWHb1eIifPpZyiGUH6pGxfF6hH0hMqqD/A6zHv/:Lc8sVWOmyaWeqqD///" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279468", "to_ids": false, "type": "size-in-bytes", "uuid": "7e8ac5f1-e8ee-4126-b3b3-faa5c77de0a4", "value": "154112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279468", "to_ids": true, "type": "vhash", "uuid": "9f5c13de-b59f-45e4-bcaf-faa4a8108270", "value": "015036656d1223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279468", "to_ids": true, "type": "filename", "uuid": "5d1b2504-1aef-41bf-8fe1-a5cce03d7d5e", "value": "842758___23fe90fe-6d4f-40b0-bfde-7a5d3166a380.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279468", "to_ids": false, "type": "text", "uuid": "6bddf816-2c7e-40bc-b8b5-f28ed674e5ab", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA!MTB\nVT Total Detection:66/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981242", "uuid": "0656616a-c9f1-4ba0-a71b-6ccaa91aff1f", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "9559dd93-5267-491c-9e09-b0b1eb442065", "value": "5761ee98b1c2fea31b5408516a8929ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "3ef20e68-138a-449a-9b8c-1aae5b0a3f48", "value": "4d043df23e55088bfc04c14dfb9ddb329a703cc1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981242", "to_ids": true, "type": "sha256", "uuid": "c2f107b5-3745-40fc-9f46-8c872b8ee31e", "value": "0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279489", "to_ids": true, "type": "ssdeep", "uuid": "47e736a2-5c86-4283-beb2-5bec769eed40", "value": "3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/:pq/1VP1OyysNmJyXsqqD/ls/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279489", "to_ids": false, "type": "size-in-bytes", "uuid": "52cdd94b-a57d-4bfd-9834-d40265bd91b9", "value": "154112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279489", "to_ids": true, "type": "vhash", "uuid": "19ced3f4-8a33-442d-860b-2a1855531b4b", "value": "015036656d1223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279489", "to_ids": true, "type": "filename", "uuid": "2deeaf83-a9c7-4893-8d94-edf06351844a", "value": "0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279489", "to_ids": false, "type": "text", "uuid": "b33d0fd0-66a6-45f9-a5ae-4ce6dde5870f", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA\nVT Total Detection:67/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502228", "uuid": "a72d802a-ea6f-4f45-bffe-4684cba83d1d", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502228", "to_ids": true, "type": "md5", "uuid": "068664ca-dd01-42bf-9c75-a1daf5582686", "value": "5cc28691fdaa505b8f453e3500e3d690", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280896", "to_ids": true, "type": "sha1", "uuid": "1a12e7d7-9de1-4080-b6be-acc0086d10f3", "value": "cb3fb57b5c70c3a2f30aa3af078bbb1cfdd1bf02", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280896", "to_ids": true, "type": "sha256", "uuid": "cbb8d803-25da-441c-9e76-ae69f123b57c", "value": "286bffaa9c81abfb938fe65be198770c38115cdec95865a241f913769e9bfd3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279511", "to_ids": true, "type": "ssdeep", "uuid": "4b6cea7a-c694-4770-a76c-3573a5cf8ff1", "value": "12288:A1kx1gjdatSK411nhuGvv6DuQ4yPcFy62eaFsvXPAVVRSPq2hvP:A1kfoatSK41dhuGvQgy6GWQxSvX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279511", "to_ids": false, "type": "size-in-bytes", "uuid": "5def8d27-5e4c-456d-bd8a-ac6154746151", "value": "783416" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279511", "to_ids": true, "type": "vhash", "uuid": "507dff99-0bc0-4d86-ae7b-8c3287435b78", "value": "075056655d55151064z22007a7z5035z22z72fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279511", "to_ids": true, "type": "filename", "uuid": "5ee2212b-edec-45d7-8e40-88223bad8843", "value": "sh1.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 19/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279511", "to_ids": false, "type": "text", "uuid": "b3c23966-c784-498e-9405-7054c0b3aa36", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/DelShad\nVT Total Detection:59/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502249", "uuid": "2f7a4b10-0c22-4109-a678-44fcf71a2450", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502249", "to_ids": true, "type": "md5", "uuid": "a34f2513-ac5a-4404-98d2-3ccc47c529d2", "value": "123511227718f17b3dec5431d5ae87f3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280898", "to_ids": true, "type": "sha1", "uuid": "0087cf8e-b599-42d0-b244-0377c6c2eb90", "value": "307088ae7027b55541311fd70a9337ff3709fccf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280898", "to_ids": true, "type": "sha256", "uuid": "39804989-a5b7-4b61-9b04-125adc274820", "value": "e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279532", "to_ids": true, "type": "ssdeep", "uuid": "7c0cd079-66cd-4cf3-a2dc-12fce411b6a1", "value": "3072:3m5H8y2mrr217uS8nW+cpsCp2cOy1cjKCy8YjKGiyWDDuMqqD/E0a3Hv/:3MHf2mr/Ww74cdlzXFqqD/Za//" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279532", "to_ids": false, "type": "size-in-bytes", "uuid": "9a033fc0-7ced-4bc5-96a1-70dfd75c866d", "value": "154624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279532", "to_ids": true, "type": "vhash", "uuid": "d2701c63-5ad2-4da7-afe5-9c6463661d5d", "value": "015036656d5223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279532", "to_ids": true, "type": "filename", "uuid": "ab1593f6-9342-4675-845d-bf4f12129193", "value": "823406___87eb5f03-e02c-4c36-8116-79b09218c231.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279532", "to_ids": false, "type": "text", "uuid": "118c2d62-5f51-488a-bb59-a27c06b05186", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA!MTB\nVT Total Detection:66/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981243", "uuid": "27daea45-5cc5-4627-96bf-7500fdca1b7b", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981242", "to_ids": true, "type": "md5", "uuid": "ae8e3ec3-dbcf-48a9-b73b-e2d874e139b7", "value": "1fbef2a9007eb0e32fb586e0fca3f0e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981242", "to_ids": true, "type": "sha1", "uuid": "bcf30f92-c18d-4414-95a6-4bbe05be598c", "value": "3e86304198d1185a36834e59147fc767315d8678", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981243", "to_ids": true, "type": "sha256", "uuid": "ae73fd01-13b5-43f4-9440-8100e114565d", "value": "0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279553", "to_ids": true, "type": "ssdeep", "uuid": "973a64da-be25-4e5c-a1d2-3cee50eae0ed", "value": "3072:3m5H8y2mrr217uS8nW+cpsCp2cOy1cjKCy8YjKGiyWDDuMqqD/E0a3Hv/:3MHf2mr/Ww74cdlzXFqqD/Za//" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279553", "to_ids": false, "type": "size-in-bytes", "uuid": "fa02cf30-0019-410e-861f-374835cdf6de", "value": "154624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279553", "to_ids": true, "type": "vhash", "uuid": "ff62c31e-6ab0-4816-b97e-7b6dae42c04b", "value": "015036656d5223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279553", "to_ids": true, "type": "filename", "uuid": "3d0fc83f-c1b8-49f4-9fb9-175b58207d9b", "value": "0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279553", "to_ids": false, "type": "text", "uuid": "a760bc94-d534-428d-a06e-70b69a41e609", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA!MTB\nVT Total Detection:65/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981243", "uuid": "5b89768b-3956-4d1b-a52d-ce236eedbdc1", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981243", "to_ids": true, "type": "md5", "uuid": "bfc3aabf-4f02-4fe7-9f3f-0268112ae573", "value": "1f4f6abfced4c347ba951a04c8d86982", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981243", "to_ids": true, "type": "sha1", "uuid": "5ab41f00-cdb0-417e-86d4-a65ac5ce3448", "value": "a4c486b0926f55e99d12f749135612602cc4bf64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981243", "to_ids": true, "type": "sha256", "uuid": "b23082ad-1db5-434c-adbc-36481b0ef223", "value": "1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279575", "to_ids": true, "type": "ssdeep", "uuid": "60a749c9-76f7-4ebb-bc3f-858c299f425f", "value": "3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/:pq/1VP1OyysNmJyXsqqD/ls/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279575", "to_ids": false, "type": "size-in-bytes", "uuid": "c318e4b2-9762-46b9-8f00-8ea6e7576b5c", "value": "154112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279575", "to_ids": true, "type": "vhash", "uuid": "deb275cf-ca04-40f1-8402-d4c6d73686cf", "value": "015036656d1223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279575", "to_ids": true, "type": "filename", "uuid": "bf5e17cc-69bd-4ae6-b760-c61d36904fa4", "value": "LockBit_21.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279575", "to_ids": false, "type": "text", "uuid": "9e046c8b-d42e-46bb-b999-5b168e0ff139", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.PA!MTB\nVT Total Detection:66/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502319", "uuid": "f6da0eaa-432c-4b66-be98-0f59799aac76", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502319", "to_ids": true, "type": "md5", "uuid": "48672cc3-3162-435e-89be-50138b8284ab", "value": "0859a78bb06a77e7c6758276eafbefd9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280903", "to_ids": true, "type": "sha1", "uuid": "a41de78c-dfd8-4c24-96ff-819293dcab62", "value": "a72e18efa33f1e3438dbb4451c335d487cbd4082", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280903", "to_ids": true, "type": "sha256", "uuid": "caccd1fb-6772-4745-9145-2a5a9b54bb43", "value": "ffbb6c4d8d704a530bdd557890f367ad904c09c03f53fda5615a7208a0ea3e4d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279597", "to_ids": true, "type": "ssdeep", "uuid": "71e9efb4-07df-4ba3-a639-6b790b7a3801", "value": "3072:sr85CNR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/3Q1m3/OyVPX/1jTCA:k93OyysNmJyXsqqD/ls/32q/1VPn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279597", "to_ids": false, "type": "size-in-bytes", "uuid": "e4326c1e-1438-44b5-95cf-31d63ad09e27", "value": "195584" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279597", "to_ids": true, "type": "vhash", "uuid": "fc3676c9-f98c-4729-be23-6db213f765f9", "value": "0150866d1c0d1c0515651035zc00159z25z23z2fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279597", "to_ids": true, "type": "filename", "uuid": "f97e8fc0-933d-4a8b-810a-5d19e53fcdf2", "value": "773404___1b213b0c-01b1-4333-b811-aec8ddc3774c.