{ "Event": { "analysis": "1", "date": "2026-06-26", "extends_uuid": "", "info": "[Threat Intel] Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages", "protected": false, "publish_timestamp": "1783089829", "published": true, "threat_level_id": "2", "timestamp": "1783089829", "uuid": "475097b7-9f3d-4fea-9ea2-38eae1389f38", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Shai-Hulud\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"npm\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#18005e", "local": false, "name": "rectifyq:topic=\"supply-chain\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782730816", "to_ids": false, "type": "link", "uuid": "14e884dd-f3b1-4aeb-9c42-7d22166c3a17", "value": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-packages" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782730816", "to_ids": false, "type": "text", "uuid": "15e5272c-17cb-42e2-9bdd-0fcdf7311a42", "value": "A fresh wave of the Miasma Mini Shai-Hulud supply chain campaign compromised legitimate npm packages under the @immobiliarelabs scope on June 26, 2026. The attack targeted Backstage plugins used for GitLab integration and LDAP authentication, affecting 22 package versions across multiple releases. The malware employs sophisticated techniques including hidden payloads that bypass standard package reviews, steals developer credentials and CI/CD secrets, and exploits GitHub Actions workflows for propagation. The campaign appears linked to a compromised upstream GitHub Action (codfish/semantic-release-action) and leverages deployment-triggered workflows for execution. Stolen credentials include npm tokens, GitHub tokens, cloud credentials, SSH keys, and various authentication secrets, which are exfiltrated to attacker-controlled repositories for further propagation across the ecosystem." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782730816", "to_ids": false, "type": "text", "uuid": "e1475bc5-16d8-456f-b576-3f617eabe12c", "value": "Name: Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages\nAuthor: AlienVault\nAdversary: \nTags: [\"backstage plugins\", \"ci/cd compromise\", \"supply chain attack\", \"github actions\", \"miasma mini shai-hulud\", \"npm compromise\", \"credential theft\", \"immobiliarelabs\", \"developer infrastructure\"]\nTgtd countries: []\nMlwr families: [\"Miasma Mini Shai-Hulud\"]\nAttack_ids: []\nIndustries: [\"Technology\"]" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077055", "to_ids": true, "type": "sha256", "uuid": "987814f1-eee9-4539-863b-1d7cf6e51b7d", "value": "0574f0bee78294a5f3495144ea6e05848c5fe8dcda11414e35c65aea46ce953b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077056", "to_ids": true, "type": "sha256", "uuid": "93b6bd79-3aec-4c3c-b2f8-42c7bd2732d2", "value": "0ccd7c44a6352f295f65ffea21c2472566f9e73c4dd1028fe0b9971314b18de6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077057", "to_ids": true, "type": "sha256", "uuid": "a0281c34-9564-47f9-b47e-af143233f148", "value": "14253cd5b8acccbbacb5cd3bb0a099fb6b0aafe4d06d032e4070b3fb814677dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077058", "to_ids": true, "type": "sha256", "uuid": "299e15c6-7a1d-46f4-acba-e4a67fe5867f", "value": "1623787aa0de7310a4585101212b41ae02d02801ebda5812395932392400c756", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077059", "to_ids": true, "type": "sha256", "uuid": "0db5ad09-e0e7-4780-bf56-0c6c0fa2c0cc", "value": "1e7b04a9a4a25eb7928821a5519b0a40f7afe0f6042a6860c918b62d369096ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077061", "to_ids": true, "type": "sha256", "uuid": "31053b76-cbfd-4141-a8c6-c79db8387cbc", "value": "24c578c2573bf7a04f69c4762a36a87fd32746e9db4df16b2ad92f31fbdd0d50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077062", "to_ids": true, "type": "sha256", "uuid": "dec4dcd0-b1a7-41ec-9e63-005108a07ee7", "value": "2ffed3b58bc267c438c759cd03b3e