{
  "Event": {
    "analysis": "1",
    "date": "2026-07-14",
    "extends_uuid": "",
    "info": "[Threat Intel] Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader",
    "protected": false,
    "publish_timestamp": "1784437725",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1784437725",
    "uuid": "5bc69e1e-25a1-4ad1-9368-a097675c0162",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf6f24",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#00f752",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#f07d7c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#07a4a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#44b2c2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#40fad1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"npm\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084411",
        "to_ids": false,
        "type": "link",
        "uuid": "e54c39ed-10c0-4552-9c42-b968332e9474",
        "value": "https://socket.dev/blog/asyncapi-supply-chain-attack"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084411",
        "to_ids": false,
        "type": "text",
        "uuid": "86e194ab-52f1-49ad-b276-675b2848f6fb",
        "value": "Four npm packages in the AsyncAPI namespace were compromised to distribute a multi-stage botnet loader called Miasma. The attack utilized trusted GitHub Actions publishing but originated from a poisoned source commit. Malicious code was injected into legitimate source files that execute when imported, launching a detached Node.js process to download an 8.25 MB encrypted payload from IPFS. The final payload is a sophisticated tasking framework supporting multiple command-and-control channels including REST, Nostr relays, IPFS, Ethereum smart contracts, and BitTorrent DHT. The framework establishes persistence via systemd services on Linux and fake NodeJS directories, supporting file operations, shell execution, data collection, and cross-ecosystem propagation capabilities for npm, PyPI, RubyGems, and Cargo ecosystems."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084411",
        "to_ids": false,
        "type": "text",
        "uuid": "df4b3241-3ec2-47e4-9fe1-33ab5ef51840",
        "value": "Name: Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader\nAuthor: AlienVault\nAdversary: \nTags: [\"cross-platform\", \"ipfs delivery\", \"trusted publishing abuse\", \"multi-stage loader\", \"systemd persistence\", \"npm supply chain\", \"miasma\", \"asyncapi\", \"miasma botnet\"]\nTgtd countries: []\nMlwr families: [\"Miasma\"]\nAttack_ids: [\"T1059.007\", \"T1140\", \"T1090\", \"T1568\", \"T1102\", \"T1041\", \"T1547.001\", \"T1048\", \"T1059.004\", \"T1571\", \"T1027\", \"T1573\", \"T1195.002\", \"T1059.006\", \"T1132\", \"T1071.001\", \"T1543.002\", \"T1105\", \"T1564.001\", \"T1008\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437178",
        "to_ids": true,
        "type": "url",
        "uuid": "672eca9e-db28-4215-a963-7814ca103b9a",
        "value": "https://ethereum-rpc.publicnode.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437200",
        "to_ids": true,
        "type": "url",
        "uuid": "f19b9994-5607-4657-ab41-57b5993bd5b5",
        "value": "http://85.137.53.71:8080/api/v1/beacon",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437222",
        "to_ids": true,
        "type": "url",
        "uuid": "246cf832-d79f-4ec6-a1b0-63934017d70b",
        "value": "http://85.137.53.71:8080/api/v1/file-result",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437243",
        "to_ids": true,
        "type": "url",
        "uuid": "3c265d00-6705-4312-97ec-f80232affa2f",
        "value": "http://85.137.53.71:8080/api/v1/file-content/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434551",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ac31655b-217c-476a-a9a1-7a00caf286ba",
        "value": "34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434552",
        "to_ids": true,
        "type": "sha256",
        "uuid": "257bde64-0bfc-4a22-a13b-0939624df2a9",
        "value": "082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434553",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4f1cf73e-44e7-473e-9ec1-593ad36a1309",
        "value": "9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434553",
        "to_ids": true,
        "type": "sha256",
        "uuid": "8406cf1e-6795-4769-ba40-3ccf1cd1a870",
        "value": "d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434554",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e6b0b667-bece-4487-b510-dca653a57339",
        "value": "6e78713b75bd34828d49896176627f7face7aa9036cd874f2e02d9f23a9a9c71",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434555",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e8fba633-6168-4bf3-9c49-841f20574755",
        "value": "b270bdf8e2274ea1af0a6eed74d8f10e5fe61012d6cc226a43cc7cc7fd9f6292",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434556",
        "to_ids": true,
        "type": "sha256",
        "uuid": "9c6b2e36-04c0-44c3-ab54-d6f9b5742a17",
        "value": "8351d251cf0b5a0bd82242deaa0a14e3e1394418d55c0f4259dac4303b79fc0c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434557",
        "to_ids": true,