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279597", "to_ids": false, "type": "text", "uuid": "291c3492-be07-4460-a25b-6ed590881070", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Virus:Win32/Neshta.A\nVT Total Detection:67/77" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502343", "uuid": "554f69ff-15f3-4239-ae18-8b8fff5279cc", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502343", "to_ids": true, "type": "md5", "uuid": "bce9069d-2f6d-49c4-aa49-cafe99539b41", "value": "9a246bf39f3fab9c2d45f1003bdc6b45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280904", "to_ids": true, "type": "sha1", "uuid": "7644853d-39d6-4914-8638-555aadd7cb5b", "value": "f05e71ed0e4a779fc30c3d732b07e15d56f8e3bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280904", "to_ids": true, "type": "sha256", "uuid": "cfe00917-b9c3-4773-9cf0-c062eb6f8c93", "value": "76a77def28acf51b2b7cdcbfaa182fe5726dd3f9e891682a4efc3226640b9c78", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279619", "to_ids": true, "type": "ssdeep", "uuid": "0039e216-959b-4822-9bf2-c1b7f56b0bfc", "value": "6144:XRgAYEzNetKh0FtASkJuTXHJdprdf9SDborKA/26m5:BgdSNqKGYDujDpJlSDEGA/A" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279619", "to_ids": false, "type": "size-in-bytes", "uuid": "51850e7f-3825-4115-9220-1eba4a61cc80", "value": "352144" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279619", "to_ids": true, "type": "vhash", "uuid": "24655e85-1ad3-4304-85af-8883fc1e25c3", "value": "03503e0f7d1015z11z47z1015z13z1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279619", "to_ids": true, "type": "filename", "uuid": "234f5ddc-f4eb-4e37-941f-acd39738a362", "value": "sh1.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 21/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279619", "to_ids": false, "type": "text", "uuid": "3e7c1e04-e4f1-4c5a-88f5-e739775739b5", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/DelShad\nVT Total Detection:59/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502365", "uuid": "1c5ce6d1-98f0-431c-ba6e-2877a93d0430", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502365", "to_ids": true, "type": "md5", "uuid": "4a9005d7-af8e-4f81-82b7-8408c6a81914", "value": "a04a99d946fb08b2f65ba664ad7faebd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280906", "to_ids": true, "type": "sha1", "uuid": "ee858447-9411-4a86-9cce-fb89137ecc84", "value": "1fe7e2f8fbd98d6b5505fd9ee66da5b4f11720a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280906", "to_ids": true, "type": "sha256", "uuid": "166f1e9c-4c0c-4bd2-8b8a-de0e3836f807", "value": "faa3453ceb1bd4e5b0b10171eaa908e56e7275173178010fcc323fdea67a6869", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279641", "to_ids": true, "type": "ssdeep", "uuid": "13057be7-cb8d-4b2f-96f2-5da4bf8443ae", "value": "12288:S1kx1gjdatSK411nhuGvv6DuQ4yPcFy62eaFsvXPAVVRSPq2hv:S1kfoatSK41dhuGvQgy6GWQxSv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279641", "to_ids": false, "type": "size-in-bytes", "uuid": "475315eb-de87-4fd8-bec7-109fa89a8673", "value": "780688" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279641", "to_ids": true, "type": "vhash", "uuid": "2a4c2372-a25e-46bf-a19e-fd7354867e63", "value": "075056655d55151064z22007a7z5035z22z72fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279641", "to_ids": true, "type": "filename", "uuid": "ed51a835-fcb8-47ca-a157-a2611d5066cf", "value": "sh1.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 19/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279641", "to_ids": false, "type": "text", "uuid": "8cc432d1-2d41-4a7b-b4f4-6e596e3fbe98", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Trojan:Win32/Occamy.C\nVT Total Detection:61/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502387", "uuid": "40e07b6b-8ecb-48c5-bea1-e15571e015b2", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502387", "to_ids": true, "type": "md5", "uuid": "5893aab8-9eba-45f3-a795-c5bbc5a0d25b", "value": "309036e77962a4361159d60b4ea01fd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280907", "to_ids": true, "type": "sha1", "uuid": "2b74e6cf-b08e-43c1-aaa1-478f21aad5d7", "value": "aab72476b7af6fdf12f68324c77094614be20c1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280907", "to_ids": true, "type": "sha256", "uuid": "396efb7e-725e-45c1-b26c-f320fb652c7a", "value": "12a435aa3fe7fc3fa531b9e02ee63b907f343b4aa7acc137105e48eb7b32075a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279662", "to_ids": true, "type": "ssdeep", "uuid": "f92a5d2c-d4c8-4816-845e-732687f83b69", "value": "196608:dF5VWpKiicWxCwPoi+D5FyY30uO4sXjog7HFHj4u1MLmkTuda:ddFiZwAt5FyYkTxPBH1MLKa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279662", "to_ids": false, "type": "size-in-bytes", "uuid": "90cb086b-6d95-4482-974b-89973202d7e0", "value": "7160177" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279662", "to_ids": true, "type": "vhash", "uuid": "a189c07e-5291-41b6-8fc1-dbd0ef92d12d", "value": "196ac1969dbbd3a6913b7928c4f20b19" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279662", "to_ids": true, "type": "filename", "uuid": "c94ae6b5-f97a-4533-a889-e86adec43cb5", "value": "C761DC.zip" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/12/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279662", "to_ids": false, "type": "text", "uuid": "9301f39c-ab1a-453d-873e-4b14c528ae1e", "value": "Lockbit 2.0\r\nType Description: ZIP\n\nMicrosoft: Ransom:Win32/lockbit!MSR\nVT Total Detection:34/62" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502409", "uuid": "973a66ab-3b20-4347-ad0e-39f6b4ad3353", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502409", "to_ids": true, "type": "md5", "uuid": "c8d6c0fd-68fb-442b-8a2a-7bf9af6d5f56", "value": "38dc6cbaef2be2647447280ffccf9c80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280909", "to_ids": true, "type": "sha1", "uuid": "9fd50645-ab1d-470c-83fb-1b9486c36f5b", "value": "dd13155bdbd8a63053fa14cf50a04cdbfdda4a84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280909", "to_ids": true, "type": "sha256", "uuid": "553c3004-7082-4a23-b607-6a2ab1f4a5dc", "value": "14b3827e821ee2d719d20c265d873e7e1471df40df1089175adbbe31a83fc0eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279684", "to_ids": true, "type": "ssdeep", "uuid": "749bd76d-5414-4086-a3c4-69871166f378", "value": "24576:fClseAiEoGWtd5wqmvxq5CEObA8o8IKUqhzsTr1NaHSjG0HC9imKjpsn:qlBttd6vBbA80ohzs3PjHHCu1sn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279684", "to_ids": false, "type": "size-in-bytes", "uuid": "2c43723b-76fa-4758-b395-954b94dbfdd8", "value": "1092324" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279684", "to_ids": true, "type": "vhash", "uuid": "cb1f81f3-36f4-4db8-97ab-9e6e6973cde4", "value": "a05e5e33a9071b4de92a9e8bdfe7d96f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279684", "to_ids": true, "type": "filename", "uuid": "53a76fba-e9cb-4248-9a0b-2d5a45862fbf", "value": "\u3010\u53ef\u7591\u6587\u4ef6\u3011xxxx.zip" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 21/06/2022", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279684", "to_ids": false, "type": "text", "uuid": "d15294ff-2933-43c8-bb8a-2332b2dcf619", "value": "Lockbit 2.0\r\nType Description: ZIP\nNone\nMicrosoft: Trojan:MSIL/AgentTesla.CGP!MTB\nVT Total Detection:42/63" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502431", "uuid": "af1756f8-9bf7-4728-a79a-9a973e86a1a0", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502431", "to_ids": true, "type": "md5", "uuid": "190fb8bc-0dfa-429b-9130-2db3df1d5d08", "value": "66b9ccb41b135f302b3143a5d53f4842", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280910", "to_ids": true, "type": "sha1", "uuid": "3dfe99d3-698d-403a-bc93-84e854574edb", "value": "3d532697163e7c33c7c906e8efbb08282d3efd75", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280910", "to_ids": true, "type": "sha256", "uuid": "1c86f32f-9a0a-479b-a4c0-dc4b018e38db", "value": "d089d57b8b2b32ee9816338e96680127babc5d08a03150740a8459c29ab3ba78", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279706", "to_ids": true, "type": "ssdeep", "uuid": "fa043ca9-fce5-4997-8706-731d0e89ed0c", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QzF:dAfSrWW4g+7Ht+UmxJeg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279706", "to_ids": false, "type": "size-in-bytes", "uuid": "0d337ca5-3ec1-4d49-9ab0-75dcdcffafd0", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279706", "to_ids": true, "type": "vhash", "uuid": "bfabac00-6fd3-4521-a031-2dd089c78308", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279706", "to_ids": true, "type": "filename", "uuid": "15eba9f3-220f-4602-9b48-c9d552e7487a", "value": "799189___71458f90-2756-4137-bb3f-9305d18651b0.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 06/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279706", "to_ids": false, "type": "text", "uuid": "a9aad086-c420-4949-b2d6-ce65c1ec04b2", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:66/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502453", "uuid": "2db291de-cecb-41d2-b279-c8ee5e6838c5", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502453", "to_ids": true, "type": "md5", "uuid": "a7b33eb4-4fb2-49b0-ab34-bcaad28f6079", "value": "082fffb7439f2ec6c40bbb29640ebc3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280911", "to_ids": true, "type": "sha1", "uuid": "442c2bcd-f5c3-4848-aebb-2bf373203b7a", "value": "e0398947a2213182bf3d8612cac42d274e2eb179", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280912", "to_ids": true, "type": "sha256", "uuid": "33b81703-0058-4ad6-acdf-b8e7fdd70fbc", "value": "32f8eed5b2ada44b51cb251bce22355604d8cafef77e33bce769469926dc8cd7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279727", "to_ids": true, "type": "ssdeep", "uuid": "64af3d77-e216-4631-a177-2dd1d4bb989e", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QfF:dAfSrWW4g+7Ht+UmxJew" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279727", "to_ids": false, "type": "size-in-bytes", "uuid": "f77301cb-c653-459a-9075-4e5808935c68", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279727", "to_ids": true, "type": "vhash", "uuid": "e0cd4b4d-5409-44cb-b138-dbec6a027b2a", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279727", "to_ids": true, "type": "filename", "uuid": "2b18c967-46bc-4cfe-80af-da2c783de4b1", "value": "1.