{ "Event": { "analysis": "1", "date": "2026-02-12", "extends_uuid": "", "info": "[Threat Intel] LockBit strikes with new 5.0 version, targeting Windows, Linux and ESXI systems", "protected": false, "publish_timestamp": "1780042183", "published": true, "threat_level_id": "2", "timestamp": "1780042183", "uuid": "db240f3d-7cc8-4a58-9b99-69e778ab7a5d", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#b2a633", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#2d0c2f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable Windows Event Logging - T1562.002\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#40bedd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Permissions Modification - T1222\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution Guardrails - T1480\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"lockbit5\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SmokeLoader\"", "relationship_type": "" }, { "colour": "#2afb09", "local": false, "name": "misp-galaxy:target-information=\"Argentina\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Bolivia\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#52d590", "local": false, "name": "misp-galaxy:target-information=\"China\"", "relationship_type": "" }, { "colour": "#74d147", "local": false, "name": "misp-galaxy:target-information=\"Czech Republic\"", "relationship_type": "" }, { "colour": "#78cd12", "local": false, "name": "misp-galaxy:target-information=\"Egypt\"", "relationship_type": "" }, { "colour": "#a3567e", "local": false, "name": "misp-galaxy:target-information=\"Estonia\"", "relationship_type": "" }, { "colour": "#15ccfd", "local": false, "name": "misp-galaxy:target-information=\"France\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#4e41fc", "local": false, "name": "misp-galaxy:target-information=\"Ireland\"", "relationship_type": "" }, { "colour": "#4cea11", "local": false, "name": "misp-galaxy:target-information=\"Italy\"", "relationship_type": "" }, { "colour": "#841801", "local": false, "name": "misp-galaxy:target-information=\"Kuwait\"", "relationship_type": "" }, { "colour": "#915448", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#d52b43", "local": false, "name": "misp-galaxy:target-information=\"Mexico\"", "relationship_type": "" }, { "colour": "#7dbb86", "local": false, "name": "misp-galaxy:target-information=\"Singapore\"", "relationship_type": "" }, { "colour": "#35a578", "local": false, "name": "misp-galaxy:target-information=\"South Africa\"", "relationship_type": "" }, { "colour": "#f439e5", "local": false, "name": "misp-galaxy:target-information=\"Spain\"", "relationship_type": "" }, { "colour": "#33360c", "local": false, "name": "misp-galaxy:target-information=\"Thailand\"", "relationship_type": "" }, { "colour": "#ce98fe", "local": false, "name": "misp-galaxy:target-information=\"Turkey\"", "relationship_type": "" }, { "colour": "#a24b57", "local": false, "name": "misp-galaxy:target-information=\"United Arab Emirates\"", "relationship_type": "" }, { "colour": "#ce59f1", "local": false, "name": "misp-galaxy:target-information=\"United Kingdom\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": "" }, { "colour": "#7f009f", "local": false, "name": "ms-caro-malware:malware-platform=\"WinNT\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770951612", "to_ids": false, "type": "link", "uuid": "7c19480d-1f83-46fa-9182-9a9762451e44", "value": "https://www.acronis.com/en/tru/posts/lockbit-strikes-with-new-50-version-targeting-windows-linux-and-esxi-systems" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1770951612", "to_ids": false, "type": "text", "uuid": "2b09cd74-30f9-48af-9dc3-d944650779a4", "value": "LockBit 5.0, the latest version