{
  "Event": {
    "analysis": "1",
    "date": "2026-07-11",
    "extends_uuid": "",
    "info": "[Threat Intel] jscrambler npm Package Compromised in Supply Chain Attack",
    "protected": false,
    "publish_timestamp": "1784392488",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1784392488",
    "uuid": "02b59dab-9c6e-4ece-a76f-1bd08b5ab54c",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#95f9b9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Sudo and Sudo Caching - T1548.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#ec8ba3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Managers - T1555.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b4369",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Container API - T1552.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"npm\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783940417",
        "to_ids": false,
        "type": "link",
        "uuid": "910c299a-d589-47ab-a922-1ea07669c174",
        "value": "https://socket.dev/blog/jscrambler-supply-chain-attack"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783940417",
        "to_ids": false,
        "type": "text",
        "uuid": "e47a91a9-0ecc-4b91-a4bd-3f472844901e",
        "value": "A malicious release of the jscrambler npm package (version 8.14.0) was published on July 11, 2026, introducing hidden native binaries that execute automatically during installation. The compromised package added an undocumented preinstall hook executing dist/setup.js, which deploys platform-specific binaries for Linux, macOS, and Windows embedded in an obfuscated CSI container. The payload is a Rust-built infostealer targeting cryptocurrency wallets, AI coding assistants, cloud credentials (AWS, GCP, Azure), browser data, and messaging applications. String obfuscation uses per-string ChaCha20-Poly1305 encryption. The threat actor published five malicious versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) over three hours, evolving delivery methods to evade detection. Version 8.22.0 is confirmed clean. The package receives approximately 15,800 weekly downloads, affecting developer workstations, CI systems, and build pipelines with access to credentials and secrets."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783940417",
        "to_ids": false,
        "type": "text",
        "uuid": "2897a7c1-451b-4877-b384-098e8ebf427b",
        "value": "Name: jscrambler npm Package Compromised in Supply Chain Attack\nAuthor: AlienVault\nAdversary: \nTags: [\"npm compromise\", \"infostealer\", \"supply chain attack\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1033\", \"T1059.007\", \"T1539\", \"T1548.003\", \"T1204.002\", \"T1053.003\", \"T1555.005\", \"T1082\", \"T1140\", \"T1555.003\", \"T1552.001\", \"T1528\", \"T1041\", \"T1027\", \"T1195.002\", \"T1567.002\", \"T1027.002\", \"T1543.002\", \"T1078.004\", \"T1552.007\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 18/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784377566",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5f586025-ca1a-425d-801a-8c0fba242e93",
        "value": "bba32ddeab075a5e5015eec50f5d2af364c95b848732c714aea6b6baf78f49f0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-11T16:49:28+00:00",
        "last_seen": "2026-07-13T20:25:43+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784382778",
        "uuid": "029edfd5-2ac5-47a6-ad8f-4986a56c7e1a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T16:49:28+00:00",
            "last_seen": "2026-07-13T20:25:43+00:00",
            "object_relation": "md5",
            "timestamp": "1784382778",
            "to_ids": true,
            "type": "md5",
            "uuid": "4bc97868-2809-4640-85cf-2ddf890ede4a",
            "value": "a9b84ba27ab557caba50f913e2f7950d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T16:49:28+00:00",
            "last_seen": "2026-07-13T20:25:43+00:00",
            "object_relation": "sha1",
            "timestamp": "1784377560",
            "to_ids": true,
            "type": "sha1",
            "uuid": "7903122e-8844-46d4-8f38-854b7fb5939f",
            "value": "693d9704dfffdbb190ddf822410f690dd57a4efe",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T16:49:28+00:00",
            "last_seen": "2026-07-13T20:25:43+00:00",
            "object_relation": "sha256",
            "timestamp": "1784377560",
            "to_ids": true,
            "type": "sha256",
            "uuid": "adc65dde-16da-43f8-aaf2-eaf67d385bd9",
            "value": "a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-11T16:49:28+00:00",
            "last_seen": "2026-07-13T20:25:43+00:00",
            "object_relation": "text",
            "timestamp": "1784368617",
            "to_ids": false,
            "type": "text",
            "uuid": "766e161d-96e7-4d23-881d-b1f082e147b5",
            "value": "Type Description: unknown\nMicrosoft: Trojan:JS/ObfusJS\nClamAV: None\nVT Total Detection: 19/74\nFirst Submission: 2026-07-11T16:49:28+00:00\nLast Submission: 2026-07-13T20:25:43+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T16:49:28+00:00",
            "last_seen": "2026-07-13T20:25:43+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784368617",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "80f41f57-8a94-4d08-bf38-a2a4f7cd2e96",
            "value": "196608:RYs2jUc+bGeMdbtMf9vTo5FaLTAIl2zLiWGesPD:P2jUZ6eMdbtkTKFaH/MLifesb"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-11T16:49:28+00:00",