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279727", "to_ids": false, "type": "text", "uuid": "bac48a51-f659-4dd3-8ce2-232e37f4cce3", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.SA\nVT Total Detection:64/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502475", "uuid": "5aedab3d-5b1c-4cb7-916c-37b5ac2dd8e8", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502475", "to_ids": true, "type": "md5", "uuid": "7099c328-f483-437a-ab00-4536191d7ca2", "value": "b2bb315120eb657647415aebc1985294", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280912", "to_ids": true, "type": "sha1", "uuid": "510226fe-5d58-4b77-b312-e479b17d60a1", "value": "79961fed246cead1df5750f10a6d4b57cafc1131", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280912", "to_ids": true, "type": "sha256", "uuid": "6d45e214-1b13-4375-b0e4-19a82dfe9824", "value": "92ec3373b528e0040fae1c34b6edc8d623d03eac84267bd3ed408fe547b9c944", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279748", "to_ids": true, "type": "ssdeep", "uuid": "32ec6a67-2e12-49de-a83d-e5e036bb81fc", "value": "24576:MCmcsqyJkounlRNf+zuwClcnHlroP8pbLRvM7uEFx:DmcfyJk9Lcu7qlroUpfRyxD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279748", "to_ids": false, "type": "size-in-bytes", "uuid": "45f3088b-cde8-4cb1-aea0-118bd65c2fef", "value": "995328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279748", "to_ids": true, "type": "vhash", "uuid": "e4eb75af-f1dc-45f0-9df2-2b72e73fa00b", "value": "0950366d651029z57z29z2jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279748", "to_ids": true, "type": "filename", "uuid": "e5347c5e-794d-44c7-9631-3a0fdd43ef6b", "value": "v2c.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279748", "to_ids": false, "type": "text", "uuid": "4f05a227-cf17-4eb6-ad26-feac13a733e7", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:62/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502496", "uuid": "f87e8639-863d-4784-b438-6385fdaa7da4", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502496", "to_ids": true, "type": "md5", "uuid": "8a9f6a38-46be-4eee-865e-df10a4566d09", "value": "0f890d99d7a89506db76866f4a93b771", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280913", "to_ids": true, "type": "sha1", "uuid": "3830bd0d-81ec-4062-af7f-ed34b66dbe07", "value": "20ef9057653cb710608eb632fed45d42aff0ac6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280914", "to_ids": true, "type": "sha256", "uuid": "fa7046b3-6938-41e7-abe4-caf3d1832e69", "value": "d52f0647e519edcea013530a23e9e5bf871cf3bd8acb30e5c870ccc8c7b89a09", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279770", "to_ids": true, "type": "ssdeep", "uuid": "b213a570-cea3-466e-9938-a25ea16ad6f2", "value": "1536:3XmpuZ+4Jn/YhGtX3l6uomCImXjosOdsgixFCfNKgf:im+4X3lq9TTQuuIs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279770", "to_ids": false, "type": "size-in-bytes", "uuid": "8835fe93-4405-4eee-8780-db2dd6834f1f", "value": "68096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279770", "to_ids": true, "type": "vhash", "uuid": "e67b5638-1e58-40d5-87bb-bf4ada9059ea", "value": "06403f7e7d1bz4!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279770", "to_ids": true, "type": "filename", "uuid": "68913c98-b005-4bb8-8a9b-362eedf1e638", "value": "want.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 30/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279770", "to_ids": false, "type": "text", "uuid": "160981c1-0f23-4253-9d12-7088718fb1b9", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!rfn\nVT Total Detection:61/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502517", "uuid": "536b8089-7a3d-42ac-832a-4caa6dad8b88", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502517", "to_ids": true, "type": "md5", "uuid": "a9254a1a-e403-4060-a169-5ff66cd5724c", "value": "5471d251b16dd1ad99ff16917a6f21ca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280915", "to_ids": true, "type": "sha1", "uuid": "61053212-bf3d-4151-a4fe-a3632ab2c6ad", "value": "5d7a9381e93657bc24205e04f35f7f184bb9d55d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280915", "to_ids": true, "type": "sha256", "uuid": "c1ef3ad5-dbfe-410a-8351-9bd92f013bf0", "value": "1008af117f3f9f5c2d7f634c7c88fdb2af0dc2a8d01be203f0d69897559d3e05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279791", "to_ids": true, "type": "ssdeep", "uuid": "0f721d08-53d4-4c67-b461-e0d9dac00a43", "value": "6144:fqaOOhnKHvfcGEUGA1dbyK4VYBardLTlU/Q7sdOj4HQSY:Ca8HvfzWV6a9+/BQjmi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279791", "to_ids": false, "type": "size-in-bytes", "uuid": "f1f6c4b3-f177-4715-803a-bbe95b90728e", "value": "273270" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279791", "to_ids": true, "type": "vhash", "uuid": "8c4a0590-525d-4e97-8d89-eb053543eee3", "value": "06586a8422b54051ec676032ecd49352" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279791", "to_ids": true, "type": "filename", "uuid": "bf1bd609-3be9-48c8-9f33-5bc9d730e62a", "value": "LOCKBIT-FILE.7z" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 21/06/2022", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279791", "to_ids": false, "type": "text", "uuid": "0c215e49-3137-4acc-bd8c-3a947e6160c5", "value": "Lockbit 2.0\r\nType Description: 7ZIP\nNone\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:40/57" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502538", "uuid": "fc15e4e2-37b5-4215-9bfa-49dbc595723c", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502538", "to_ids": true, "type": "md5", "uuid": "32e06dd4-f6b3-48d4-8edf-a995f2361e93", "value": "de0f761ba8670b0d124b3b6a87de991f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280916", "to_ids": true, "type": "sha1", "uuid": "9ce3b944-f220-4536-9c34-88d9a1574681", "value": "f4689cc030f056305a8582b5d7fe31d1da3a4173", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280916", "to_ids": true, "type": "sha256", "uuid": "bf273f2b-2144-4a9f-9584-c3133a72e16f", "value": "60b5aa993eaef3342252f8cb3f4c9d7c6272ebf2180a27bac8db516af32e8393", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279812", "to_ids": true, "type": "ssdeep", "uuid": "5c50bd29-301c-4e55-804d-fe1fc76b5950", "value": "3072:lVsId2h7+St8WbmKHqmmuiOLb7hv/TFwjlxxXz145x50:fd2sSqImoqfuiObhXKY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279812", "to_ids": false, "type": "size-in-bytes", "uuid": "ae31aa21-79b7-4fe6-8175-8b776d309ac3", "value": "233984" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279812", "to_ids": true, "type": "vhash", "uuid": "f956f960-04a1-4ac6-9426-f19365a5d83b", "value": "025046755d155az57!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279812", "to_ids": true, "type": "filename", "uuid": "92e76426-f1a4-40fa-b580-40c553c815dd", "value": "7d6c.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 01/08/2020", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279812", "to_ids": false, "type": "text", "uuid": "10158368-ea1d-4062-84ad-0cde164ee2df", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Sodinokibi.SK!MSR\nVT Total Detection:58/73" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502560", "uuid": "1a585975-709c-4652-8040-4559b21d9368", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502560", "to_ids": true, "type": "md5", "uuid": "da4e0abe-54d9-4a1c-bac5-d53af3c102d2", "value": "c1ccd4d01158267a6a8af231e58c0fd8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280918", "to_ids": true, "type": "sha1", "uuid": "0615dd48-53df-4557-9ffe-3de4741e296d", "value": "b05ecf6e9df78fcc74ed9c39b63bd20a74942443", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280918", "to_ids": true, "type": "sha256", "uuid": "eb6e0f50-2f60-44e8-ada7-5061b6f3beae", "value": "459e6ff44674568233b2b2fbfd56e1456e5d72147fe919c063b5fc87d8fb3365", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279834", "to_ids": true, "type": "ssdeep", "uuid": "6bb37575-cd1a-4a20-9446-3d897f557347", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279834", "to_ids": false, "type": "size-in-bytes", "uuid": "495b5b86-3c4a-4f7f-8a25-c1e8b7e179a6", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279834", "to_ids": true, "type": "vhash", "uuid": "7078bf90-d26a-4246-9bff-fb4cfe300c2e", "value": "015036656d11e3z12z3b0302231z37z60600165zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279834", "to_ids": true, "type": "filename", "uuid": "501bc751-4a21-4c0c-ad67-6f12ebb0400d", "value": "c1ccd4d01158267a6a8af231e58c0fd8.virus" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/06/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279834", "to_ids": false, "type": "text", "uuid": "30f82821-7626-464d-a2bf-aa077d0778f5", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:55/70" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502582", "uuid": "422d710c-8c9c-4c69-a20b-904c8ce4f20f", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502582", "to_ids": true, "type": "md5", "uuid": "3799eaf3-3641-4bec-8a19-fff4b60ec9fd", "value": "940bdaaaf565a64839aa869ddc4b95ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280919", "to_ids": true, "type": "sha1", "uuid": "c3b4406f-2eda-43f9-85f9-38ab19fcc896", "value": "2e5d02c8ae01a8f66eacdb81a8ff1203dbed3a66", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280919", "to_ids": true, "type": "sha256", "uuid": "0f3b1c6a-c24b-4117-8e20-8c78aaee0dd3", "value": "0bbd59147cf0893d16829d705dcb6bed82487efc77c78fb17c1f2dcffa08875e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279855", "to_ids": true, "type": "ssdeep", "uuid": "357ff214-6103-4e49-97cb-9d8cf8963a83", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279855", "to_ids": false, "type": "size-in-bytes", "uuid": "984801fc-d2fa-4b3a-bc02-190524bd98f0", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279855", "to_ids": true, "type": "vhash", "uuid": "54572d4d-f7eb-45a1-8da8-f51a4f9b57ed", "value": "015036656d51e3z12z3b0302231z37z60600165zb7z" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 04/07/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279855", "to_ids": false, "type": "text", "uuid": "a02b6d4b-6d9f-4c52-8d45-4bfeda63e256", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:67/74" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502604", "uuid": "24c6cf14-e873-4665-803d-d80b06289135", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502604", "to_ids": true, "type": "md5", "uuid": "d67c0a6f-22e7-4a57-a9af-f7f54a688256", "value": "687f47f3e7d60f4644e045d03f0a25e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280921", "to_ids": true, "type": "sha1", "uuid": "9ffd1b01-921c-45f8-acfd-e89f2ebe9542", "value": "7a51ed940986c3dee53eef544058b63ff2a774a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280921", "to_ids": true, "type": "sha256", "uuid": "793224a6-9896-4838-a35e-0b1c8f538056", "value": "a8dfd303f2ff18416ccb88a8156298892689767121206b137a92ece8577e7403", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279876", "to_ids": true, "type": "ssdeep", "uuid": "bf81d4de-b8c2-4f1a-8859-03db6fb6e899", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279876", "to_ids": false, "type": "size-in-bytes", "uuid": "7b46b4b3-a6c3-4114-b82a-af49d9a69c5a", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279876", "to_ids": true, "type": "vhash", "uuid": "05f2a626-f2ea-465f-91ce-f10376033b04", "value": "015036656d11e3z12z3b0302231z37z60600165zb7z" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 