890904f25bacd015608f888c302741cad29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077063", "to_ids": true, "type": "sha256", "uuid": "cf43795f-d321-49e1-aa35-a081a606a325", "value": "333f2e3753063447819a3c86cfc475fe4bd3f0a76c05262a61c3d18b50438bb5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077064", "to_ids": true, "type": "sha256", "uuid": "82eef611-2195-4114-b864-02b72c8b12f1", "value": "3809fd3a3a912abccaa7aa201880a2cfd194ae7f9dbdc747872cd045bcb3def5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077065", "to_ids": true, "type": "sha256", "uuid": "279539d2-f97f-4a6c-b11e-0cd913ed5b05", "value": "3b24b47a66b17d39fbdb7deccc329342b18cec6feb967adbaf80e81a70ecc609", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077066", "to_ids": true, "type": "sha256", "uuid": "6f4ed289-8ccd-4a30-a2e0-45f93784462b", "value": "441d834d8a97b3d76bd7a9ac73174a18c1add1bf80b21319c0cb2d5737782e83", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077067", "to_ids": true, "type": "sha256", "uuid": "65b9e8ef-82eb-4e69-b976-dacbbb2bec3e", "value": "54086c0f23710ff45cb6bde498083d0a0098112aab9b0ef48e6e869a280f1b42", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077068", "to_ids": true, "type": "sha256", "uuid": "31b6a533-8262-470c-8286-7af0573a9e15", "value": "60099babe48a48831262b40d4c5c1dd623726060da10c1e2f74f191c9c4cd81d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077069", "to_ids": true, "type": "sha256", "uuid": "ac1384ef-97ce-4b85-bf55-dd20e8307203", "value": "7a879ed69a8191df5c68535f6ac41b830577b698de943c66ff40e51482d90d79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077070", "to_ids": true, "type": "sha256", "uuid": "b7c3f912-9a2a-49bb-8abf-ef6dd8351694", "value": "7bc28ba4d33d010785a5289211ad6a0d968ec0abd56201d90d74921ad83d925d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077072", "to_ids": true, "type": "sha256", "uuid": "701661e7-d2a5-4971-b3fc-ac6354b01274", "value": "7cd21d65d5a085d82d07275df9a66c6dfac4e13e43ea9ef44e84a3dd14ea1b3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077073", "to_ids": true, "type": "sha256", "uuid": "0d809810-ad93-4049-b1ea-8b3746cfc69a", "value": "8284d9bd16c9141d331d3b724f9d57ae2cae265bf326055e18d5cde4bb5985b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077074", "to_ids": true, "type": "sha256", "uuid": "d07b8434-3138-49a8-8c1b-21f072802d1f", "value": "869ffe5400477ce69bbfd5f51ddd0c40eacad9a83005956fb14787a5e1e98330", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077075", "to_ids": true, "type": "sha256", "uuid": "bd055afb-930e-4e2c-9e28-0a234aefe717", "value": "8746d49834ad938eebeaffd380b6302c94ab0b3258268c1a8c7e57ee7d5c11e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077076", "to_ids": true, "type": "sha256", "uuid": "16a5a96a-45df-41e3-b24d-4c6f3017f8b1", "value": "89c218ca407c2d92359b53a9e3b7b973a761dcf323d2fa1cc2dc12c13f27afaf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077077", "to_ids": true, "type": "sha256", "uuid": "60975c3c-e2a4-400a-9c24-150500669cbd", "value": "8a71e7d9b6b1b6d3e7bee490e98b34595ceea207160fc7ed35e47f82160febbe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077078", "to_ids": true, "type": "sha256", "uuid": "8de8c71d-e064-4d1c-be95-87a2100774d0", "value": "8df5d46d91589e6a3ec8d87d6eea6c71fac103f9e10dff9b88c309c1e9129b07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077079", "to_ids": true, "type": "sha256", "uuid": "213ea6d5-df52-40eb-bfe0-eba3ee484541", "value": "8e83e3ece1a2a764a7c6fd78dd39cfb32cb38d22b7b3d92709cb5b87fa916403", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077080", "to_ids": true, "type": "sha256", "uuid": "abc3b407-5fdf-4938-9e01-77e104895906", "value": "99eb789284fa62e3f956e81294247ae82f596ebf481c069ae45019ac4e879927", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077081", "to_ids": true, "type": "sha256", "uuid": "404b3823-a96f-4554-bac6-b2ed1c0cd5f8", "value": "9d8ea