        "type": "sha256",
        "uuid": "6cf5ae28-63c6-43c5-bbd1-15a70298c3ee",
        "value": "550af477c12192a22f5c9edb9c8081c0a789b3a1a2992a7ecb157cca1c975e10",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434558",
        "to_ids": true,
        "type": "sha256",
        "uuid": "3c762089-e681-42fe-8a82-66e440f15f70",
        "value": "9f1a709310824f9110c6203d861a721ebefba8b204a8657057fe57efb961c850",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434559",
        "to_ids": true,
        "type": "sha1",
        "uuid": "74805e3f-dcfc-4181-80fb-ccbb447901f1",
        "value": "3eab3ec9304aa26081358330491d3cfeb55cc245",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437264",
        "to_ids": true,
        "type": "url",
        "uuid": "3330cc5d-2a37-49dc-acfd-8d1397b6e2b3",
        "value": "https://ipfs.io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437286",
        "to_ids": true,
        "type": "url",
        "uuid": "017b61eb-602e-4907-bebd-b0dfd304abe2",
        "value": "http://85.137.53.71",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437306",
        "to_ids": true,
        "type": "url",
        "uuid": "74d8c748-f611-4777-bc41-e3126d624ee6",
        "value": "https://ipfs.io",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437328",
        "to_ids": true,
        "type": "url",
        "uuid": "1986399d-155a-4003-8edf-b6bcfa708412",
        "value": "wss://relay.damus.io",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437350",
        "to_ids": true,
        "type": "url",
        "uuid": "829b5c0f-d4ba-4e8e-8246-29df95b7864b",
        "value": "wss://relay.nostr.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 6881",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437371",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9ccd5dd5-5a4b-4c51-a49e-7fabd0330831",
        "value": "dht.transmissionbt.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437392",
        "to_ids": true,
        "type": "url",
        "uuid": "02f5c363-3438-4bb2-a510-b4955ce0c93f",
        "value": "https://ipfs.io/api/v0/cat?arg=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437413",
        "to_ids": true,
        "type": "url",
        "uuid": "18b60653-693e-41c0-b297-35e9ea4dd247",
        "value": "Support/NodeJS/sync.js",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-14T17:34:20+00:00",
        "last_seen": "2026-07-14T17:34:20+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784437434",
        "uuid": "bfa63a00-a58c-404c-97f7-2a9570258393",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "md5",
            "timestamp": "1784437434",
            "to_ids": true,
            "type": "md5",
            "uuid": "dfa08523-83e8-4dbe-8f51-79a42c818c1b",
            "value": "d602f4eeb914cf32782799376a8c5953",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "sha1",
            "timestamp": "1784434546",
            "to_ids": true,
            "type": "sha1",
            "uuid": "cf4c8372-86e2-4522-95ae-a1587eed6bd6",
            "value": "93d8cffab1171a115228808e526d9bd7fe935e4e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "sha256",
            "timestamp": "1784434546",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f7b65711-8359-4a65-96db-3b2b811914ac",
            "value": "bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "text",
            "timestamp": "1784433805",
            "to_ids": false,
            "type": "text",
            "uuid": "eab804a4-0e5e-409e-876c-5226fa83bf64",
            "value": "Type Description: GZIP\nMicrosoft: Trojan:JS/ObfuseJS\nClamAV: None\nVT Total Detection: 21/74\nFirst Submission: 2026-07-14T17:34:20+00:00\nLast Submission: 2026-07-14T17:34:20+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784433805",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "453c50b6-d58c-4408-9f92-5359a2cb0de7",
            "value": "3072:Xx/VYOSZdaaXSrxv0lAyB14hH+ulg1UiVNdJe0ZV/Z:rSn2VEeEyiVNdzZVR"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784433805",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "49fd694b-ae88-4eef-9778-66507183c2d9",
            "value": "168416"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "vhash",
            "timestamp": "1784433805",
            "to_ids": true,
            "type": "vhash",
            "uuid": "81a2a20d-038e-475c-ad90-50c9fe706a80",
            "value": "b8a2c23f93b42e5bd4070c65b2c05f9f"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-15T05:12:39+00:00",
        "last_seen": "2026-07-15T16:50:27+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784437455",
        "uuid": "56310f0b-849d-4d18-b29c-4dfa0c6e1a7d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "md5",
            "timestamp": "1784437455",
            "to_ids": true,
            "type": "md5",
            "uuid": "8a2ad2d1-34a3-45dc-a383-f963c02658ce",
            "value": "d8a6b102c1715bd80393ce510931b1f6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "sha1",
            "timestamp": "1784434547",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c3bc2a7c-557e-44e0-997b-7f9fa852a58d",
            "value": "22bf76fe317ea6769bd38619bd440e42d119bd6b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "sha256",