28/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279876", "to_ids": false, "type": "text", "uuid": "f2a4f2ff-1b52-4fe1-93dc-2a73bc680195", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:57/68" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502625", "uuid": "96ee2a7e-2277-4e97-8554-5e4d970e8bb8", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502625", "to_ids": true, "type": "md5", "uuid": "1888d7a2-45d3-4e86-8086-68d18a8ce757", "value": "c5ada42d5c2f48db3d4c752405325ddf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280922", "to_ids": true, "type": "sha1", "uuid": "6ef364df-e177-4318-85e2-4ae13e636383", "value": "965991c75771455dd8fe9fba5957b14a3e6163a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280922", "to_ids": true, "type": "sha256", "uuid": "5200ccbd-c9d6-4912-a313-8274130e8c15", "value": "ebe038b29b9f535f975ac7e6c256b7b0597ff93710c2328e8c43a63c750b441d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279898", "to_ids": true, "type": "ssdeep", "uuid": "f43b726f-e054-4fa5-b6fc-f83b19dc6f6e", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279898", "to_ids": false, "type": "size-in-bytes", "uuid": "56f06eca-bc18-44e5-b118-8e0059744d07", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279898", "to_ids": true, "type": "vhash", "uuid": "5252b465-f125-4955-8a15-a92829f591ed", "value": "015036656d51e3z12z3b0302231z37z60600165zb7z" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 27/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279898", "to_ids": false, "type": "text", "uuid": "78dc986f-289a-458e-b2cc-bd7be4c6d7fe", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:56/69" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502647", "uuid": "fc86c92c-9aea-4cf4-8e6d-b7d77820815f", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502647", "to_ids": true, "type": "md5", "uuid": "b1c877d9-5dd7-4a1d-b0fa-8b0e3c65d103", "value": "1786f00209d89b34d2268d95f94ec23f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280924", "to_ids": true, "type": "sha1", "uuid": "90aa9e53-f1d0-4533-94f1-412a5b23c681", "value": "d9af6719496564f11a5eb0468517b69cf7a22aa5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280924", "to_ids": true, "type": "sha256", "uuid": "daa83bae-e3e8-455a-b7b6-e2ceb8b01cc5", "value": "b0ae47c915e7ed46e7badb3ed3888debf505c0a9f0a88e1ee18757df74cecb5f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279919", "to_ids": true, "type": "ssdeep", "uuid": "eef4cb91-d764-4103-9cd7-9d8ba7e52a77", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279919", "to_ids": false, "type": "size-in-bytes", "uuid": "16016316-1024-4f2b-9387-9cacc38ee25a", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279919", "to_ids": true, "type": "vhash", "uuid": "27e7f980-d408-4913-aaf3-456f51ed7a1b", "value": "015036656d11e3z12z3b0302231z37z60600165zb7z" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 25/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279919", "to_ids": false, "type": "text", "uuid": "5d52b48a-b37a-437f-a409-99b4bf10cc2c", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:56/69" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981243", "uuid": "d551c2c2-7564-4f6e-bcab-7eaaf03f62fc", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981243", "to_ids": true, "type": "md5", "uuid": "b84c232f-cdc2-4027-9559-ec6aa413f673", "value": "ebe673b2ee28dd65565f2f389279ac47", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981243", "to_ids": true, "type": "sha1", "uuid": "9079aeb9-bd26-4141-812f-f7dd0be591a6", "value": "bcebe09c61d3e6c47aefcb6bca0882752e0053a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981243", "to_ids": true, "type": "sha256", "uuid": "20d74e59-f080-4e9a-99b5-4da27e7d2dc4", "value": "0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279940", "to_ids": true, "type": "ssdeep", "uuid": "95e4a25e-1238-4d6e-acff-cc0fced626b9", "value": "3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/R:pq/1VP1OyysNmJyXsqqD/ls/R" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279940", "to_ids": false, "type": "size-in-bytes", "uuid": "5aec8404-be17-4b2e-8851-ca814de4c3e6", "value": "154112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279940", "to_ids": true, "type": "vhash", "uuid": "db763cac-1915-4d38-a973-d0f0e2399760", "value": "015036656d1223z12z3e05031f1z37z406001a5zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279940", "to_ids": true, "type": "filename", "uuid": "b9a5a52e-5612-475e-b0c7-4541f6d29f70", "value": "LockBit_3.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 20/09/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279940", "to_ids": false, "type": "text", "uuid": "71f20775-d250-4171-812d-e8f99ce4006c", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:63/73" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502689", "uuid": "967464d9-e946-4bff-b4ec-506eaed74930", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502689", "to_ids": true, "type": "md5", "uuid": "494f4991-cbdd-41af-87ce-0b81a30fbe98", "value": "50bbcedacd191e4ffe0ab8836a10f409", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280927", "to_ids": true, "type": "sha1", "uuid": "76ca518d-2ab7-412d-9b61-f2172e8837b4", "value": "c14474c57c1392c66d1480ecb38ddfb2eeb40c71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280927", "to_ids": true, "type": "sha256", "uuid": "8ebf8fc2-db1b-4968-a43f-3eb4b03240cc", "value": "3dcb5aa76118a5af24c3e01290d2ad0f71adcc21d3e2b337210bbeb97f73881a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279962", "to_ids": true, "type": "ssdeep", "uuid": "3d04b053-2add-410a-a8ed-edbec396455e", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279962", "to_ids": false, "type": "size-in-bytes", "uuid": "11517661-4168-404a-b0fa-b00bd41ff505", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279962", "to_ids": true, "type": "vhash", "uuid": "1643cbcf-b9e0-47f9-889e-91e1bf5ad95c", "value": "015036656d11e3z12z3b0302231z37z60600165zb7z" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 25/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279962", "to_ids": false, "type": "text", "uuid": "924ed70e-fc6b-4f69-ba51-53b7508ef71e", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: None\nVT Total Detection:54/68" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502711", "uuid": "8ff32a9e-befb-41b5-8bc8-4a42a6609023", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502711", "to_ids": true, "type": "md5", "uuid": "78f64000-42d6-4948-823f-cfc88753b87a", "value": "80d408493855a87a932bb47b16a29db5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280928", "to_ids": true, "type": "sha1", "uuid": "de2a2e7f-0ace-4a6b-a7f9-2d77838b933e", "value": "32fa87fe7dceb6189407e4f24176d6af62e45520", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280929", "to_ids": true, "type": "sha256", "uuid": "d5304cbb-c776-48ee-b27c-23fb3b6a5a59", "value": "ade83273f178c3dd5f82c22f42015dcf1aa1a2c961b6e4bf80068b7b5986cc2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740279984", "to_ids": true, "type": "ssdeep", "uuid": "7833dafc-5abf-419c-ba6f-0c269e3be108", "value": "1536:QyUvmpkwvHpza/q+jbQXi4DFViVpXd7yu7Eq9DwJm/AOrrqRXtvwxZbCK9:rUp4za/q+jn4DFUVj7ye9Dom9m34xZek" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740279984", "to_ids": false, "type": "size-in-bytes", "uuid": "6c1c84ed-ff23-4dfb-96d1-61bedb779b7e", "value": "79879" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740279984", "to_ids": true, "type": "vhash", "uuid": "9141d8b1-20c0-4f19-aa52-247159fb376c", "value": "77fbabaf10d86eba2e858b9dd24506e8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740279984", "to_ids": true, "type": "filename", "uuid": "6539c729-0015-4c77-b9ef-c712dcfd8670", "value": "LockBit_14_02_2021_146KB.zip" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 25/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740279984", "to_ids": false, "type": "text", "uuid": "1c3c17bc-31b3-4910-b155-28e92a1653c0", "value": "Lockbit 2.0\r\nType Description: ZIP\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:52/64" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502732", "uuid": "3e3992a2-2e63-45a6-b839-7af913807e67", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502732", "to_ids": true, "type": "md5", "uuid": "6e9e5575-028c-4d73-baaf-023f0d5f8a6b", "value": "508ab0ce0a16c7d215302af82e4c6a58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280930", "to_ids": true, "type": "sha1", "uuid": "bda0433e-227c-489e-a13a-cf73ff5e74a4", "value": "2a6965f50e8761eaa46979bab98d9b94691c4a3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280930", "to_ids": true, "type": "sha256", "uuid": "104d9440-7c77-40e9-8d99-0733dfff4233", "value": "b2b29c358242d49da3c9ef237695e02817b3e5b3fbb75fa94b5762e2a4210f8f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280005", "to_ids": true, "type": "ssdeep", "uuid": "24325f64-cb13-400c-9901-bd59fd98d0a5", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdVF:Ujrc2So1Ff+B3k796X" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280005", "to_ids": false, "type": "size-in-bytes", "uuid": "3223e579-e8a5-4822-8169-c8e388c2032e", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280005", "to_ids": true, "type": "vhash", "uuid": "92ca5ee7-67a6-4bd0-9f54-3cf9e2e735ca", "value": "0950366d651029z47z29z1jz" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/02/2023", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280005", "to_ids": false, "type": "text", "uuid": "59d8ade7-c8b7-471b-a6c3-da9a5897a20d", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.STA\nVT Total Detection:58/70" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502753", "uuid": "e4f5af34-8202-4854-9cc4-d05769cb65c1", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502753", "to_ids": true, "type": "md5", "uuid": "119002a9-b184-4f5c-9d69-a4bf3edd03af", "value": "858c2be3f107cbd7cea4e62a8b399336", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280931", "to_ids": true, "type": "sha1", "uuid": "09da1dea-72fc-49ef-bfce-6fee5b0e3b77", "value": "adf01321f23855546db9b91f3804aaf71e2054e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280931", "to_ids": true, "type": "sha256", "uuid": "cf6c5455-b259-486a-9c56-b6e162cd7b97", "value": "d2ab5785e0dcf9c7657d960b7b7e86f1373408226a95946400f98e5957faf631", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280026", "to_ids": true, "type": "ssdeep", "uuid": "45762beb-8eb0-4307-827a-304bdd88f874", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QRF:dAfSrWW4g+7Ht+UmxJeu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280026", "to_ids": false, "type": "size-in-bytes", "uuid": "cd480e4e-6eb1-4807-9996-b18927c25898", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280026", "to_ids": true, "type": "vhash", "uuid": "5712de79-8552-4747-9725-01e7808eefa1", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280026", "to_ids": true, "type": "filename", "uuid": "afc8a91f-efe5-4327-b0c6-281eb5795767", "value": "LockBIT_E9582C17C5305452.