{
  "Event": {
    "analysis": "0",
    "date": "2025-10-19",
    "extends_uuid": "",
    "info": "HardBit 4.0 Investigation by Reyben Cortes",
    "publish_timestamp": "1761172034",
    "published": true,
    "threat_level_id": "4",
    "timestamp": "1760891104",
    "uuid": "ffcf7530-3c0b-4f7b-af24-e91447a33904",
    "Orgc": {
      "name": "Ransom-ISAC",
      "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Compressed - T1002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted - T1022\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#0087e8",
        "local": false,
        "name": "osint:certainty=\"50\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload type",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760867691",
        "to_ids": false,
        "type": "comment",
        "uuid": "ce848b71-772b-4075-babd-290dbef9b6a0",
        "value": "aec47e12f0cb9fbb3d99faa5bdb58f9ece03a1da2a497431221e293b5c55b211"
      },
      {
        "category": "Payload type",
        "comment": "ransomware payload",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760867796",
        "to_ids": false,
        "type": "comment",
        "uuid": "d7a9c171-a33a-435f-8160-00715a88fcb6",
        "value": "36c85c0ba7046433c48af6d2492dfdcd0f5c7ee26b137249acc7de4ab48ea6e2"
      },
      {
        "category": "Payload type",
        "comment": "ransomware payload",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760867778",
        "to_ids": false,
        "type": "comment",
        "uuid": "cd8cf410-c47e-4068-8895-4b22da579b66",
        "value": "29b3c4c96dd932f3e6b828a8a147ec25664913391c30406e2cca638fb1962567"
      },
      {
        "category": "Other",
        "comment": "extortion email",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760867759",
        "to_ids": false,
        "type": "comment",
        "uuid": "7633a3b4-6c88-4c73-b887-cc0308659bfe",
        "value": "hardbit_locker@tutamail.com"
      },
      {
        "category": "Other",
        "comment": "payload name",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760867879",
        "to_ids": false,
        "type": "comment",
        "uuid": "bc62a6c6-196e-46a4-b781-f4cf38c9d615",
        "value": "6387u460.exe"
      },
      {
        "category": "Payload delivery",
        "comment": "Ransom email",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760890256",
        "to_ids": true,
        "type": "email-src",
        "uuid": "764f4367-6c98-4049-8a63-1f33c4254c9c",
        "value": "hardbit_locker@tutamail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "Ransomware payload",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760890306",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a8f17f5c-6859-4696-b10b-93f7e536659f",
        "value": "36c85c0ba7046433c48af6d2492dfdcd0f5c7ee26b137249acc7de4ab48ea6e2"
      },
      {
        "category": "Payload delivery",
        "comment": "ransomware payload",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760890818",
        "to_ids": true,
        "type": "sha256",
        "uuid": "015edb93-f343-481b-bf07-c3341341a3d1",
        "value": "29b3c4c96dd932f3e6b828a8a147ec25664913391c30406e2cca638fb1962567"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1760890838",
        "to_ids": true,
        "type": "sha256",
        "uuid": "877c56e9-ea89-4d7c-89ab-4ad578410a99",
        "value": "aec47e12f0cb9fbb3d99faa5bdb58f9ece03a1da2a497431221e293b5c55b211"
      }
    ],
    "Object": [
      {
        "comment": "aec47e12f0cb9fbb3d99faa5bdb58f9ece03a1da2a497431221e293b5c55b211: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1760890960",
        "uuid": "e6a9e7db-243f-4b18-aae7-38d5eab84897",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1760890960",
            "to_ids": true,
            "type": "md5",
            "uuid": "33de46cc-5468-45cc-b258-cb06deeda62f",
            "value": "b32317fcf295b75d6e089ca42a323f5d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1760890960",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4af46720-5288-455c-bbad-e1499d2be0cb",
            "value": "dc8c26c71e885b085af967f819d7f9ac0f9809b7"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1760890960",
            "to_ids": true,
            "type": "sha256",
            "uuid": "74bb3a21-05ae-43ea-8aad-afcc66e0ddb6",
            "value": "aec47e12f0cb9fbb3d99faa5bdb58f9ece03a1da2a497431221e293b5c55b211"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "tlsh",
            "timestamp": "1760890960",
            "to_ids": true,
            "type": "tlsh",
            "uuid": "ed2ca252-19ba-490b-a553-5067b9f7d2e5",
            "value": "t167f41224f3ca8831c4941e79ac19d7d0ab35d7680cad2b33b0ec485deb835859e673b9"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1760890960",
            "to_ids": true,