            "last_seen": "2026-07-13T20:25:43+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784368618",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "72666698-abe7-4b66-b46f-3b849c279b92",
            "value": "7837238"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-11T16:49:28+00:00",
            "last_seen": "2026-07-13T20:25:43+00:00",
            "object_relation": "filename",
            "timestamp": "1784368618",
            "to_ids": true,
            "type": "filename",
            "uuid": "af8c16ee-7c0a-41ff-907f-9e930c3da37c",
            "value": "intro.js"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-13T20:24:56+00:00",
        "last_seen": "2026-07-13T20:24:56+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784382799",
        "uuid": "12e6df16-d370-4397-92b4-050bcd9952c9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T20:24:56+00:00",
            "last_seen": "2026-07-13T20:24:56+00:00",
            "object_relation": "md5",
            "timestamp": "1784382799",
            "to_ids": true,
            "type": "md5",
            "uuid": "d8ad114c-48ba-4cac-a4ff-3f7fdc079890",
            "value": "ac9a218fe62ca06df14c0e3c7517827f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T20:24:56+00:00",
            "last_seen": "2026-07-13T20:24:56+00:00",
            "object_relation": "sha1",
            "timestamp": "1784377561",
            "to_ids": true,
            "type": "sha1",
            "uuid": "10f15e68-7018-4f77-98fa-be9909e55261",
            "value": "f305ea87105a335813e26da83e2cb501be66511b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T20:24:56+00:00",
            "last_seen": "2026-07-13T20:24:56+00:00",
            "object_relation": "sha256",
            "timestamp": "1784377561",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7064779b-b799-4deb-a2ee-2a6d31b3d469",
            "value": "a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T20:24:56+00:00",
            "last_seen": "2026-07-13T20:24:56+00:00",
            "object_relation": "text",
            "timestamp": "1784368639",
            "to_ids": false,
            "type": "text",
            "uuid": "c4e35231-ecbd-4197-a397-72c788b8e60e",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/jscramSteal.DA!MTB\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2026-07-13T20:24:56+00:00\nLast Submission: 2026-07-13T20:24:56+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T20:24:56+00:00",
            "last_seen": "2026-07-13T20:24:56+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784368639",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "18085d46-7024-4cd5-acdb-387dc3454c3d",
            "value": "24:HpKelZBC+IDhBoemBVBoBSqjXdJ9ENDOMjRCmD+1LDoG1zVz56NOkwBUalGUQ1Io:H5lZwDhBoTbBcSqjtJ9ERNjRCmDkL7z8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T20:24:56+00:00",
            "last_seen": "2026-07-13T20:24:56+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784368639",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "2032e6c3-0087-4884-bf28-d63084bece46",
            "value": "1428"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T20:24:56+00:00",
            "last_seen": "2026-07-13T20:24:56+00:00",
            "object_relation": "filename",
            "timestamp": "1784368639",
            "to_ids": true,
            "type": "filename",
            "uuid": "3685ad11-9b71-4983-b24b-4ea2d3e33021",
            "value": "setup.js"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-12T02:22:59+00:00",
        "last_seen": "2026-07-16T03:28:52+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784382820",
        "uuid": "48a941bc-c4d8-4a3a-a05c-4f0c5908949e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "md5",
            "timestamp": "1784382820",
            "to_ids": true,
            "type": "md5",
            "uuid": "c7a1d2b7-fc56-44fc-b5ba-193a93ef4a1b",
            "value": "1c994ac44036ada0ae80a1a864774f3e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "sha1",
            "timestamp": "1784377562",
            "to_ids": true,
            "type": "sha1",
            "uuid": "dfb05f0e-482e-48f2-8bd6-14f752eb2e40",
            "value": "b9c8b84157c14472d51b3413924d4ffbe33bc8d4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "sha256",
            "timestamp": "1784377563",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0647c2ca-6261-4f21-b59a-23c05187aaf9",
            "value": "b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "text",
            "timestamp": "1784368660",
            "to_ids": false,
            "type": "text",
            "uuid": "0a06f403-10a2-41f6-804d-2950d3fdb5c8",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/jscramSteal.DA!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-07-12T05:46:14+00:00\nFirst Submission: 2026-07-12T02:22:59+00:00\nLast Submission: 2026-07-16T03:28:52+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784368660",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "4d84f312-8813-4b61-af35-6e1a316a9201",
            "value": "49152:shSvgFq86kInXNywNEJWJf6tzEzOxCxhiD7/v8rDxrpNUp3XUgzKepDo9INVbiLW:shSv5Vf64RqpAQu+5i1F+AQoqgQp7+Y"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784368660",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9ec7a7f9-4f7c-4651-90f9-699731efdbe3",
            "value": "5155328"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "vhash",
            "timestamp": "1784368660",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b48f1197-e943-426f-bef4-9da736823890",