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 19/11/2023", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280026", "to_ids": false, "type": "text", "uuid": "d3a94c44-2dd4-42a6-9532-bb2d059e4f30", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:60/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981243", "uuid": "276a285e-a395-4ac5-b3d4-3f335a715a18", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981243", "to_ids": true, "type": "md5", "uuid": "bd5c6f6e-4c1d-47f8-aa5f-d11b9bfa475f", "value": "49f42f6a81b55cc3d3ea2f971be70e4f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981243", "to_ids": true, "type": "sha1", "uuid": "2807f129-6e1d-48e4-ac61-c165d11fca5f", "value": "835752b69885e2e225998c3355a336c5f7dbfa08", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981243", "to_ids": true, "type": "sha256", "uuid": "4fd4983e-bfbe-4da7-9739-592e6b47d042", "value": "5b9e6d9275e9523aa3945be891745442a07b936ee5236e23934250ba3844f65f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280068", "to_ids": true, "type": "ssdeep", "uuid": "061805e7-9cd0-4069-995f-c0e7bb47da49", "value": "196608:f+gqLKB2p6c05dXYaIAOadsRvEduD9s+83I/2xQTEE+oI:f+jOB2px05poSKWuDdw6vo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280068", "to_ids": false, "type": "size-in-bytes", "uuid": "bbd6dc1b-16c5-455a-b9c3-94da7ed50331", "value": "9267976" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280068", "to_ids": true, "type": "vhash", "uuid": "eb197c32-7d9b-440e-8734-b1e4927ddcbc", "value": "096056651d15156azaf!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280068", "to_ids": true, "type": "filename", "uuid": "a85ca829-ebe4-49f5-bcad-615077fc2acb", "value": "adv.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 28/11/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280068", "to_ids": false, "type": "text", "uuid": "ed209008-eab1-435a-868f-56e53aba8692", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Trojan:Win32/Darkvnc!mclg\nVT Total Detection:50/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502795", "uuid": "1ee0f077-2297-4f43-8982-6ec6a6a4dddf", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502795", "to_ids": true, "type": "md5", "uuid": "5ba0a959-702e-4fe4-bb6f-25afabb15872", "value": "93fc430d98608fc0b0a16f1a96b35459", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280935", "to_ids": true, "type": "sha1", "uuid": "0bd30015-3190-4ba1-a7ad-04a97104df54", "value": "013ae2439799e123c232e328f8a53b96a8b91195", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280935", "to_ids": true, "type": "sha256", "uuid": "0b448010-3770-4023-a353-d8d8236d2dca", "value": "3e3801d5441c63661aca495f3e540ff77c669437924aff64dc340f594fbb185a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280090", "to_ids": true, "type": "ssdeep", "uuid": "016c2a99-9795-4f12-9dbb-1e16a08a9102", "value": "196608:d/ewEByCkhA0Alm2FGZzMng1NOUg5i3stUBq+M6ie:dC8f4Eog1X+QnMe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280090", "to_ids": false, "type": "size-in-bytes", "uuid": "40c961fa-c547-4797-84ab-99ed46a5e0ee", "value": "7846532" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280090", "to_ids": true, "type": "vhash", "uuid": "b169263c-29fc-44f9-9127-4f29486076f4", "value": "a05e5e33a9071b4de92a9e8bdfe7d96f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280090", "to_ids": true, "type": "filename", "uuid": "07a19bc5-68f1-4ea9-8d90-f302665be02e", "value": "Ransomeware - \ubcf5\uc0ac\ubcf8.zip" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/12/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280090", "to_ids": false, "type": "text", "uuid": "b86790a5-aa14-4bbe-b5f4-b1cad1fe1cdf", "value": "Lockbit 2.0\r\nType Description: ZIP\n\nMicrosoft: Trojan:Win32/Darkvnc!mclg\nVT Total Detection:35/62" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502816", "uuid": "9ed3ca05-a5b2-46a9-9e1c-5794bb9db752", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502816", "to_ids": true, "type": "md5", "uuid": "a0292a1c-a491-4dca-a272-9e9418fe3a3a", "value": "0341998514e0d8c8e7f7aef6a2738119", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280936", "to_ids": true, "type": "sha1", "uuid": "28f6ead9-7570-410d-b8c9-bf9f08f05c89", "value": "1cefa6babb99aa7d6706d7cd3241b7439886bbe3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280936", "to_ids": true, "type": "sha256", "uuid": "6f821e3d-7fb1-477e-beb7-cc74589c05d6", "value": "99d781a0e9ac3dfaa7f9958cc62051f47ba116835e75b5d61835ff63afc98571", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280111", "to_ids": true, "type": "ssdeep", "uuid": "59b41f6b-e573-43d2-b9b6-9f7e1da467ff", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdhF:Ujrc2So1Ff+B3k796H" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280111", "to_ids": false, "type": "size-in-bytes", "uuid": "1ee17249-ebeb-48a0-b2aa-e90f90a880f0", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280111", "to_ids": true, "type": "vhash", "uuid": "ab889c2f-fbd3-438c-8f33-db6f81c3f502", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280111", "to_ids": true, "type": "filename", "uuid": "33582b4d-6da9-47ce-9e58-d9bb56c5f49a", "value": "0341998514e0d8c8e7f7aef6a2738119.virus" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280111", "to_ids": false, "type": "text", "uuid": "8e1a2946-bad3-4486-b4e6-09b83f82f890", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:64/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502837", "uuid": "56214b74-17b9-4db3-b411-61c0c67e7066", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502837", "to_ids": true, "type": "md5", "uuid": "3e4e1f0d-b53d-4904-83da-9e8e0d1fd741", "value": "f5fa2b0ac4af6730538304d564ecc9f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280938", "to_ids": true, "type": "sha1", "uuid": "133d82aa-fee6-4da4-bd37-f06acc80b5ea", "value": "f6e91c7ed6ff92c2b5ca077915278b0c0d1cb7b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280938", "to_ids": true, "type": "sha256", "uuid": "29b73ddf-0ad2-407e-a1a8-b4f33061b80a", "value": "e2e140d6d84e377c313006ae8d0848583f74a1ee7aad0fcd758a1888f9b04694", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280132", "to_ids": true, "type": "ssdeep", "uuid": "278d8d7b-ce1d-41e4-810e-a4a9984deff7", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpd2F:Ujrc2So1Ff+B3k796M" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280132", "to_ids": false, "type": "size-in-bytes", "uuid": "9895407d-8271-4880-ac95-e196e1f9dafc", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280132", "to_ids": true, "type": "vhash", "uuid": "9859d870-1987-4fa0-bacc-d653fb8d5c1e", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280132", "to_ids": true, "type": "filename", "uuid": "155be63c-efd8-4f15-bfc4-c09cf6972881", "value": "9D773E.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/02/2023", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280132", "to_ids": false, "type": "text", "uuid": "c260a105-538b-419f-85d8-5aaa36a303a4", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.STA\nVT Total Detection:57/70" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502858", "uuid": "f7e10dfc-60f8-4900-b259-094f50a7a222", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502858", "to_ids": true, "type": "md5", "uuid": "5cb0430f-821c-4b43-9661-4296bb26209e", "value": "022091772db14e763fcceeb462d150d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280939", "to_ids": true, "type": "sha1", "uuid": "37576c49-0477-4021-893a-da38086ffe41", "value": "dcc81069eccf55b6b292fa0b284265c6af4c4e74", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280939", "to_ids": true, "type": "sha256", "uuid": "5dcdb03a-0276-4fc7-8169-50e457a7ce63", "value": "b2f1ec9408272cc125b96a4f3b7c06c23742d69845e9b6a24f7eafad4da72faa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280154", "to_ids": true, "type": "ssdeep", "uuid": "f52da875-76e7-40b4-8e68-8c848e44089b", "value": "24576:PbqIi4vsu1NQ9+aubOj+vCVCdN/4yMdkzkxwccmiF:DqIiW7Qoau174IkxwVD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280154", "to_ids": false, "type": "size-in-bytes", "uuid": "47a3a280-7bc4-46d3-8d38-f9bfda963d36", "value": "992768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280154", "to_ids": true, "type": "vhash", "uuid": "005b6614-5ef7-4007-a47a-65e9016525cb", "value": "0950366d651029z57z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280154", "to_ids": true, "type": "filename", "uuid": "7f75b1b7-8d0d-4e66-b9b7-e35a6b8dad59", "value": "022091772db14e763fcceeb462d150d1.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280154", "to_ids": false, "type": "text", "uuid": "6eec4108-d38a-483a-9664-9199a84d4472", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:64/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502879", "uuid": "bc59d90d-a082-4ced-affb-8da518d9d669", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502879", "to_ids": true, "type": "md5", "uuid": "78a4b024-def9-47d7-b6ab-239b8d85cabc", "value": "d85e8c8a4bc691ea815df62a5785412f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280941", "to_ids": true, "type": "sha1", "uuid": "11a4dfe6-ee28-4338-ac7e-9f22a78550e6", "value": "4c1432e3d6f5af8ad02d37e0f9254d217ec5d2ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280941", "to_ids": true, "type": "sha256", "uuid": "ec86d2ea-c9fd-4f7c-ba48-5806172b2bc1", "value": "e7a81e3c2bd77a237a3b75806197cb18db5cbf06fda246739bb3904ac117d013", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280175", "to_ids": true, "type": "ssdeep", "uuid": "55abbd9b-fd0c-410e-8c9f-f2bc4b13699c", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVjMqqD/yIHVcH:IS9rLPPUpa3VVEtLXcFqqD/fcH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280175", "to_ids": false, "type": "size-in-bytes", "uuid": "1f117f07-de57-4b1f-aaaf-71f891b8fa32", "value": "149504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280175", "to_ids": true, "type": "vhash", "uuid": "069ab4e7-a9c1-4a74-bc04-8e7bb260181c", "value": "015036655d51e3z12z3b0302231z37z60600165zb7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280175", "to_ids": true, "type": "filename", "uuid": "fea2e13c-9da8-4301-b3ec-a1adb7b7f4a0", "value": "executable.1888.