            "type": "vhash",
            "uuid": "2d21d7b4-efb9-43de-b2b6-05555c4e4705",
            "value": "0750866d1c0d1c0515651035zc00159z25z23z2fz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1760890960",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "44b396a1-3b9d-4053-8786-1743c30942df",
            "value": "12288:ViRlPuZskio2eiMJ9keNWZ0tiLI4CTEYMhQZsp+betsdsUId1wyPk:QHPuWkiQiMJOe9tiUE3aupMetsPUk"
          }
        ]
      },
      {
        "comment": "29b3c4c96dd932f3e6b828a8a147ec25664913391c30406e2cca638fb1962567: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1760891043",
        "uuid": "cb04c26f-4bdf-4451-87d0-f6388bd59b79",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1760891043",
            "to_ids": true,
            "type": "md5",
            "uuid": "49a0e2e8-3d21-4e1d-bccb-ba1b3cc34e62",
            "value": "a57ed12aaf054f69c1442410fecdfaf6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1760891043",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ca370486-553c-4a04-a17c-ce47a27b591a",
            "value": "88027d16b91e313aaf74271543dffa0975ff7249"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1760891043",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b7dd0e32-528d-443b-9fa2-514599995923",
            "value": "29b3c4c96dd932f3e6b828a8a147ec25664913391c30406e2cca638fb1962567"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "tlsh",
            "timestamp": "1760891043",
            "to_ids": true,
            "type": "tlsh",
            "uuid": "fca466db-0d1f-4c2d-85d3-52145c9f4ecc",
            "value": "t128651251bb49cd92c1ba16b68d42c3f16724ce5c4962eb3730fddc6fbb872840e4265a"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1760891043",
            "to_ids": true,
            "type": "vhash",
            "uuid": "dae861c6-0f0c-47ba-b923-bab31bb95b2b",
            "value": "21605f766555161b7081f8b6fb683"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1760891043",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6c42ac96-d21c-41cc-a142-989be073b5c1",
            "value": "24576:AIf8oTbo5AMj60vap9OsBtD81BRfSBck+QA16twaKYGTtf2kHB4jOr2mzgaWtzX:p3bkAA3sUsYPqjZwawf2khXCmzst7"
          }
        ]
      },
      {
        "comment": "36c85c0ba7046433c48af6d2492dfdcd0f5c7ee26b137249acc7de4ab48ea6e2: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "5",
        "timestamp": "1760891104",
        "uuid": "babe76da-9576-4f49-8ee6-077b3f56d289",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "permalink",
            "timestamp": "1760891104",
            "to_ids": false,
            "type": "link",
            "uuid": "7916d0f4-3b7e-476a-b035-04be2af1adfc",
            "value": "https://www.virustotal.com/gui/ip_address/a83f:8110:71b3:da01:855f:25cf:71b3:da01"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1760891104",
            "to_ids": false,
            "type": "text",
            "uuid": "f620c1db-0823-47e2-a97e-5b4202c529f0",
            "value": "0/95"
          }
        ]
      },
      {
        "comment": "36c85c0ba7046433c48af6d2492dfdcd0f5c7ee26b137249acc7de4ab48ea6e2: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1760891104",
        "uuid": "c8541018-4b03-4100-912f-79543b994be8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1760891104",
            "to_ids": true,
            "type": "md5",
            "uuid": "bf03a800-11cf-42e1-b14e-ef9993a70d6b",
            "value": "a24dea9616c4047b172e61309becccc8"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1760891104",
            "to_ids": true,
            "type": "sha1",
            "uuid": "45a560c4-7f10-45ee-8fdd-cf5656fb5390",
            "value": "9bbf5f29c3e11956b84a50e8b6aa3a41bbc225ea"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1760891104",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5b517c96-a7b7-4418-b70e-a84f9751e57c",
            "value": "36c85c0ba7046433c48af6d2492dfdcd0f5c7ee26b137249acc7de4ab48ea6e2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "tlsh",
            "timestamp": "1760891104",
            "to_ids": true,
            "type": "tlsh",
            "uuid": "5bc3dfa3-d61e-4ea2-93c9-c31c607f79db",
            "value": "t114e41234b3ce8521c5d81a766d19d7d0bf34c79848ae2b23b0dc8499ab835859f673b8"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1760891104",
            "to_ids": true,
            "type": "vhash",
            "uuid": "65b795bc-5381-4d36-8137-3e52b37342ba",
            "value": "27505f766555161aa09153b121054"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1760891104",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "58d52b59-3eec-445f-9c39-ba2f5db41069",
            "value": "12288:GPviRlPuZskio2eiMJ9keNWZ0tiLI4CTEYMhQZsp+betsdsUId1wE:AKHPuWkiQiMJOe9tiUE3aupMetsPE"
          }
        ]
      }
    ]
  }
}