of the notorious ransomware, has been released with support for Windows, Linux, and ESXi systems. This update brings improved defense evasion, faster encryption, and enhanced modularity. The Windows variant employs extensive anti-analysis techniques, while Linux and ESXi versions remain unpacked. All variants share a common encryption scheme using XChaCha20 and Curve25519. LockBit 5.0 demonstrates a focus on enterprise and infrastructure targets, including explicit support for Proxmox virtualization. The group's data leak site reveals a primary focus on the U.S. business sector, with victims spanning various industries. LockBit's infrastructure has shown connections to SmokeLoader, suggesting possible cooperation or infrastructure reuse among malware operators." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1770951612", "to_ids": false, "type": "text", "uuid": "24fc735b-98d7-42b6-836f-8417bb682920", "value": "Name: LockBit strikes with new 5.0 version, targeting Windows, Linux and ESXI systems\nAuthor: AlienVault\nAdversary: LockBit\nTags: [\"linux\", \"encryption\", \"double-extortion\", \"infrastructure\", \"windows\", \"lockbit\", \"smokeloader\", \"virtualization\", \"defense-evasion\", \"ransomware\", \"esxi\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: []\nAttack_ids: [\"T1489\", \"T1553.002\", \"T1082\", \"T1071\", \"T1140\", \"T1036\", \"T1055\", \"T1562.002\", \"T1112\", \"T1070.001\", \"T1222\", \"T1083\", \"T1497\", \"T1480\", \"T1078\", \"T1027\", \"T1486\", \"T1573\", \"T1490\"]\nIndustries: [\"Finance\", \"Manufacturing\", \"Government\", \"Education\", \"Healthcare\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1770951612", "to_ids": false, "type": "threat-actor", "uuid": "29f2acfe-3b18-4182-b7c9-291ed33d0844", "value": "LockBit" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017453", "to_ids": true, "type": "domain", "uuid": "e6e391ea-f6d3-47e3-b435-b2426b22999c", "value": "lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017474", "to_ids": true, "type": "domain", "uuid": "a0f0aec2-8443-444a-8fed-9283b8d5e8b1", "value": "lockbit7z2mmiz3ryxafn5kapbvbbiywsxwovasfkgf5dqqp5kxlajad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017496", "to_ids": true, "type": "domain", "uuid": "e6d5aa16-3092-44a3-9785-58fdf8d99888", "value": "lockbit7z2og4jlsmdy7dzty3g42eu3gh2sx2b6ywtvhrjtss7li4fyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017518", "to_ids": true, "type": "domain", "uuid": "3a610cff-780a-4391-89e5-57abd96ba616", "value": "lockbit7z355oalq4hiy5p7de64l6rsqutwlvydqje56uvevcc57r6qd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017540", "to_ids": true, "type": "domain", "uuid": "395b351c-e978-49f7-8d55-7f195288e657", "value": "lockbit7z36ynytxwjzuoao46ck7b3753gpedary3qvuizn3iczhe4id.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017561", "to_ids": true, "type": "domain", "uuid": "3faa89db-dd11-4ca4-9679-c14a5aa92f5e", "value": "lockbit7z37ntefjdbjextn6tmdkry4j546ejnru5cejeguitiopvhad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017583", "to_ids": true, "type": "domain", "uuid": "4b858ad2-87bc-4462-ba95-16b91a61e7a9", "value": "lockbit7z3azdoxdpqxzliszutufbc2fldagztdu47xyucp25p4xtqad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017604", "to_ids": true, "type": "domain", "uuid": "9c9845bd-f214-408b-bfdd-ee3f4571f7f0", "value": "lockbit7z3ddvg5vuez2vznt73ljqgwx5tnuqaa2ye7lns742yiv2zyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017626", "to_ids": true, "type": "domain", "uuid": "d6bf7249-d88f-47e6-b127-0b32014b4b5d", "value": "lockbit7z3hv7ev5knxbrhsvv2mmu2rddwqizdz4vwfvxt5izrq6zqqd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017649", "to_ids": true, "type": "domain", "