security/stix_test_lockbit.json at main · jemmee/security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
{
  "type": "bundle",
  "id": "bundle--51c5224e-c336-4986-b510-9361dbc50b43",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d1cde45-8723-4094-bcea-c19b724ec418",
      "created": "2026-05-29T20:35:20.973927Z",
      "modified": "2026-05-29T20:35:20.973927Z",
      "name": "LockBit Ransomware SHA-256 Indicator",
      "description": "Detects the specific payload hash associated with a new LockBit variant.",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-05-29T20:35:20.973927Z"
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50849b8c-7d4c-4c6f-baff-43028b905475",
      "created": "2026-05-29T20:35:20.975898Z",
      "modified": "2026-05-29T20:35:20.975898Z",
      "name": "LockBit Variant X",
      "description": "A highly evasive file-encrypting ransomware strain.",
      "malware_types": [
        "ransomware"
      ],
      "is_family": true
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--558bffd3-c659-43e8-ade8-31ecd427102c",
      "created": "2026-05-29T20:35:20.976304Z",
      "modified": "2026-05-29T20:35:20.976304Z",
      "relationship_type": "indicates",
      "description": "This specific file hash indicates the presence of the LockBit Variant X payload.",
      "source_ref": "indicator--9d1cde45-8723-4094-bcea-c19b724ec418",
      "target_ref": "malware--50849b8c-7d4c-4c6f-baff-43028b905475"
    }
  ]
}