{
  "Event": {
    "analysis": "1",
    "date": "2026-06-15",
    "extends_uuid": "",
    "info": "[Threat Intel] WebAssembly Malware Found in Trojanized Open VSX Extensions",
    "protected": false,
    "publish_timestamp": "1782352622",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782352622",
    "uuid": "43eb70af-9f4f-4cb9-98c9-15bcea35e6a9",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#201172",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Dependencies and Development Tools - T1195.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#f4b62b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665227",
        "to_ids": false,
        "type": "link",
        "uuid": "077352e9-53d0-45f3-93cb-95a728b98772",
        "value": "https://socket.dev/blog/glasswasm-malware-open-vsx-extensions",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665227",
        "to_ids": false,
        "type": "text",
        "uuid": "10f16a20-e52d-4e2c-9dfd-037f6f3522b7",
        "value": "Trojanized Visual Studio Code extensions distributed via the Open VSX marketplace deliver a sophisticated WebAssembly-based attack chain. The extensions ship ChaCha20-encrypted TinyGo-compiled WebAssembly modules that poll the Solana blockchain for command-and-control instructions embedded in transaction memos. This novel dead-drop technique allows attackers to rotate infrastructure without hardcoded servers. Once activated, the modules read attacker instructions from a monitored Solana wallet address, then execute platform-specific download-and-execute commands via Node.js child_process to deploy second-stage payloads. The campaign impersonates legitimate extensions on Open VSX, exploiting cross-registry trust gaps to target VSCodium, Cursor, Windsurf, and other VS Code forks. Attribution points to GlassWorm-associated tradecraft with medium confidence, representing a new WebAssembly-based variant of previously documented supply chain compromise techniques."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665227",
        "to_ids": false,
        "type": "text",
        "uuid": "8b97cbcf-da24-4321-b948-dabbd617cac8",
        "value": "Name: WebAssembly Malware Found in Trojanized Open VSX Extensions\nAuthor: AlienVault\nAdversary: GlassWorm\nTags: [\"glasswasm\", \"cryptocurrency targeting\", \"dead-drop c2\", \"webassembly\", \"chacha20 encryption\", \"supply chain\", \"tinygo\", \"vs code extensions\", \"open vsx\", \"solana blockchain\"]\nTgtd countries: []\nMlwr families: [\"GlassWASM\"]\nAttack_ids: [\"T1195.001\", \"T1036.005\", \"T1204.002\", \"T1573.001\", \"T1497.001\", \"T1140\", \"T1497.003\", \"T1102\", \"T1059.001\", \"T1059.004\", \"T1562.001\", \"T1027\", \"T1518.001\", \"T1059.003\", \"T1071.001\", \"T1105\", \"T1102.001\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781665227",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "bd951de3-fe2f-447d-a81a-ce85d29133ce",
        "value": "GlassWorm"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346321",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7cf0e2d7-7668-4d0c-bac4-9e7201aa9d88",
        "value": "45.150.34.158",
        "Tag": [
          {
            "colour": "#1e9433",
            "local": false,
            "name": "asn:asn=\"215826\"",
            "relationship_type": ""
          },
          {
            "colour": "#04c4b8",
            "local": false,
            "name": "asn:as-owner=\"PARTNER-HOSTING-LTD\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346342",
        "to_ids": true,
        "type": "url",
        "uuid": "c3416a7c-218d-4d9b-b75d-4ceadde21e4c",
        "value": "http://dodod.lat/darwin/i/_",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346363",
        "to_ids": true,
        "type": "url",
        "uuid": "92aead3f-79c1-4a95-a5ef-2026b7739fbd",
        "value": "http://dodod.lat/linux/i/_",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346385",
        "to_ids": true,
        "type": "url",
        "uuid": "ff676d73-5b26-4904-8c8e-c27ebfa63f43",
        "value": "http://dodod.lat/win32/i/_",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346406",
        "to_ids": true,
        "type": "url",
        "uuid": "34d98f92-66fd-4db6-8951-a66c107b9493",
        "value": "https://dodod.lat/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346427",
        "to_ids": true,
        "type": "url",
        "uuid": "6c00174e-27b6-4cb2-bde9-c97b108cfc61",
        "value": "https://dodod.lat/darwin/i/_",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346448",
        "to_ids": true,
        "type": "url",
        "uuid": "36c980b9-c112-4432-962a-7e0ac4bade9f",
        "value": "https://dodod.lat/linux/i/_",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346469",
        "to_ids": true,
        "type": "url",
        "uuid": "f6c475cb-96dc-46a7-8253-c893c9224699",
        "value": "https://dodod.lat/win32/i/_",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346490",
        "to_ids": true,
        "type": "domain",
        "uuid": "1e792683-b8bf-4ddd-b702-31ab6e2afcb0",
        "value": "dodod.lat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346511",
        "to_ids": true,
        "type": "url",
        "uuid": "e7074464-59d6-480f-a04c-5f25906fb5de",
        "value": "github.com/zaitoona43",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782346533",
        "to_ids": true,
        "type": "url",
        "uuid": "4e627136-43bf-433a-97c7-96b3eb1576e8",
        "value": "https://api.mainnet.solana.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782346554",
        "uuid": "2b4b32fa-554c-4247-844d-8b34183f57d5",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782346554",
            "to_ids": true,
            "type": "md5",
            "uuid": "84e23e74-9cbc-4028-85dc-5911d4408695",
            "value": "4e143876eeaf5e767a9971f603b0f13c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782345993",