uuid": "a8300363-b21b-492f-a0d6-67fc04140d1f", "value": "lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017670", "to_ids": true, "type": "domain", "uuid": "41ff7730-cb1c-45aa-9aba-f5eb4fc02af4", "value": "lockbit7z4bsm63m3dagp5xglyacr4z4bwytkvkkwtn6enmuo5fi5iyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017692", "to_ids": true, "type": "domain", "uuid": "7758812f-3890-4d53-84a5-a8c1de71618e", "value": "lockbit7z4cgxvictidwfxpuiov4scdw34nxotmbdjyxpkvkg34mykyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017714", "to_ids": true, "type": "domain", "uuid": "74d3b122-78a7-418d-bc88-1757c8a6a497", "value": "lockbit7z4k5zer5fbqi2vdq5sx2vuggatwyqvoodrkhubxftyrvncid.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017735", "to_ids": true, "type": "domain", "uuid": "71713ab6-a054-463c-8ec4-db480ef70f25", "value": "lockbit7z4ndl6thsct34yd47jrzdkpnfg3acfvpacuccb45pnars2ad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017756", "to_ids": true, "type": "domain", "uuid": "2a24b697-a108-4440-b703-8fcfe988f505", "value": "lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017778", "to_ids": true, "type": "domain", "uuid": "f105b44a-cd84-4b50-a60b-8b48071b331e", "value": "lockbit7z57mkicfkuq44j6yrpu5finwvjllczkkp2uvdedsdonjztyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017800", "to_ids": true, "type": "domain", "uuid": "9e04cd62-c7e6-4f3f-a4d1-a293df8fcfee", "value": "lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017821", "to_ids": true, "type": "domain", "uuid": "035c574c-0b3a-43fe-be18-a44e990812ab", "value": "lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017843", "to_ids": true, "type": "domain", "uuid": "241d7ee2-963d-4a7c-8126-41a3cd2a0f6e", "value": "lockbit7z5ltrhzv46lsg447o3cx2637dloc3qt4ugd3gr2xdkkkeayd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017865", "to_ids": true, "type": "domain", "uuid": "5aef633a-77be-4410-9f7a-0f907e02e855", "value": "lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017886", "to_ids": true, "type": "domain", "uuid": "c85be30e-8caa-441b-b8e5-81f807bd425d", "value": "lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017908", "to_ids": true, "type": "domain", "uuid": "0b5a4df0-6f97-42cb-9468-139ed1371418", "value": "lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017929", "to_ids": true, "type": "domain", "uuid": "ab8ddd61-a7b5-4d43-b2d7-cba2e5d91e99", "value": "lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017951", "to_ids": true, "type": "domain", "uuid": "f91fadb3-2c8d-4edb-a6b6-4ea7c4a8f80c", "value": "lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017972", "to_ids": true, "type": "domain", "uuid": "be1a424f-7e85-48cb-a580-5179a4b5b29c", "value": "lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771017993", "to_ids": true, "type": "domain", "uuid": "43bf0e23-9238-49e0-92f8-9687c8323b67", "value": "lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1771018015", "to_ids": true, "type": "domain", "uuid": "2a539d35-a7f9-4396-9578-fb93439ba5db", "value": "rodericwalter.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "LockBit exposed server", "deleted": false, "disable_correlation": false, "timestamp": "1780042183", "to_ids": true, "type": "ip-dst", "uuid": "cb60d56a-ea3b-4745-9ffa-f283995bc043", "value": "205.185.116.233", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#075f7f", "local": false, "name": "asn:asn=\"53667\"", "relationship_type": "" }, { "colour": "#ae50d2", "local": false, "name": "asn:as-owner=\"PONYNET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "LockBit exposed server", "deleted": false, "disable_correlation": false, "timestamp": "1770979044", "to_ids": true, "type": "ip-dst|port", "uuid": "8de44f53-0449-420e-b018-95ce0f738acf", "value": "205.185.116.233|3389" }, { "category": "Network activity", "comment": "LockBit exposed server", "deleted": false, "disable_correlation": false, "timestamp": "1771018058", "to_ids": true, "type": "domain", "uuid": "fda61586-75f3-4456-a20a-1600fa949ef3", "value": "karma0.