3cefb942081a1409e842ddc541ccd65fb3e66a4f8dfe562ca8548dd09d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077083", "to_ids": true, "type": "sha256", "uuid": "de74afbf-14da-4bda-b8e5-d8a794adbee9", "value": "9df6bda43678708605dfaad35f02be8027e85e6aa38193704cf192f842f0d186", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077084", "to_ids": true, "type": "sha256", "uuid": "99a4ca03-3437-473d-8fcc-0c0502616253", "value": "a09909e8981e17712ef38b363f94553e2f86b6c2abd6c87eada94d3d3aab937e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077085", "to_ids": true, "type": "sha256", "uuid": "dd2f4dea-3676-4b4d-9c84-e996d3904c75", "value": "a16810f972f577f129f95f147e64aa4c70977035285d357a53958496c0531223", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077086", "to_ids": true, "type": "sha256", "uuid": "0aecb5a0-e7c0-489b-8b69-4a224fbfbdfc", "value": "b4f90f5515df39cf346bf436e284f2dae28c9341c035765d83d82a76c86922b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077087", "to_ids": true, "type": "sha256", "uuid": "3bfa7340-cb0e-4eaa-a774-d1cc25bcabb4", "value": "b82f5f6f1d969ba8f32937a3d81306c631defa943b7cc7529e45a0003340ece5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077088", "to_ids": true, "type": "sha256", "uuid": "2047fa7e-49d6-4d70-9ffd-084b9f07a183", "value": "ca89ece660251554b66f1e5e9874410d206e0f080da3039e1221f1c71d817395", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077089", "to_ids": true, "type": "sha256", "uuid": "a1a364e2-a5f2-4c4c-95ae-1ee1fa7566d8", "value": "cc00c23768bee76e2f297c1766a013a681efb519888545352cff96fc5cead035", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077090", "to_ids": true, "type": "sha256", "uuid": "f014310a-1370-4a80-b79c-802a679683dd", "value": "cf5d79494d8b1fdcb5480507eee8beeb2fcd69bcd9afcdc7dc1bcdda7461913e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077091", "to_ids": true, "type": "sha256", "uuid": "0622e7af-2a59-493d-a69f-dd1e85347703", "value": "d2aa3f9057c6f3295766aabed0a71a369353d6eb665049a45fd407fd55020fdb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077092", "to_ids": true, "type": "sha256", "uuid": "c36ccb9e-4185-4e03-9970-73127c99652b", "value": "dfcdec5f43cc8d127084a2ac4d66499f13bae7f49167e3291a6f1a70738772d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077093", "to_ids": true, "type": "sha256", "uuid": "9ee8c889-c39c-47cf-a9ba-a52b718b6627", "value": "ef01e18ccf618a8992ad0aa4eb7d804bbacf9f092d43d39237f283a9a289c9b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 03/07/2026 No sample in VT\r\nLast check: 03/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783077094", "to_ids": true, "type": "sha256", "uuid": "cb08b256-2415-4f50-ab15-0fe3edde3d49", "value": "ef89e81be6b9d81b9d4bc41dae5f10a7a68f33b17fd76affcf7dca2f5d50a843", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081529", "uuid": "d0324073-ac50-4801-8a8c-1ea97d4640a2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "object_relation": "md5", "timestamp": "1783081529", "to_ids": true, "type": "md5", "uuid": "9da451f3-6a39-43b2-9c51-61dabe9d6e07", "value": "a6a5c6a53644d3bde0ca8ef7a9a64d28", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "object_relation": "sha1", "timestamp": "1783077044", "to_ids": true, "type": "sha1", "uuid": "f243408f-6612-4a56-b916-b57ce3139424", "value": "a2f2f1f9d0de1bb16fb96fa57e3b0995679dd583", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "object_relation": "sha256", "timestamp": "1783077044", "to_ids": true, "type": "sha256", "uuid": "67abfebb-b51f-4134-8f6a-be29c46c8ea4", "value": "ef641e956f91d501b748085996303c96a64d67f63bfeef0dda175e5aa19cca90", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "object_relation": "text", "timestamp": "1783029093", "to_ids": false, "type": "text", "uuid": "0796633c-ab63-4954-aca4-c13c6aa0e2cd", "value": "Type Description: JSON\nMicrosoft: Trojan:JS/PhantomWorm.DA!MTB\nClamAV: None\nVT Total