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 16/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280175", "to_ids": false, "type": "text", "uuid": "532d6102-3267-46e0-8aa2-a7b128d9df74", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:52/69" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502900", "uuid": "45f9b0b6-3723-4d63-8f6a-853693bc7f38", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502900", "to_ids": true, "type": "md5", "uuid": "217ede2d-31e9-4acd-8481-7a276fd02f0f", "value": "331eab9d29ecae0f1fe0d8ec835ab426", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280942", "to_ids": true, "type": "sha1", "uuid": "4042a0ef-74b7-45aa-bb9c-a49219295a4c", "value": "d97e295ad1be1ede6cb6a5c778e6fdc7f9efc1fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280942", "to_ids": true, "type": "sha256", "uuid": "147118be-dfb4-41e4-80d7-7dec71e3eece", "value": "e15903faaad61d6d6499148c596d8051a51c80973cc1190336769b84a1eca1c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280196", "to_ids": true, "type": "ssdeep", "uuid": "c3dfd07c-f467-488e-96da-7146032821d1", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdnF:Ujrc2So1Ff+B3k796x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280196", "to_ids": false, "type": "size-in-bytes", "uuid": "90c9db4c-7212-485e-96d2-f4389e161338", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280196", "to_ids": true, "type": "vhash", "uuid": "8f96c4c2-1b4b-4be5-b0ec-80cc91bd17ba", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280196", "to_ids": true, "type": "filename", "uuid": "85446eb3-a354-4bf3-8fc7-12f7cd9cf9dd", "value": "331eab9d29ecae0f1fe0d8ec835ab426.virus" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/02/2023", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280196", "to_ids": false, "type": "text", "uuid": "5c520614-bab4-4102-93d3-f02dc5b2ffd3", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.STA\nVT Total Detection:59/70" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502922", "uuid": "7de0a536-200a-4236-b872-f306b0e96ebb", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502922", "to_ids": true, "type": "md5", "uuid": "47914b7d-d6d0-44bd-a5ef-ad7dad4ec33f", "value": "9dccc012908b030b3fe7c21173442eae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280943", "to_ids": true, "type": "sha1", "uuid": "84001a54-cb74-4797-b13d-c05043b26975", "value": "d6d09f593aba3a7d6db84260e539dc05ac79fb25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280944", "to_ids": true, "type": "sha256", "uuid": "70fd461d-cea8-4070-a642-88fc6fefac85", "value": "743ecc953dcd83a48140c82d8a7dcac1af28e0839aed16628ddfc9454bec8dfa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280217", "to_ids": true, "type": "ssdeep", "uuid": "0467489c-4c4b-457a-b722-0fedef70e9ff", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdbF:Ujrc2So1Ff+B3k796p" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280217", "to_ids": false, "type": "size-in-bytes", "uuid": "7a71658a-2a1e-4bcd-b45f-87ad109d1f61", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280217", "to_ids": true, "type": "vhash", "uuid": "7d307986-8015-49b3-9c4e-7c8776579e1c", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280217", "to_ids": true, "type": "filename", "uuid": "9fd198d1-436b-4ef0-8699-488da7699c92", "value": "Lockbit.ransom" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280217", "to_ids": false, "type": "text", "uuid": "fdbdc9be-d9e8-4528-be33-a2c53460c5ce", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:67/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502943", "uuid": "f062528f-d12b-47d4-a3f4-753c5f5c7296", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502943", "to_ids": true, "type": "md5", "uuid": "8a7278e1-8797-4451-9007-3593ee8bcec3", "value": "9671babf2f07330a1a519764ef26d144", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280945", "to_ids": true, "type": "sha1", "uuid": "cf487a44-cfe5-4a5c-a3c5-24cd4521ddd5", "value": "6ceae037595f858f51f67ed76dd8bcfd0b1b0fb8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280945", "to_ids": true, "type": "sha256", "uuid": "60c88f57-6b4e-4f40-9d99-22bc37222da0", "value": "626a4fa1f52623e89b3011c37c2d3ca4069dc5a4d3f5c4f74d4579c2d3d50356", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280239", "to_ids": true, "type": "ssdeep", "uuid": "bad70b85-413b-4ebc-9893-7db8ccc178f7", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdTF:Ujrc2So1Ff+B3k796l" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280239", "to_ids": false, "type": "size-in-bytes", "uuid": "89b824e5-de51-4d9b-ae0b-acd19bb8101c", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280239", "to_ids": true, "type": "vhash", "uuid": "e3a5b4aa-6386-456c-bf07-ece94992417b", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280239", "to_ids": true, "type": "filename", "uuid": "ee03e4a5-187b-48ef-a34a-afaf7531621f", "value": "147-982528_9671babf2f07330a1a519764ef26d144.ex$" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280239", "to_ids": false, "type": "text", "uuid": "2fcf3e40-344e-4cb2-9955-7c78194b36ba", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:65/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502964", "uuid": "b79224b2-5f3b-4922-9e7c-c22b7bcb3916", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502964", "to_ids": true, "type": "md5", "uuid": "cfc59db6-cbcc-49d7-bab1-a01a8e4c5154", "value": "8d3c2f8033a0a8a43c79ba8a12acb1d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280946", "to_ids": true, "type": "sha1", "uuid": "753db091-f12f-429b-9e33-7658acf2f2af", "value": "4dc0079e940b91b944aa143409d0ba2103148864", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280946", "to_ids": true, "type": "sha256", "uuid": "df6ac95f-6d04-4b0f-a8e2-99d8a9c758e9", "value": "8013232fb7c254269c1029f91a915b80ed7ded53043d239a4be9a0b1fe37fa2c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280260", "to_ids": true, "type": "ssdeep", "uuid": "c7de4e79-2de1-4251-8af2-066cf3e99e19", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdXF:Ujrc2So1Ff+B3k796V" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280260", "to_ids": false, "type": "size-in-bytes", "uuid": "ed9c8bab-0f7e-49cb-95f4-4e5aca3f2761", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280260", "to_ids": true, "type": "vhash", "uuid": "a51e7465-4288-43d8-bdcb-5ea318f1f3c3", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280260", "to_ids": true, "type": "filename", "uuid": "9ce612a9-8813-4a9d-8052-9906e43444de", "value": "LockBit_2C89224968B61A2D.bin" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280260", "to_ids": false, "type": "text", "uuid": "69bc7e26-3ec5-48c3-8903-d8dc8d323b21", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:66/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747502985", "uuid": "02bc290f-8a9f-4525-8493-346650d5954a", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747502985", "to_ids": true, "type": "md5", "uuid": "84594a3c-1906-4a3c-b480-5e0d25ba76dc", "value": "1c399f3867c8ac37005c1c7ec92b1f64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280948", "to_ids": true, "type": "sha1", "uuid": "68d398cb-1d79-4182-8083-8347df58ac59", "value": "676c795e870b0f34af1e83c256e6523ddf6714aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280948", "to_ids": true, "type": "sha256", "uuid": "3622a29b-e73f-40de-86bd-098af2e778a7", "value": "953bdc65d1d3316ffb2761da09a3b8587228bd40095d72eae95fc373488732cc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280281", "to_ids": true, "type": "ssdeep", "uuid": "a029caf0-9486-4c9f-86bf-4c2b14b1d4d7", "value": "12288:oFEs8rU7XP2vNSyRnlU1AZCsD5oZxCnmnoKUkHP2rI4ui+:WH8rU7f2vfRna1AZ5D54CnmoTkvuK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280281", "to_ids": false, "type": "size-in-bytes", "uuid": "07cdf4d9-784f-4d7d-bae8-8b4b0bb69ecd", "value": "625200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280281", "to_ids": true, "type": "vhash", "uuid": "a2560ad0-05d3-41e2-8ff9-8a8347fef690", "value": "b0ba4603cf03195696f9b3822e7edec3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280281", "to_ids": true, "type": "filename", "uuid": "f272d3bc-c60e-4699-a66b-0605f74e3ad1", "value": "lockbit.zip" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 18/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280281", "to_ids": false, "type": "text", "uuid": "f6c3b4b3-9fdd-4007-a268-ebdbcc50a1af", "value": "Lockbit 2.0\r\nType Description: ZIP\n\nMicrosoft: Ransom:Win32/LockBit.SK!MTB\nVT Total Detection:50/65" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503006", "uuid": "7014103b-8796-45d6-a15c-9481ffc8bec8", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503006", "to_ids": true, "type": "md5", "uuid": "c941f07c-8c8f-448d-b3a6-fb04fad0aec6", "value": "345e9386165de4a718b9a8ae8b206e29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280949", "to_ids": true, "type": "sha1", "uuid": "52d21a72-4d06-4885-a13f-6a963d880946", "value": "4d94d55519493b9944d3659ee46e9e9a042adcbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280949", "to_ids": true, "type": "sha256", "uuid": "2c413a9e-2f98-4afc-b74c-be0e7a08f0b7", "value": "e82315985f8eab415f6fabab7f805f0a76db6ca58b851070c946142f0ba29cbd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280303", "to_ids": true, "type": "ssdeep", "uuid": "605609c5-63c7-401e-80f2-fb8281b524a3", "value": "1536:LgJXcr55etere400PECzO5LK/Wo8hxpEos2lV7gUw7FzKEU+vArN3Y2KP8x:gs952erk09zOxKMhX9s2QUw7BQy2g8x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280303", "to_ids": false, "type": "size-in-bytes", "uuid": "9dc700b8-3080-483f-9b95-cd8ad2d86193", "value": "79517" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280303", "to_ids": true, "type": "vhash", "uuid": "8a3eae66-8e61-4928-8bed-9246e4e83239", "value": "6880bb731660f4017cf7c3957ac1c22b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280303", "to_ids": true, "type": "filename", "uuid": "9c9bd4e6-7435-4703-88ea-2a938f6ddecb", "value": "Lockbit.zip" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 13/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280303", "to_ids": false, "type": "text", "uuid": "5632d4d9-7479-4c30-b29d-a38429d1d39e", "value": "Lockbit 2.0\r\nType Description: ZIP\n\nMicrosoft: Ransom:Win32/Lockbit.SA!MSR\nVT Total Detection:50/65" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503029", "uuid": "6dbe744c-4271-4e78-b28e-3b6b9053028b", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503029", "to_ids": true, "type": "md5", "uuid": "b4a317b0-4a31-4acb-bce2-acebaa33ccd7", "value": "ea3433b844ee10e71b84d2b9038b46ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280950", "to_ids": true, "type": "sha1", "uuid": "7455fbdc-9718-480f-b47d-2e9bcce92bf0", "value": "6dfd524ca390a05d6c8a653c0594179409c5ef45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280951", "to_ids": true, "type": "sha256", "uuid": "1501c952-48b6-4961-9d63-fec906dc4585", "value": "fab378dbd88af235421174b73ad06d1e5f2c614c70b9bab318602f51da544d5e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280324", "to_ids": true, "type": "ssdeep", "uuid": "90f2d929-a5bf-498e-8c74-c5cf3acdfe49", "value": "98304:dU1AXEwL4JFTVlNrcXRGfetQvAJ8qsO+G+:dU84XTjNrcXRGfCJwrG+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280324", "to_ids": false, "type": "size-in-bytes", "uuid": "64bacd7d-d571-4e5c-aeab-ce4c8a7cf81d", "value": "3577380" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280324", "to_ids": true, "type": "vhash", "uuid": "9ec370f2-aa2e-4d54-b787-9ca9f7e76ec3", "value": "ef12c167a3b1949c7efdba6fbe6bf09c" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 