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Data leak site", "deleted": false, "disable_correlation": false, "timestamp": "1771018079", "to_ids": true, "type": "url", "uuid": "c1f9a835-71c3-4dc0-b322-ce9f39f73dfa", "value": "http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Threat actor chat link", "deleted": false, "disable_correlation": false, "timestamp": "1771018100", "to_ids": true, "type": "url", "uuid": "d9172694-1981-4f60-9fec-c6fca8226ea2", "value": "http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018122", "to_ids": true, "type": "url", "uuid": "db833f81-8d19-400a-b338-f79a14649675", "value": "http://lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018144", "to_ids": true, "type": "url", "uuid": "c986d5a8-dad7-4085-b5b3-3909e964566d", "value": "http://lockbit7z2mmiz3ryxafn5kapbvbbiywsxwovasfkgf5dqqp5kxlajad.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018165", "to_ids": true, "type": "url", "uuid": "089ae9cf-194c-4a1e-b504-f24465af5076", "value": "http://lockbit7z2og4jlsmdy7dzty3g42eu3gh2sx2b6ywtvhrjtss7li4fyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018187", "to_ids": true, "type": "url", "uuid": "f77d8b89-6938-4aaf-bda4-6ce03988050a", "value": "http://lockbit7z355oalq4hiy5p7de64l6rsqutwlvydqje56uvevcc57r6qd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018208", "to_ids": true, "type": "url", "uuid": "4042d055-5482-49e5-8399-5b644c830615", "value": "http://lockbit7z36ynytxwjzuoao46ck7b3753gpedary3qvuizn3iczhe4id.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018229", "to_ids": true, "type": "url", "uuid": "1b1091d6-4780-49bf-839f-f815504f2a23", "value": "http://lockbit7z37ntefjdbjextn6tmdkry4j546ejnru5cejeguitiopvhad.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018251", "to_ids": true, "type": "url", "uuid": "7b73ab82-f395-40e4-a8f6-a0a0df12eb70", "value": "http://lockbit7z3azdoxdpqxzliszutufbc2fldagztdu47xyucp25p4xtqad.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018272", "to_ids": true, "type": "url", "uuid": "b0c5cb5d-f83f-4617-98d1-2f2fa26018b1", "value": "http://lockbit7z3ddvg5vuez2vznt73ljqgwx5tnuqaa2ye7lns742yiv2zyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018293", "to_ids": true, "type": "url", "uuid": "228e990d-44b7-4008-8a26-f77a92350597", "value": "http://lockbit7z3hv7ev5knxbrhsvv2mmu2rddwqizdz4vwfvxt5izrq6zqqd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018315", "to_ids": true, "type": "url", "uuid": "8962abb9-23c8-416a-a37d-819de605da5f", "value": "http://lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018336", "to_ids": true, "type": "url", "uuid": "1b12a70e-cc72-4e74-884e-366a1dd22d99", "value": "http://lockbit7z4bsm63m3dagp5xglyacr4z4bwytkvkkwtn6enmuo5fi5iyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018357", "to_ids": true, "type": "url", "uuid": "446ed5ea-8a94-4c55-9a6e-a39ba22a876e", "value": "http://lockbit7z4cgxvictidwfxpuiov4scdw34nxotmbdjyxpkvkg34mykyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018380", "to_ids": true, "type": "url", "uuid": "655c3b7a-973d-450e-ba85-5e314be4745e", "value": "http://lockbit7z4k5zer5fbqi2vdq5sx2vuggatwyqvoodrkhubxftyrvncid.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018401", "to_ids": true, "type": "url", "uuid": "faebeaef-2fc7-455d-aa6f-7d7283fdde8f", "value": "http://lockbit7z4ndl6thsct34yd47jrzdkpnfg3acfvpacuccb45pnars2ad.