Detection: 19/74\nFirst Submission: 2026-06-04T09:37:58+00:00\nLast Submission: 2026-06-04T09:37:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "object_relation": "ssdeep", "timestamp": "1783029093", "to_ids": true, "type": "ssdeep", "uuid": "10c7442f-8b2a-4dbc-a8fc-1e8f2d9ee9e0", "value": "3:HS0WL/7ES069UW7d/FFzc8fp7fF0KF4HZENLK147YNsFtxfQ/CICYn:HS0WUS063gaiALKG7zFnfQjbn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1783029093", "to_ids": false, "type": "size-in-bytes", "uuid": "f53f8762-d79e-4760-a07e-2cfa71bb8fdd", "value": "157" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-04T09:37:58+00:00", "last_seen": "2026-06-04T09:37:58+00:00", "object_relation": "filename", "timestamp": "1783029093", "to_ids": true, "type": "filename", "uuid": "b4715cc1-9b0d-446a-bb0e-f24b00d2f1ab", "value": "binding.gyp" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081550", "uuid": "f8908b6c-2a9c-4269-90ba-c594d1a8ec8c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "md5", "timestamp": "1783081550", "to_ids": true, "type": "md5", "uuid": "8c37b39a-baa7-4405-8a93-0ce404110557", "value": "65f4285c1e8d3a8686eca6e484aa2d4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "sha1", "timestamp": "1783077045", "to_ids": true, "type": "sha1", "uuid": "c656f5c7-f322-47ce-82e8-dd6d782b79c1", "value": "7b4d99626d9c8bfa9fa0f8006e6d37c66320e57d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "sha256", "timestamp": "1783077045", "to_ids": true, "type": "sha256", "uuid": "821b5104-eea7-4cfd-9240-ad0b41a6e2e5", "value": "2f6cbe3a79148bc247131c36cd12689c97166a9d141dd9d9466270b4c04c3e3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "text", "timestamp": "1783029315", "to_ids": false, "type": "text", "uuid": "8a801eea-1a85-4057-9380-8d9ef13e0e09", "value": "Type Description: GZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-06-27T12:59:53+00:00\nLast Submission: 2026-06-27T12:59:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "ssdeep", "timestamp": "1783029315", "to_ids": true, "type": "ssdeep", "uuid": "8ec9c8f1-6ff1-4362-b4ad-7a47ffcad142", "value": "24576:Ae0PlfgVbMbfvW2yCZzS4UBd8PHgis1B33QVbURLkEi:XGJwKOkZz6BKPHgX1B33QVb+Xi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1783029315", "to_ids": false, "type": "size-in-bytes", "uuid": "3d1aa0a5-c1ad-4241-964c-863fd1f3ff81", "value": "1213153" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "vhash", "timestamp": "1783029315", "to_ids": true, "type": "vhash", "uuid": "54a8dcaf-9fea-4522-a203-9107a3ede99b", "value": "18aa629b135c7765c0d7cf7d38ed11c3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:59:53+00:00", "last_seen": "2026-06-27T12:59:53+00:00", "object_relation": "filename", "timestamp": "1783029315", "to_ids": true, "type": "filename", "uuid": "d2930a11-8e27-45c9-b068-1d6b97a7ff6c", "value": "@immobiliarelabs-backstage-plugin-gitlab-3.0.3.tgz" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081571", "uuid": "2a1b94ff-20fc-42cc-b217-2699c94b7f5c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "md5", "timestamp": "1783081571", "to_ids": true, "type": "md5", "uuid": "49d72808-beb3-464a-90b9-cbde315b2388", "value": "d28f5df28af826eb61f39a2ef15fb96f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "sha1", "timestamp": "1783077047", "to_ids": true, "type": "sha1", "uuid": "6cae8e8f-2d9d-48ea-9b1e-c68497ed359f", "value": "c63e6d86ebe37f171040f18d916eab0b943e1c26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "sha256", "timestamp": "1783077047", "to_ids": true, "type": "sha256", "uuid": "9557b3d1-f705-457d-8ac6-c0e7b5a97ce5", "value": "3667e7080c083563f6d05118d8b08f535b391fe2a5c0f98d5bd31f96257620f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 30/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "text", "timestamp": "1783029379", "to_ids": false, "type": "text", "uuid": "d581288a-20fb-4021-9c78-c6f1de814160", "value": "Type Description: GZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-06-28T23:23:02+00:00\nLast Submission: 2026-06-28T23:23:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "ssdeep", "timestamp": "1783029379", "to_ids": true, "type": "ssdeep", "uuid": "4cc078f3-bb81-40e7-bc38-6081ddb291a4", "value": "24576:CvU/jP4Y2PVlgK9v3AMFphwWwAPnwVnSFpeKbXmDT23KrzL:CvU7kPAK9vwMhwWnZpwEKrn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1783029379", "to_ids": false, "type": "size-in-bytes", "uuid": "f21a7efc-7718-4700-88bc-6a2b812d497f", "value": "1179512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "vhash", "timestamp": "1783029379", "to_ids": true, "type": "vhash", "uuid": "09525ce8-4b66-4310-bf51-04cb1a7e3fa7", "value": "425ad95028f353ff95755c54bbb25bb4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-28T23:23:02+00:00", "last_seen": "2026-06-28T23:23:02+00:00", "object_relation": "filename", "timestamp": "1783029379", "to_ids": true, "type": "filename", "uuid": "1eedd314-4280-4436-8a70-afa714927c34", "value": "@immobiliarelabs-backstage-plugin-ldap-auth-2.0.5.tgz" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081592", "uuid": "6befbb4d-9001-4378-b9b9-5c333f912e29", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "md5", "timestamp": "1783081592", "to_ids": true, "type": "md5", "uuid": "2df230aa-b090-4946-93f3-dc99cc899388", "value": "0eba063f26c71cdc21a77928dc9c8160", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "sha1", "timestamp": "1783077048", "to_ids": true, "type": "sha1", "uuid": "1ba31f8e-1ead-4f0e-ab65-9e76d61035d4", "value": "3cba5fd4d6fa6e9ed7aa7a79523f2bb97eeb5645", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "sha256", "timestamp": "1783077048", "to_ids": true, "type": "sha256", "uuid": "ccecfc03-8b3e-4fd2-9311-96f0c5d925ee", "value": "63667208bcd2d307b307e6df43bf8960ccb7058333d00ba064ed53f180ec32ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 29/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "text", "timestamp": "1783029505", "to_ids": false, "type": "text", "uuid": "74a66fe1-912b-4570-bf02-2ac95c9a7ce6", "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/MiniShaiHrd.ZA!MTB\nClamAV: None\nVT Total Detection: 18/75\nFirst Submission: 2026-06-29T03:36:52+00:00\nLast Submission: 2026-06-29T03:36:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "ssdeep", "timestamp": "1783029505", "to_ids": true, "type": "ssdeep", "uuid": "fa6c16d1-f5dd-4c44-8449-b39962928ea7", "value": "768:AdYJHN9TCkLnua0BMiT0DyUM6KGKx18o7a/wgA3BeNTWtoiNbyWRqsMW4gVKq6sP:AdF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1783029505", "to_ids": false, "type": "size-in-bytes", "uuid": "799f29ac-ca27-4d44-879a-a15663b2732c", "value": "5285438" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "vhash", "timestamp": "1783029505", "to_ids": true, "type": "vhash", "uuid": "5932e45a-9043-4074-9022-cd55d7ea1277", "value": "4b37ee64e39a6449904a4968eb4bf1ed" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T03:36:52+00:00", "last_seen": "2026-06-29T03:36:52+00:00", "object_relation": "filename", "timestamp": "1783029505", "to_ids": true, "type": "filename", "uuid": "30eb7c04-0b9e-426f-9f90-564a1729dd80", "value": "index.js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081613", "uuid": "0f930f72-e89f-407e-9b22-3a78e0f3a8c2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "md5", "timestamp": "1783081613", "to_ids": true, "type": "md5", "uuid": "ed136967-790a-4f61-ab99-05bc3a74f670", "value": "303e6b88d7ff48a80972da23b23f1cfe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "sha1", "timestamp": "1783077049", "to_ids": true, "type": "sha1", "uuid": "720f929e-8f64-4908-b982-a5d15ec9ff49", "value": "a36134e065b6317977cefdd689e4f618634d4919", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "sha256", "timestamp": "1783077049", "to_ids": true, "type": "sha256", "uuid": "f372c620-b328-4d84-933d-e37c97ae1328", "value": "720571b83600cd61080a7779e7f44327e4df4974d4a01475439d2e59e11ab29f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 