12/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280324", "to_ids": false, "type": "text", "uuid": "73299c46-6241-4808-ba51-d6da6c1f0466", "value": "Lockbit 2.0\r\nType Description: ZIP\n\nMicrosoft: Ransom:Win32/Lockbit.SB\nVT Total Detection:45/65" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503051", "uuid": "4ba1e631-c35d-4d82-a668-f5592ecdd941", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503051", "to_ids": true, "type": "md5", "uuid": "e8c7302c-75f7-4cb1-8c1d-00a5485bb73a", "value": "c083e019e1fa79d5095dca37165a1346", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280952", "to_ids": true, "type": "sha1", "uuid": "5040dd76-75c9-455c-a54a-34403f95624c", "value": "831f0e1dd2c9a00a305f45d2b1eb2a4fbef660bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280952", "to_ids": true, "type": "sha256", "uuid": "2040b87c-4143-4c87-8e60-b0c785cc06a0", "value": "a7591e4a248c04547579f014c94d7d30aa16a01bb2a25b77df36e30a198df108", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280387", "to_ids": true, "type": "ssdeep", "uuid": "837e1cc0-fd3c-40b2-954c-c3beec395a91", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpd9F:Ujrc2So1Ff+B3k796f" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280387", "to_ids": false, "type": "size-in-bytes", "uuid": "55e3eadb-8a4f-4917-a064-5ac6cefa2982", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280387", "to_ids": true, "type": "vhash", "uuid": "524d95e0-2dd9-43b2-88c4-ebba3ad439a2", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280387", "to_ids": true, "type": "filename", "uuid": "a79fb3f4-a1e0-42ff-b506-624d96db95ae", "value": "io.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280387", "to_ids": false, "type": "text", "uuid": "8a05347d-b479-4e0d-b24d-44791c715bf2", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:67/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981243", "uuid": "bdfc775f-391c-4abd-8f87-2842c360d35a", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981243", "to_ids": true, "type": "md5", "uuid": "761d711b-909f-4616-b2bd-dd252dbc99c0", "value": "92429807c7d957566d1897d5bf7c6639", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981243", "to_ids": true, "type": "sha1", "uuid": "f6ff635c-3a54-4741-b5da-364254c3f65b", "value": "d1dce09219c0df46742fa0eec6f7a6b72ca877f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981243", "to_ids": true, "type": "sha256", "uuid": "dfa86a63-4128-4a6b-b2ae-fd95cd65b02e", "value": "98900768d564c6962981edde2759889fdda11bb1113c851468e5c40ddafe1d4d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280408", "to_ids": true, "type": "ssdeep", "uuid": "1c0f5af0-f1a5-4247-a1ee-9544c51c1170", "value": "49152:rjrc2So1Ff+B3k79nfIVGQ41P9x9tHpYZYp+:rjrcSmQ9Njx9tHi5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280408", "to_ids": false, "type": "size-in-bytes", "uuid": "61dec3f4-7039-490f-aca9-2d51ff383ef2", "value": "1845248" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280408", "to_ids": true, "type": "vhash", "uuid": "83cae5a7-2976-456d-8af4-040a5de4b3d7", "value": "0160466d65177029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280408", "to_ids": true, "type": "filename", "uuid": "10812b86-806a-4f2c-b5a2-9cd3892a5b82", "value": "98900768d564c6962981edde2759889fdda11bb1113c851468e5c40ddafe1d4d.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280408", "to_ids": false, "type": "text", "uuid": "d56d0bcf-b68b-44e3-966c-5f10c3976dd6", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.STA\nVT Total Detection:61/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503095", "uuid": "984327e9-3649-43bc-96d4-b723b3864650", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503095", "to_ids": true, "type": "md5", "uuid": "205487a6-576a-45f7-9b73-3f63c0db6942", "value": "18cea7c5ab3ffb0146bad18ea79b6745", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280956", "to_ids": true, "type": "sha1", "uuid": "99878728-a429-4050-ac86-97559e4139c9", "value": "08cf96e2bc9509163da4e7c3fdffd9ade068ff66", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280956", "to_ids": true, "type": "sha256", "uuid": "d2690ef1-162f-4cc1-b6b5-be50d5c4c7fc", "value": "6d26226f99724c18faf355a4e07b74bad72f5837e0de8c8361f7d9a18525b5ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280429", "to_ids": true, "type": "ssdeep", "uuid": "f1c28f4a-4121-4d76-a27a-a705c4d9c708", "value": "98304:0jrcS5Q99S9RxlDaBDwgrg/rozMMYUvCyBSa99fbPG3kpnmAAmm0JTkj:CQc9RvDkwGgkYiFbfbHDm0JTc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280429", "to_ids": false, "type": "size-in-bytes", "uuid": "0113e4e8-ada6-4fd3-b6ea-d76a381f2fea", "value": "4487680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280429", "to_ids": true, "type": "vhash", "uuid": "217dc208-9925-439c-a8fa-cc8fb9710924", "value": "0460566d6567777019z17z19z11z2fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280429", "to_ids": true, "type": "filename", "uuid": "af06ef41-1204-41fb-b392-b08647b7aba5", "value": "18cea7c5ab3ffb0146bad18ea79b6745.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 03/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280429", "to_ids": false, "type": "text", "uuid": "01bdec83-c4c5-458e-b148-dbbd78c2b6e0", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:62/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503116", "uuid": "f6af6454-5aea-4060-a7af-06767d49d7ef", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503116", "to_ids": true, "type": "md5", "uuid": "3dc47d77-e5da-42b3-a013-d1160ae8b21d", "value": "84a0cdd9e78e46ccdd84eb0dc9de6928", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280957", "to_ids": true, "type": "sha1", "uuid": "c111a710-fa01-412e-b863-42dfb52ee1ec", "value": "6304e554add105ce7a066b041e4b68f42dc19acb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280957", "to_ids": true, "type": "sha256", "uuid": "d949ff89-e8d8-4f1b-8f28-a7d2a3e29326", "value": "5f99cdba09aa3e03e531fc34bc5fcee96f61ec0b83b575911d79573da7109906", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280451", "to_ids": true, "type": "ssdeep", "uuid": "259ce169-2a8e-4138-ada0-445dc6d19393", "value": "98304:pUcN3Jy9t3VBR7zkDARd3RO/FTwv/Er5BolWPdFntusZ:hs9t3ndKmReFEv8rD8WPTtusZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280451", "to_ids": false, "type": "size-in-bytes", "uuid": "d27f4aa2-c5c5-4832-a22e-856384773549", "value": "5564928" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280451", "to_ids": true, "type": "vhash", "uuid": "935cca98-21e0-4d0f-a6be-beb717cd052c", "value": "0560560d0507077019z17z19z11z1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280451", "to_ids": true, "type": "filename", "uuid": "51518a29-50a4-4d5e-9371-2729e24c9aa0", "value": "LockBit.vmp.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 04/08/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280451", "to_ids": false, "type": "text", "uuid": "0536769e-a5a3-45e5-b140-276f2971e626", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SB\nVT Total Detection:47/70" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503139", "uuid": "87a4d0a3-86e3-42de-9e27-785a75297d4f", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503139", "to_ids": true, "type": "md5", "uuid": "c404083d-f4c2-4447-afb3-0f29fa6a1426", "value": "231c75a33f047ee2dd5d5330e26efe22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280958", "to_ids": true, "type": "sha1", "uuid": "4a54c5c2-9bb9-49d0-ab1b-f327108bc139", "value": "873f162c7e3758ac3a77ff7fdc26887fd93c86b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280958", "to_ids": true, "type": "sha256", "uuid": "0a70f2c1-b3be-4d3c-ae5c-d30e189e1a9d", "value": "cd2287122277237a9c507ce9ba5f114ddd48faa1b3f87b33ed1a8b19f65c8a14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280472", "to_ids": true, "type": "ssdeep", "uuid": "9673ff78-5ed1-4855-b8b5-3224a5e7417c", "value": "24576:uqyLSCnD4A3y6tfIYY+D4LL6F+RXVxjSJjQV5ewHIdPiZ+d+nKXt5zkwagcw/TRh:sZ3xIL4GXVVSc5vea+d+ncwwadw/d0x4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280472", "to_ids": false, "type": "size-in-bytes", "uuid": "78634e25-87ad-4458-8687-5bf545ce5fb2", "value": "1491456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280472", "to_ids": true, "type": "vhash", "uuid": "fb1593ef-6ef7-40ab-b779-1dd33149e6a0", "value": "01605f7f7f0f7f7015z11z47z1015z1011z101dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280472", "to_ids": true, "type": "filename", "uuid": "1b3f39b6-14c4-4613-b59d-aed86ab84eee", "value": "LockBit_2.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/12/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280472", "to_ids": false, "type": "text", "uuid": "af203e02-f362-401b-bc56-353affe1751c", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SB\nVT Total Detection:49/69" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503160", "uuid": "7a349f5a-df80-490d-aa1e-37ec810cea6b", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503160", "to_ids": true, "type": "md5", "uuid": "e8df675f-b68f-4033-a786-83959d0222cf", "value": "5a86190f45987701b35a2c69d6c17e24", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280960", "to_ids": true, "type": "sha1", "uuid": "4be5aca2-a81a-471b-9071-e5dc121d76d2", "value": "3081142347c0abefb872de203ecf3f46daab5df1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280960", "to_ids": true, "type": "sha256", "uuid": "c85d1e5b-4012-4dc9-90a0-ac69c05ed2e9", "value": "93b0c6576c73b48dcb47f6572a31defc1304fd3c4464d50592195fa64edbcafe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280493", "to_ids": true, "type": "ssdeep", "uuid": "e5fd69e0-cc9f-4d5a-a14e-064d4af4c3ea", "value": "24576:5Jjv5Ne16L3YA8IonuffXiEvh/zf17pGt9yX1fVezNkTCnHJzX17HqwGf+mYLuYc:5JFNe88A8af7z97pS9yX1fMZnHb7H9GF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280493", "to_ids": false, "type": "size-in-bytes", "uuid": "a62a895a-94a1-4b4c-8fe1-1e4e185bdd21", "value": "1499136" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280493", "to_ids": true, "type": "vhash", "uuid": "ab04aa09-6f95-4ee4-bfcd-1132b058df70", "value": "01605f7f7f0f7f7015z11z47z1015z1011z101dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280493", "to_ids": true, "type": "filename", "uuid": "72f81c82-518b-4779-8df7-d42aba5bc83b", "value": "LockBit_1.