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018423", "to_ids": true, "type": "url", "uuid": "837eb540-1be3-4ce0-a6d9-d5f24a059ce6", "value": "http://lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018444", "to_ids": true, "type": "url", "uuid": "c0719351-5cf5-48a4-80da-fdf5eafffa6a", "value": "http://lockbit7z57mkicfkuq44j6yrpu5finwvjllczkkp2uvdedsdonjztyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018465", "to_ids": true, "type": "url", "uuid": "bcbfd538-aaf5-4526-8935-581d91f7866c", "value": "http://lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018487", "to_ids": true, "type": "url", "uuid": "dd1e487d-6044-432a-972d-3251d985d255", "value": "http://lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018508", "to_ids": true, "type": "url", "uuid": "f919bcc2-7a5b-4518-957c-99d7fe5120f6", "value": "http://lockbit7z5ltrhzv46lsg447o3cx2637dloc3qt4ugd3gr2xdkkkeayd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018529", "to_ids": true, "type": "url", "uuid": "12d6f21e-9c5f-4320-a766-dab6f3315d52", "value": "http://lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018551", "to_ids": true, "type": "url", "uuid": "acaf42d2-8d95-45e3-8a6d-1782e1b55a8a", "value": "http://lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018572", "to_ids": true, "type": "url", "uuid": "755ed768-4d8e-4843-a9a7-7224633519c2", "value": "http://lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018593", "to_ids": true, "type": "url", "uuid": "71aedb12-4ea9-4187-ad39-cade07ab4edc", "value": "http://lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Leaked data mirrors", "deleted": false, "disable_correlation": false, "timestamp": "1771018615", "to_ids": true, "type": "url", "uuid": "1fddd01e-54f7-480f-b75a-6b09d607fcca", "value": "http://lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1779139833", "to_ids": false, "type": "threat-actor", "uuid": "89afbfb0-c72c-4568-baf7-eb882c15325c", "value": "lockbit5", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"lockbit5\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1779536098", "uuid": "efa77136-a2b3-4b87-9886-21e419e17a88", "Attribute": [ { "category": "Payload delivery", "comment": "LockBit Windows x64", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1779536098", "to_ids": true, "type": "md5", "uuid": "f7c87fbf-3927-4b47-a322-86ccf8e9ae53", "value": "5e1f61b9c1c27cad3b7a81c804ac7b86", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Windows x64", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1779536098", "to_ids": true, "type": "sha1", "uuid": "75b1bb7a-6e9d-4824-980e-b2ae18e3c55d", "value": "c1888ba296f57e87a84411ddfce3cabc4536b142", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Windows x64", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1779536098", "to_ids": true, "type": "sha256", "uuid": "15521b4b-f88c-4cc6-b33f-e8afb24f1c22", "value": "180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770979924", "to_ids": true, "type": "ssdeep", "uuid": "20edb906-50d8-49a5-92e2-bfa64c8c9d16", "value": "12288:0LxxJniMoRpKP9W1u19Ol9tyHDdZIYTbviWYbn8wBNsavTduK14UqMs5XRhazKj:0LIJvyHDPVXahbnNBNgfUjs5Xuz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770979924", "to_ids": false, "type": "size-in-bytes", "uuid": "bd422976-11d6-4008-ba0a-7f10ea0e28d9", "value": "708040" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770979924", "to_ids": true, "type": "vhash", "uuid": "d0645174-9337-472c-82d9-2360db3ca277", "value": "075056657d15151\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770979924", "to_ids": true, "type": "filename", "uuid": "6c8328d4-041c-4350-b42a-10b173cc333d", "value": "lbGame.exe" }, { "category": "Other", "comment": "Checked: 13/02/2026\nLast-scan\t: 06/02/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770979924", "to_ids": false, "type": "text", "uuid": "6600e5d3-73fa-4646-be9b-7594c2898d54", "value": "LockBit Windows x64\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/Lockbit.HDL!MTB\nVT Total Detection:59/72\nFirst Submission:2025-09-17T21:12:47.000000+00:00\nLast Submission:2025-12-24T11:32:33.