01/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "text", "timestamp": "1783029526", "to_ids": false, "type": "text", "uuid": "566e0128-d0ed-4c93-9c17-5d1c416c2bce", "value": "Type Description: GZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-06-27T12:59:24+00:00\nLast Submission: 2026-06-27T12:59:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "ssdeep", "timestamp": "1783029526", "to_ids": true, "type": "ssdeep", "uuid": "a0aaa0cd-bd2c-4b7c-98ab-21517b6f8015", "value": "24576:BfPIYZUJ6ZsMqCkiTvDlrw3fQYgR+PaT64120JLHqdCE6RWnq:VIepZdw4YgR+Wto3fq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1783029526", "to_ids": false, "type": "size-in-bytes", "uuid": "2f46b693-06b4-4044-b3b2-ee6fb4c96026", "value": "1211805" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "vhash", "timestamp": "1783029526", "to_ids": true, "type": "vhash", "uuid": "04f0b204-2f03-42fc-9dc9-09164f0dc80e", "value": "18aa629b135c7765c0d7cf7d38ed11c3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:59:24+00:00", "last_seen": "2026-06-27T12:59:24+00:00", "object_relation": "filename", "timestamp": "1783029526", "to_ids": true, "type": "filename", "uuid": "a374612b-8437-4f5a-b98d-2c2d46c50a44", "value": "@immobiliarelabs-backstage-plugin-gitlab-5.2.1.tgz" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081635", "uuid": "3b8219a3-b816-4267-aa6e-1a87074f2745", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "md5", "timestamp": "1783081635", "to_ids": true, "type": "md5", "uuid": "cacbb74a-bd2b-4db1-bd49-4bc0c5d132d3", "value": "db767429082617f236d61628d19cf100", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "sha1", "timestamp": "1783077050", "to_ids": true, "type": "sha1", "uuid": "36ab7d66-40da-41d8-b919-26ffed23b8f6", "value": "08664303657e7889f51f4d1fe4882847873d165c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "sha256", "timestamp": "1783077051", "to_ids": true, "type": "sha256", "uuid": "5ef0891a-084a-4755-beeb-36d9076d27bd", "value": "b38a73c365e5761fe0e7f25a391db3a264b1f2b4878a1c8cc127ba83d64e614c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 29/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "text", "timestamp": "1783029861", "to_ids": false, "type": "text", "uuid": "eb8aa31d-b100-457d-9370-702d83207217", "value": "Type Description: GZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/75\nFirst Submission: 2026-06-27T12:57:54+00:00\nLast Submission: 2026-06-27T12:57:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "ssdeep", "timestamp": "1783029861", "to_ids": true, "type": "ssdeep", "uuid": "c622e6b5-9145-49a6-961d-9c81bf52b5f7", "value": "24576:pY/KKe8KaiPiMT3NgjGtGvwBYNKI2wU6aFF:plHai7beEGo8/Q/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1783029861", "to_ids": false, "type": "size-in-bytes", "uuid": "adbafa77-e06d-433c-b146-633e909f35f1", "value": "1181286" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "vhash", "timestamp": "1783029861", "to_ids": true, "type": "vhash", "uuid": "1cc2f1b3-12c9-42fa-95e5-f765f2b21031", "value": "5a7de8fdc0615985ae7e109d0ff57d6a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:57:54+00:00", "last_seen": "2026-06-27T12:57:54+00:00", "object_relation": "filename", "timestamp": "1783029861", "to_ids": true, "type": "filename", "uuid": "7dc141fc-dca9-45e4-ab7e-4e443d38d2f0", "value": "@immobiliarelabs-backstage-plugin-ldap-auth-4.3.2.tgz" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081656", "uuid": "d84ed526-b229-487e-9411-922ac6081f49", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "md5", "timestamp": "1783081656", "to_ids": true, "type": "md5", "uuid": "1bfff7d6-a72a-4e37-aa55-926b618ba0c2", "value": "fbf963bedaf17a646cb2a2913114e0b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "sha1", "timestamp": "1783077052", "to_ids": true, "type": "sha1", "uuid": "6fdae6c3-833b-4a86-9fbe-ca7dba328f79", "value": "98c1fc254bc6b2f72c28713f094d0e67372cadb5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "sha256", "timestamp": "1783077052", "to_ids": true, "type": "sha256", "uuid": "ebededb3-037d-41bd-aa4a-7912bd071cb3", "value": "cf46348e7a4beacc0b9600c9ece3bee140f344641e90d99c741bc54507423443", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 