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/12/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280493", "to_ids": false, "type": "text", "uuid": "f5ad10dc-9eb7-4701-9b11-2d75c4bc3b03", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SB\nVT Total Detection:48/69" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503181", "uuid": "b18205c5-df64-45a8-b87c-9450057eba2f", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503181", "to_ids": true, "type": "md5", "uuid": "ca542e14-5da2-42ad-a6d4-8ea8c352597c", "value": "2b5dc59b959884fed9372eccce13fc4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280961", "to_ids": true, "type": "sha1", "uuid": "9235d98e-658a-418e-b6fc-4254f80f6917", "value": "744ab2e8b103949743331cd49451bbc5191ae062", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280961", "to_ids": true, "type": "sha256", "uuid": "184e779d-280d-4b7f-85a2-c1c8a61f92db", "value": "34e6f4317e223d712a9464cd2e6ba9e6d7915eac75a8c06648813ea1d7a80b80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280515", "to_ids": true, "type": "ssdeep", "uuid": "52449a0b-99cb-495f-b13f-4c2e296f3dc3", "value": "98304:AjrcS4Q9CK2u/3hP6w+KOAIMRefWsTbEZSnMc8Wsm+6pVmlR4b+uE:3QvZyw+VAIMrsTbyeMTBmzVaRAE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280515", "to_ids": false, "type": "size-in-bytes", "uuid": "a6f7fb6e-33fa-45fc-ad7b-26e5ca2fa1c2", "value": "6240768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280515", "to_ids": true, "type": "vhash", "uuid": "d94b7ce4-5bab-46e8-9ea1-bd1368b03fd2", "value": "0660566d6567777019z17z19z11z1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280515", "to_ids": true, "type": "filename", "uuid": "aa34e09e-71d6-462f-98c8-4a5c8c9d8594", "value": "2b5dc59b959884fed9372eccce13fc4c.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 03/02/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280515", "to_ids": false, "type": "text", "uuid": "5084df49-d3ff-4c16-a3eb-3380bd6e885e", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:62/71" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747981243", "uuid": "fdf510dd-09f4-4524-9275-f63f48a13779", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747981243", "to_ids": true, "type": "md5", "uuid": "cd587e99-0fbc-4d3f-bf24-138e2315018c", "value": "b1e63b65c06cc8f4f72ce75ff6f03c0a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1747981243", "to_ids": true, "type": "sha1", "uuid": "6bbcc29d-5153-4e23-8519-e65f557b2c83", "value": "a4d2ba64380f76558b4e11ad32feafd98b6f5481", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1747981243", "to_ids": true, "type": "sha256", "uuid": "d8c119be-b87e-4461-98d3-d0721dfe8f60", "value": "36446a57a54aba2517efca37eedd77c89dfc06e056369eac32397e8679660ff7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280536", "to_ids": true, "type": "ssdeep", "uuid": "4a12f014-5d90-449a-8ae0-0629ff05b9c1", "value": "98304:MjrcS7Q98LdhwteMy3DJB0M9sOsuXGY3B0NF:wQmYNMDES2Y3B0NF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280536", "to_ids": false, "type": "size-in-bytes", "uuid": "825094d0-8f59-4e48-a12f-20155c00a92e", "value": "4487168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280536", "to_ids": true, "type": "vhash", "uuid": "cd3c2b10-2893-4e2c-8920-9bf5ff404101", "value": "0460566d6567777019z17z19z11z2fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280536", "to_ids": true, "type": "filename", "uuid": "9142f5c9-dd9f-458e-b635-3d0beda0b7aa", "value": "b1e63b65c06cc8f4f72ce75ff6f03c0a.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280536", "to_ids": false, "type": "text", "uuid": "bb50108b-ece7-496c-84af-98f2f938b604", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:67/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503224", "uuid": "835b13df-007a-4a67-b5aa-11af3a8ee48f", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503224", "to_ids": true, "type": "md5", "uuid": "471f0f94-1f6f-4b2c-857d-c02b756bca19", "value": "d49522c0751a8f45957e3757812ca905", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280965", "to_ids": true, "type": "sha1", "uuid": "8bc30773-0653-4331-9e56-fc8610a33356", "value": "3c322fe33b3f2b5d946750d20021efb7fdf73e4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280965", "to_ids": true, "type": "sha256", "uuid": "eb2dbd3c-23f5-4285-891f-d24514bf2747", "value": "f17ca8f7527669a35eee12edb7050a81ef91e3f0ea7b3935ddf554a6f731e374", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280557", "to_ids": true, "type": "ssdeep", "uuid": "03f237f3-b65f-4831-a545-0dc2e4a0a215", "value": "24576:+IUPQ7+k4PSttSLA2pdyImRfRem4XP+J1933YALMJfhe0fqRSXbISf/KuBZMnW2:mqD8yXRfkm4XPqD3YkqcKqs3aGZL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280557", "to_ids": false, "type": "size-in-bytes", "uuid": "bd2a74b6-5d31-4d4b-9b38-80115dd97298", "value": "1496064" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280557", "to_ids": true, "type": "vhash", "uuid": "cf33e7d1-4ed1-4246-a832-ffd5494a2fc8", "value": "01605f7f7f0f7f7015z11z47z1015z1011z101dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280557", "to_ids": true, "type": "filename", "uuid": "a60fa598-6a7f-4450-81d6-1e4778823361", "value": "LockBit_3.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 23/12/2021", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280557", "to_ids": false, "type": "text", "uuid": "c1a816c4-ee19-4f11-98da-cdb00e8f993c", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.SB\nVT Total Detection:49/68" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503245", "uuid": "eacb57fa-3496-40b5-a0e1-44910dbf61ee", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503245", "to_ids": true, "type": "md5", "uuid": "081e9e73-c539-4c75-8d47-734180d210bf", "value": "c9a478c4a5b1b945cd49c1ee077a4956", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280966", "to_ids": true, "type": "sha1", "uuid": "897b5f9b-eef1-4a31-8ac1-f565baabe348", "value": "78c33f3da3b7dfde7fe054f4e41940d282be25dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280966", "to_ids": true, "type": "sha256", "uuid": "5a49883e-2f35-42e3-b06d-b155bacf8072", "value": "4edbf2358a9820e030136dc76126c20cc38159df0d8d7b13d30b1c9351e8b277", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280579", "to_ids": true, "type": "ssdeep", "uuid": "6cdd5044-1529-42c6-b1d7-425607b7d367", "value": "24576:PbqIi4vsu1NQ9+aubOj+vCVCdN/4yMdkzkxwccmCF:DqIiW7Qoau174IkxwVP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280579", "to_ids": false, "type": "size-in-bytes", "uuid": "e9995487-fa0d-47e1-99be-4ba48263f953", "value": "992768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280579", "to_ids": true, "type": "vhash", "uuid": "3a11a6b6-8892-4d27-8125-9d4af0b6d213", "value": "0950366d651029z57z29z1jz" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/07/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280579", "to_ids": false, "type": "text", "uuid": "7d24d5ff-cc3c-4069-bbec-50755025deaf", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit!pz\nVT Total Detection:66/74" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503266", "uuid": "626ca857-4a5b-4dc2-b9ee-3a97d2067ebf", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503266", "to_ids": true, "type": "md5", "uuid": "47d57f37-11ac-4d58-86c3-02117235b783", "value": "7e68772dd303cee3c3becd653a34452c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280967", "to_ids": true, "type": "sha1", "uuid": "391a6d2a-4a75-43db-a17d-6439f7cbb486", "value": "7ff3a79a251af1ebaeca7a34172968c2aae53d1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280968", "to_ids": true, "type": "sha256", "uuid": "963a04a6-b28f-4d09-9108-30c70a81ee3a", "value": "0906a0b27f59b6db2a2451a0e0aabf292818e32ddd5404d08bf49c601a466744", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280600", "to_ids": true, "type": "ssdeep", "uuid": "4d795149-16a2-4fb7-a9b7-4e0f4c13eabc", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QPF:dAfSrWW4g+7Ht+UmxJe4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280600", "to_ids": false, "type": "size-in-bytes", "uuid": "0fce6c93-ced6-4236-947c-29b5c13c3372", "value": "883200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280600", "to_ids": true, "type": "vhash", "uuid": "1d530680-6fb0-429e-85cf-fa7ca58f2319", "value": "0850266d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280600", "to_ids": true, "type": "filename", "uuid": "eccf06c6-a3d9-44a7-a1c0-44f4f2fcffc5", "value": "0906a0b27f59b6db2a2451a0e0aabf292818e32ddd5404d08bf49c601a466744.sample" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280600", "to_ids": false, "type": "text", "uuid": "365fb161-c816-437c-b90b-2b6e559df1bc", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/LockBit.SA\nVT Total Detection:64/72" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1747503287", "uuid": "5cadb879-bb29-4d02-92b4-318a3795d833", "Attribute": [ { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1747503287", "to_ids": true, "type": "md5", "uuid": "d98d5ad3-c4dd-47f1-8122-61f03dac0d6c", "value": "02ad715191b64a46120e38ca6cb1ef6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1740280968", "to_ids": true, "type": "sha1", "uuid": "dd2a1751-449b-4519-ab58-842196bdff2f", "value": "cfd8d84b1013e5cf88878ca36021272ee0231504", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Lockbit 2.0", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1740280968", "to_ids": true, "type": "sha256", "uuid": "1cc8e8a3-1459-41f5-b50a-28470a856ffd", "value": "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1740280621", "to_ids": true, "type": "ssdeep", "uuid": "229730dc-6351-477f-9074-49cefca491a4", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpd3F:Ujrc2So1Ff+B3k796x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1740280621", "to_ids": false, "type": "size-in-bytes", "uuid": "fc940902-d331-4136-a4fe-54454f449eb2", "value": "982528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1740280621", "to_ids": true, "type": "vhash", "uuid": "4a74d93e-e490-4795-a91f-cdc0276e88b3", "value": "0950366d651029z47z29z1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1740280621", "to_ids": true, "type": "filename", "uuid": "f3264d5d-14b7-4c0d-ac93-cdb9c6a4f41c", "value": "LockBit_6.exe" }, { "category": "Other", "comment": "Checked: 23/02/2025\nLast-scan\t: 09/01/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1740280621", "to_ids": false, "type": "text", "uuid": "603fe83c-5d4e-4edd-9d1e-eb6694394cc0", "value": "Lockbit 2.0\r\nType Description: Win32 EXE\n\nMicrosoft: Ransom:Win32/Lockbit.AA!MTB\nVT Total Detection:67/72" } ] } ] } }