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1779536102", "uuid": "b73d5fa6-cf76-4180-b106-62be387c8575", "Attribute": [ { "category": "Payload delivery", "comment": "SmokeLoader sample with LockBit-related IP address", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1779536100", "to_ids": true, "type": "md5", "uuid": "abd42420-3a92-4110-93a6-1c137303fbef", "value": "e818a9afd55693d556a47002a7b7ef31", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SmokeLoader sample with LockBit-related IP address", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1779536101", "to_ids": true, "type": "sha1", "uuid": "d346f6da-d6f3-47ac-bf8e-84ee04a3dcea", "value": "ec48107db718775109347d49f8cf3c569df55f0b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SmokeLoader sample with LockBit-related IP address", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1779536102", "to_ids": true, "type": "sha256", "uuid": "96bf4280-87bc-4a90-be07-2311dcdc97a7", "value": "1da6525ae1ef83b6f1dc02396ef0933732f9ffdfca0fda9b2478d32a54e3069b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770979946", "to_ids": true, "type": "ssdeep", "uuid": "8561d72f-cbb2-4146-a24c-0d61f7c45e77", "value": "12288:wpj9EEumEd7jGKoKz3DVHW1nsZnhRsQTfQ/VG4376p7sPh8pTE9U2f:wFq0UjiKPuunLVa8zCPupf2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770979946", "to_ids": false, "type": "size-in-bytes", "uuid": "6699b8fb-120f-430f-9897-11d154cd7685", "value": "690176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770979946", "to_ids": true, "type": "vhash", "uuid": "959fcc31-93b7-40e8-b284-b3cb9df08b64", "value": "0650866d5c0d5c051565603162z3800227z303bz403dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770979946", "to_ids": true, "type": "filename", "uuid": "3ad7f93a-829c-4e70-b24a-67822784d385", "value": "ntdll.dll" }, { "category": "Other", "comment": "Checked: 13/02/2026\nLast-scan\t: 07/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770979946", "to_ids": false, "type": "text", "uuid": "5c515ed8-2346-48c5-a708-0125eae83342", "value": "SmokeLoader sample with LockBit-related IP address\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/SmokeLoader.DB!MTB\nVT Total Detection:58/71\nFirst Submission:2022-05-31T20:06:49.000000+00:00\nLast Submission:2024-04-12T07:28:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1779536105", "uuid": "ba713958-2271-46cd-add9-7e811a559348", "Attribute": [ { "category": "Payload delivery", "comment": "LockBit Linux x64", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1779536104", "to_ids": true, "type": "md5", "uuid": "84b2fa28-f1b5-4459-a717-1a7eb0485a38", "value": "ca93d47bcc55e2e1bd4a679afc8e2e25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Linux x64", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1779536105", "to_ids": true, "type": "sha1", "uuid": "2a87b0da-7865-4aee-b981-cf5b20037949", "value": "41e1e094c19fffde494c24ef4cab0d7577d5a025", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Linux