30/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "text", "timestamp": "1783031106", "to_ids": false, "type": "text", "uuid": "12c092f6-9d83-4b38-b74e-6fd4faed9b8b", "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/MiniShaiHrd.ZA!MTB\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-06-29T06:21:41+00:00\nLast Submission: 2026-06-29T06:21:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "ssdeep", "timestamp": "1783031106", "to_ids": true, "type": "ssdeep", "uuid": "27d5b7ad-eefa-40f2-906e-716667d6ffce", "value": "768:Azd1qB+bp7nHzfxpP5g3A7udDrmh4hSJeN88lgOxy2+GfsD8ucvDaAQlgvccD9lG:Afz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "size-in-bytes", "timestamp": "1783031106", "to_ids": false, "type": "size-in-bytes", "uuid": "afa82549-3c9d-4be8-a69e-ab46f9f45e93", "value": "5285364" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "vhash", "timestamp": "1783031106", "to_ids": true, "type": "vhash", "uuid": "30c78e05-2d33-45bc-b482-7a8648cdfa6c", "value": "4b37ee64e39a6449904a4968eb4bf1ed" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T06:21:41+00:00", "last_seen": "2026-06-29T06:21:41+00:00", "object_relation": "filename", "timestamp": "1783031106", "to_ids": true, "type": "filename", "uuid": "da403f3f-8417-490a-9ce9-0776e233829c", "value": "malware03-js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783081677", "uuid": "0a2fae03-15a1-4243-8d5e-345b0bc33497", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "md5", "timestamp": "1783081677", "to_ids": true, "type": "md5", "uuid": "3a6cd125-73b4-44fa-b149-e4989baedabe", "value": "6ac0102060f5007daaaa82bea10a6b19", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "sha1", "timestamp": "1783077053", "to_ids": true, "type": "sha1", "uuid": "cdad0a5e-08b0-452b-a879-a4327261882a", "value": "0ef092f8a08f98cdb9670496e2bbe567dde514e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "sha256", "timestamp": "1783077053", "to_ids": true, "type": "sha256", "uuid": "3fee31bd-ddda-4990-94b3-441f224243d8", "value": "d1db13a14db489531e11ccf700d7fd8701f61ad297ce02477e11acf194d3fed0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 29/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "text", "timestamp": "1783031149", "to_ids": false, "type": "text", "uuid": "26765b2a-0c04-4eb6-86d2-147107d728be", "value": "Type Description: GZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 24/75\nFirst Submission: 2026-06-27T12:51:24+00:00\nLast Submission: 2026-06-27T12:51:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "ssdeep", "timestamp": "1783031149", "to_ids": true, "type": "ssdeep", "uuid": "92f4bc5d-8bdb-4834-b01e-e3934d3b6ae4", "value": "24576:qzPI67+KHX5Y9dHM/Ho4AWCCSrn/B2N0lM4ny/vGIWexZ6l1qxn/O7:qzP5+OX5Y6/IThZ2N0xSRWo4PqlO7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1783031149", "to_ids": false, "type": "size-in-bytes", "uuid": "a0dc04a9-ebb7-4ed9-9418-d96292c79084", "value": "1160549" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "vhash", "timestamp": "1783031149", "to_ids": true, "type": "vhash", "uuid": "5c38f46f-37fb-4be8-8622-382ac6330259", "value": "425ad95028f353ff95755c54bbb25bb4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T12:51:24+00:00", "last_seen": "2026-06-27T12:51:24+00:00", "object_relation": "filename", "timestamp": "1783031149", "to_ids": true, "type": "filename", "uuid": "452c1101-6390-4bbe-9e82-66d40a90b168", "value": "@immobiliarelabs-backstage-plugin-ldap-auth-1.1.4.tgz" } ] } ] } }