            "to_ids": true,
            "type": "sha1",
            "uuid": "20c3b89d-b0f3-40e4-bb88-65054286d25d",
            "value": "8ebac142e34a20c297d3ccaca7ee5d9ddd24fed4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782345993",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f0afa835-3965-4e06-9a66-9f4d5dd09db2",
            "value": "558b4f1d9a263c13756ab0126c09dd080c85ba405b29488e1c4e6aa68b554f1f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782343615",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3e3824dc-4878-49be-a358-51fc79eaad7c",
            "value": "12288:56thPfKxDRBaaIEgDOh6+v+got/2Wx531fjkcVACebl33arrNYZPE2ZgWvkkViuz:cynJ+gooGQP378IvmoFB"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782343615",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "80c4a8ad-d733-4ce5-ab6f-d410a462a2c9",
            "value": "824552"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782343615",
            "to_ids": true,
            "type": "filename",
            "uuid": "25a97415-d2d2-4083-a0d2-a28680c6b623",
            "value": "orybbbdsuqmaapel.wasm"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  21/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782343615",
            "to_ids": false,
            "type": "text",
            "uuid": "27b1350d-1296-4067-b133-39c510054923",
            "value": "Type Description: unknown\nMicrosoft: Trojan:JS/GlassWorm.ST!MTB\nVT Total Detection:13/60\nFirst Submission:2026-06-10T01:09:58.000000+00:00\nLast Submission:2026-06-10T01:09:58.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782346575",
        "uuid": "5a13eea1-187e-4e1f-af2a-66984190c7e8",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782346575",
            "to_ids": true,
            "type": "md5",
            "uuid": "1b2a41a1-0bc7-4a73-8962-deb278989481",
            "value": "b262b8d2ac2f0ab3c78251db44ecf3ac",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782345994",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6062d689-27dd-4dff-b58b-b225cd24f308",
            "value": "c0ed7d575fe8085e942898c9a26f15992c895ba9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782345994",
            "to_ids": true,
            "type": "sha256",
            "uuid": "18aa6a39-dbf1-4696-919c-894557d3032f",
            "value": "3aa31999398e7f80231c03d7137ffdb554a84b83dbcffc59ce16c9a65f9e5d58",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782343637",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7985b196-78f3-45e4-ac8d-3cbba2733d46",
            "value": "12288:perWsXiTI+SS3R0KCq81MCdRPqAgOtvAzXRF5NoQ6/CXng8hKQXkuJ1RWQkQtgSa:piWJI+Hh0KCq8a4qA4D5No3/CXnKQ0i2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782343637",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "c0f99fae-e149-413f-b736-852cddc5c648",
            "value": "656847"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782343637",
            "to_ids": true,
            "type": "vhash",
            "uuid": "778a0e80-fd9a-4da5-b1d2-cceece53a997",
            "value": "1d608cdd1f4202e620c3212c7fcfc50e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782343637",
            "to_ids": true,
            "type": "filename",
            "uuid": "e77231f0-ac3d-41f7-a3d0-602eac6bb53c",
            "value": "noellee-doc.flint-debug.0.1.1.vsx"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  21/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782343637",
            "to_ids": false,
            "type": "text",
            "uuid": "b75d9440-ac30-4e40-9460-360f69d4b741",
            "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:19/65\nFirst Submission:2026-06-11T00:26:37.000000+00:00\nLast Submission:2026-06-11T00:26:37.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782346596",
        "uuid": "2efbbf9a-bc7e-4622-9156-d5303a802f1c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782346596",
            "to_ids": true,
            "type": "md5",
            "uuid": "37888f6b-d005-418d-836c-cf27078f3b76",
            "value": "f595fb7867beb76b4deab53fa328e0a2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782345995",
            "to_ids": true,
            "type": "sha1",
            "uuid": "12c18929-261a-4e8c-8efd-0a27650370eb",
            "value": "824e601b599b9ad97ee12f0b3a72efd20ba59d47",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782345996",
            "to_ids": true,
            "type": "sha256",
            "uuid": "bc0a0ac6-9aa4-4ab7-881a-d5f7f95b28bf",
            "value": "1e283327ad048bea39f4a8501770858a20f3555e87fe3e202274f2e87f8a3c25",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782343658",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "537fdafc-b269-43e4-8ac1-6082ed82ae1f",
            "value": "6144:sJXImBhSrtVA/COaJ9tqo3A8so+MG+K6jSMdkuJ1EqJMQkQYG1hQT+/gSmx8g:seoQ6/CXng8hKQXkuJ1RWQkQtgS/g"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782343658",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a891be2d-1ece-4f84-ace7-2bc2c2ff92a2",
            "value": "334836"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782343658",
            "to_ids": true,
            "type": "vhash",
            "uuid": "63f03ce9-9beb-44fb-8f95-911319668470",
            "value": "369cffc187420ebf4ebb40ff66cd1121"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782343658",
            "to_ids": true,
            "type": "filename",
            "uuid": "d3408687-bf41-4566-9a78-89fff0443f5b",
            "value": "ExarGD.vsblack.0.0.1.vsx"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  21/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782343658",
            "to_ids": false,
            "type": "text",
            "uuid": "29cf0d42-07bc-42a5-9a47-ebe0465f4df7",
            "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:14/64\nFirst Submission:2026-06-10T01:09:56.000000+00:00\nLast Submission:2026-06-10T01:09:56.000000+00:00"
          }
        ]
      }
    ]
  }
}