x64", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1779536105", "to_ids": true, "type": "sha256", "uuid": "25824b97-dcec-48d7-b126-64f75b58e25f", "value": "4dc06ecee904b9165fa699b026045c1b6408cc7061df3d2a7bc2b7b4f0879f4d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770979968", "to_ids": true, "type": "ssdeep", "uuid": "fb55bcc5-e06e-4296-bb66-a84b1dac1d51", "value": "6144:UIUFThyET/ZOhh5++4hg3nTBiHnqAHDYpzKaN7arPSnSURUd:3UFsmZOhh5+TWkCz6zunc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770979968", "to_ids": false, "type": "size-in-bytes", "uuid": "0484f359-6881-4725-834d-55d35f86e694", "value": "385634" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770979968", "to_ids": true, "type": "vhash", "uuid": "aa2531e1-f148-44c2-87d1-571b28dd25cd", "value": "05495cf416374fc4db17277993080d5d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770979968", "to_ids": true, "type": "filename", "uuid": "0698fb54-3962-4b43-a08f-9dddd559d5d8", "value": "4dc06ecee904b9165fa699b026045c1b6408cc7061df3d2a7bc2b7b4f0879f4d.elf" }, { "category": "Other", "comment": "Checked: 13/02/2026\nLast-scan\t: 12/02/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770979968", "to_ids": false, "type": "text", "uuid": "9c683952-7f58-4080-bfb0-e7abc3415c9b", "value": "LockBit Linux x64\r\nType Description: ELF\nMicrosoft: Ransom:Linux/LockBit.G!MTB\nVT Total Detection:34/65\nFirst Submission:2025-09-20T01:30:40.000000+00:00\nLast Submission:2026-02-12T17:35:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1779536108", "uuid": "ac5cc634-decb-41be-b41b-409b1f1ec869", "Attribute": [ { "category": "Payload delivery", "comment": "LockBit Windows x64", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1779536107", "to_ids": true, "type": "md5", "uuid": "85bed730-8ca1-46b4-8ff4-e0c1f68a86ee", "value": "95daa771a28eaed76eb01e1e8f403f7c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Windows x64", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1779536108", "to_ids": true, "type": "sha1", "uuid": "9d2a4bc8-39f2-49c6-bb7f-df49b3674007", "value": "cdd5717fd3bfd375c1c34237c24073e92ad6dccc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Windows x64", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1779536108", "to_ids": true, "type": "sha256", "uuid": "b6d396ad-ebb8-4fc8-a5a9-84f90f858784", "value": "7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770979990", "to_ids": true, "type": "ssdeep", "uuid": "3b6ddfd7-e01a-4491-a47e-9b44aa1c25a9", "value": "12288:q/tJbVY7R6CCJ5RqRhoS2KMPKZb8VEtiWYbn8wBNsavTduK14UqMs5+p6uaYwsjE:q/XuwyZAVEEhbnNBNgfUjs5+8RsXsx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770979990", "to_ids": false, "type": "size-in-bytes", "uuid": "f23cb98a-5af2-4464-ac5c-4d11b76609b0", "value": "710560" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770979990", "to_ids": true, "type": "vhash", "uuid": "e91f6ab5-151a-4fef-84b4-c3af2118e2c3", "value": "075056657d15151\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770979990", "to_ids": true, "type": "filename", "uuid": "33ca3bba-eb92-4c3b-bbc4-498d0a3c365f", "value": "lockbit.exe" }, { "category": "Other", "comment": "Checked: 13/02/2026\nLast-scan\t: 11/02/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770979990", "to_ids": false, "type": "text", "uuid": "9310f67e-46ca-47ae-b7ef-aee2d02646ed", "value": "LockBit Windows x64\r\nType Description: Win32 EXE\nMicrosoft: Ransom:Win64/LockBit!rfn\nVT Total Detection:59/72\nFirst Submission:2025-09-14T09:50:20.000000+00:00\nLast Submission:2026-01-15T18:22:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1779536111", "uuid": "320589f7-f281-4a21-b602-c52ba358b50c", "Attribute": [ { "category": "Payload delivery", "comment": "LockBit ESXI x64", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1779536110", "to_ids": true, "type": "md5", "uuid": "b8c46008-21e9-4d67-87a1-9fc0110d3946", "value": "a1539b21e5d6849a3e0cf87a4dc70335", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit ESXI x64", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1779536111", "to_ids": true, "type": "sha1", "uuid": "26485196-9133-4bd0-ae20-ef1d0f1f006c", "value": "561db92000409fe7093964452143ec371f930681", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit ESXI x64", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1779536111", "to_ids": true, "type": "sha256", "uuid": "79754a7b-c301-4eb1-a36a-95c0d13c8924", "value": "90b06f07eb75045ea3d4ba6577afc9b58078eafeb2cdd417e2a88d7ccf0c0273", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770980012", "to_ids": true, "type": "ssdeep", "uuid": "6711ca76-03b5-4ff5-8f26-aea8ad39c891", "value": "6144:9/D84JsDWucUi+qEg4SRg/zRJNT26aflCbt:dD8Ss8lsAyfF4du" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770980012", "to_ids": false, "type": "size-in-bytes", "uuid": "b560772e-c7e7-4793-82e0-e6cf2d34c024", "value": "410242" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770980012", "to_ids": true, "type": "vhash", "uuid": "35cf9d08-17eb-49cc-80ac-7d73f05b08da", "value": "05495cf416374fc4db17277993080d5d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770980012", "to_ids": true, "type": "filename", "uuid": "6f0ad61f-b2cc-4ae6-9508-92ef6eeac13e", "value": "90b06f07eb75045ea3d4ba6577afc9b58078eafeb2cdd417e2a88d7ccf0c0273(1).elf" }, { "category": "Other", "comment": "Checked: 13/02/2026\nLast-scan\t: 30/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770980012", "to_ids": false, "type": "text", "uuid": "1c539a01-aaf9-42d0-a5e6-263af2cc28f9", "value": "LockBit ESXI x64\r\nType Description: ELF\nMicrosoft: Ransom:Linux/LockBit.G!MTB\nVT Total Detection:34/65\nFirst Submission:2025-09-20T01:35:28.000000+00:00\nLast Submission:2026-01-25T22:00:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1779536113", "uuid": "ab475dd4-6f4c-4ee4-b076-7830018f73f1", "Attribute": [ { "category": "Payload delivery", "comment": "LockBit Linux x64", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1779536113", "to_ids": true, "type": "md5", "uuid": "8e7e5ea1-080e-4b02-941a-6127e96b9d1a", "value": "9bcff8da7165977f973ace12dd4c0ce0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Linux x64", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1779536113", "to_ids": true, "type": "sha1", "uuid": "c10e0c31-5aa2-46da-bd49-f3727bbf5b36", "value": "801a97a2fe5c3749b713d71172de6eafb961a888", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LockBit Linux x64", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1779536113", "to_ids": true, "type": "sha256", "uuid": "7c79667e-e6d9-4d09-af74-04c6d0bb613a", "value": "98d8c7870c8e99ca6c8c25bb9ef79f71c25912fbb65698a9a6f22709b8ad34b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770980033", "to_ids": true, "type": "ssdeep", "uuid": "6b5e83cd-b081-41da-9154-17facb045873", "value": "6144:koUFThyET/ZuhB5++4hg3nTBiHp1AHD4qzKaN7aLPSnSUvvUY:HUFsmZuhB5+TWXRz6TunP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770980033", "to_ids": false, "type": "size-in-bytes", "uuid": "f439ef26-baac-4df2-8471-6ec25184ed70", "value": "385650" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770980033", "to_ids": true, "type": "vhash", "uuid": "717a4faa-2a7e-4e7d-9b1d-283f13eceec5", "value": "05495cf416374fc4db17277993080d5d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770980033", "to_ids": true, "type": "filename", "uuid": "cc9e59fe-78af-422e-83cd-781e323d516c", "value": "lw44w5aq.exe" }, { "category": "Other", "comment": "Checked: 13/02/2026\nLast-scan\t: 26/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770980033", "to_ids": false, "type": "text", "uuid": "230e09f3-600d-46be-983f-fc1137c49c6d", "value": "LockBit Linux x64\r\nType Description: ELF\nMicrosoft: Ransom:Linux/LockBit.G!MTB\nVT Total Detection:34/65\nFirst Submission:2025-09-17T16:25:12.000000+00:00\nLast Submission:2025-09-17T16:25:12.000000+00:00" } ] } ] } }