            "value": "056066657d156d155018z8d3z81z205iz147z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-12T02:22:59+00:00",
            "last_seen": "2026-07-16T03:28:52+00:00",
            "object_relation": "filename",
            "timestamp": "1784368660",
            "to_ids": true,
            "type": "filename",
            "uuid": "fb9390db-5f8b-4585-9cad-bde313560d68",
            "value": "payload_win32.exe"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-13T15:26:32+00:00",
        "last_seen": "2026-07-13T15:26:32+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784382841",
        "uuid": "4909855d-f114-4090-be53-1d79db116c39",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "md5",
            "timestamp": "1784382841",
            "to_ids": true,
            "type": "md5",
            "uuid": "52e0e902-38d6-49ef-8b30-f227b867c7e7",
            "value": "8599acfae026fc4e9cae26ec298aaeb9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "sha1",
            "timestamp": "1784377563",
            "to_ids": true,
            "type": "sha1",
            "uuid": "3d267c64-afdc-48a1-ae0c-f2b9ecf0bf3f",
            "value": "c11a9a1d8cdd7b98c693bcef97f2200cf1b505e6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "sha256",
            "timestamp": "1784377563",
            "to_ids": true,
            "type": "sha256",
            "uuid": "03fa5045-e93d-4b84-9c3c-8a5b99814500",
            "value": "c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "text",
            "timestamp": "1784368702",
            "to_ids": false,
            "type": "text",
            "uuid": "a270a176-b497-4e82-86ac-230e60af58d6",
            "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/jscramSteal.DA!MTB\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-07-13T15:26:32+00:00\nLast Submission: 2026-07-13T15:26:32+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784368702",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f740bdd0-f0a5-452e-98e2-695f29ce299b",
            "value": "49152:+0DUx/oLpxwOEleDoaNIpQ5XDSPapXMlIU6iFWOnXWVz0q:RUxEpxUQPIpQVDLpci+3nXWVz0q"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784368702",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "13100132-300b-46de-b915-8f6e3d3284f4",
            "value": "3184979"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "vhash",
            "timestamp": "1784368702",
            "to_ids": true,
            "type": "vhash",
            "uuid": "765d0d45-ab10-4ebe-a31e-8cb99089e200",
            "value": "3f25af2d72c0bd74fe711cb65a4d11f2"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-13T15:26:32+00:00",
            "last_seen": "2026-07-13T15:26:32+00:00",
            "object_relation": "filename",
            "timestamp": "1784368702",
            "to_ids": true,
            "type": "filename",
            "uuid": "a0ebc08e-8892-4221-b988-b44397abdafa",
            "value": "agent-d89a8344a9914242"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-11T17:39:38+00:00",
        "last_seen": "2026-07-12T01:39:55+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784382863",
        "uuid": "de14b844-a50b-4094-a5fa-cceabc0d38fa",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "md5",
            "timestamp": "1784382863",
            "to_ids": true,
            "type": "md5",
            "uuid": "8f57bee5-dc58-4b63-89cb-5af75c01c050",
            "value": "1c6124ed1f4739e41298ee377a032713",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "sha1",
            "timestamp": "1784377565",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6a0451f4-cff5-432a-8c2c-716f4c2edf0b",
            "value": "08d2c8561b9d44b9290b64bcefa023fa6daa5431",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "sha256",
            "timestamp": "1784377565",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e28d716b-ade0-401d-b924-2100e736c12c",
            "value": "fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "text",
            "timestamp": "1784368724",
            "to_ids": false,
            "type": "text",
            "uuid": "ffa43265-ab3a-497a-94ae-e433a218aae3",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/jscramSteal.DA!MTB\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-07-11T17:39:38+00:00\nLast Submission: 2026-07-12T01:39:55+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784368724",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "aa05885b-82cb-4f1c-9f35-4b016ebec3d8",
            "value": "49152:gYnOtiXccwruKwIU6i1WS7H3Z9sFp6h1y62rMiJWBkErG84n40bFHwmvSBZEULG+:gYnF4r1P+sUzdLYSBGU2L5Ezz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784368724",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d407fdf4-de8b-49fa-bafd-a112b6472f08",
            "value": "4521128"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "vhash",
            "timestamp": "1784368724",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8a9c06d7-e4ac-4ef0-bfb2-187226df6d97",
            "value": "9c895afcd7a2a8bbee7e9850219e85a0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-11T17:39:38+00:00",
            "last_seen": "2026-07-12T01:39:55+00:00",
            "object_relation": "filename",
            "timestamp": "1784368724",
            "to_ids": true,
            "type": "filename",
            "uuid": "c069ceed-b10c-43bf-86e0-28ddbe6c018e",
            "value": "watch.mal"
          }
        ]
      }
    ]
  }
}