            "timestamp": "1784434548",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1b93e882-5c00-4382-a1ba-660d10e952a6",
            "value": "b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "text",
            "timestamp": "1784433910",
            "to_ids": false,
            "type": "text",
            "uuid": "a7870ce1-6778-413f-a362-20d08d021c27",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/SupplyChainRisk.A\nClamAV: None\nVT Total Detection: 11/74\nFirst Submission: 2026-07-15T05:12:39+00:00\nLast Submission: 2026-07-15T16:50:27+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784433910",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "20552b9d-886a-4f9c-996c-ec5da7dfb5de",
            "value": "384:ZlKU3M2cyyBouN/xgVsFJgKdLQvKGSLE9JJk:ZlDhcyyBouNZgVY6fvKGIJ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784433910",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fee274c7-47d2-4404-9766-164ac0128b05",
            "value": "16288"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "vhash",
            "timestamp": "1784433910",
            "to_ids": true,
            "type": "vhash",
            "uuid": "bac9a7a1-e22e-477f-a833-d756b7adba89",
            "value": "5190a2922e3721dffb06475804b98f7f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "filename",
            "timestamp": "1784433910",
            "to_ids": true,
            "type": "filename",
            "uuid": "13d2e44b-4ffc-46be-bed3-52e369463b90",
            "value": "validator.js"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-14T12:48:12+00:00",
        "last_seen": "2026-07-14T12:48:12+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784437476",
        "uuid": "d911c94a-21b1-444b-952d-13b4219daa7a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "md5",
            "timestamp": "1784437476",
            "to_ids": true,
            "type": "md5",
            "uuid": "1695603e-715d-49b4-9132-a40045dd34dc",
            "value": "ea895416fe585a5c2a5dce207190ff1c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "sha1",
            "timestamp": "1784434549",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5f1ca6c3-f077-46ff-8822-94d6ef7aad3d",
            "value": "c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "sha256",
            "timestamp": "1784434549",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f314cad1-c555-404f-b8bc-dca3c9dbb8be",
            "value": "24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "text",
            "timestamp": "1784433973",
            "to_ids": false,
            "type": "text",
            "uuid": "82a5dc98-ecc4-4755-a705-99b46c9e085b",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Supychain.A\nClamAV: None\nVT Total Detection: 4/74\nFirst Submission: 2026-07-14T12:48:12+00:00\nLast Submission: 2026-07-14T12:48:12+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784433973",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f24b9b75-52d9-49cf-af49-0b463128b565",
            "value": "49152:o5U89pssHmTdE95gZZlU7q+tafdQWr38MCZ2qbHUY1QwkHbK/nld7bW9Hpom5U8z:5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784433973",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "30b8aa4c-10e8-42a4-ba2f-074ecce5517f",
            "value": "8254481"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "filename",
            "timestamp": "1784433973",
            "to_ids": true,
            "type": "filename",
            "uuid": "3548b721-7be0-46c3-bb54-fb868f56938e",
            "value": "QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-16T13:41:48+00:00",
        "last_seen": "2026-07-16T13:41:48+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784437497",
        "uuid": "3e032781-0c4c-4ef1-8138-3b41fe3514f2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "md5",
            "timestamp": "1784437497",
            "to_ids": true,
            "type": "md5",
            "uuid": "9aa7bfd8-0be6-4cb1-abcc-c2d41484a35d",
            "value": "81b71f779cb7d339ef4aa7e700a14c94",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "sha1",
            "timestamp": "1784434550",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a89fbade-c107-466e-bc91-2e0e240fc2b5",
            "value": "d12db72763bc8be436ddc9efbcf848a00be7387b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "sha256",
            "timestamp": "1784434550",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6fb19e3d-3993-4c91-9477-9114e7f99d02",
            "value": "9e214f38537e69bf51c7fa1ddd35ae495e9cb897231ec010baf9e4f29407ee9a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "text",
            "timestamp": "1784433995",
            "to_ids": false,
            "type": "text",
            "uuid": "ddf7b1c7-7c8f-4e32-b2a9-8e66a264f082",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/MiasmSupplyChain.SCD\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-07-16T13:41:48+00:00\nLast Submission: 2026-07-16T13:41:48+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784433995",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "60b35955-fb10-40f2-882e-3a22114f9984",
            "value": "24576:UOHbGGojPFEiwbRCGu1ABGlRMaBJd0aYgi+/ir5T16nywyrxoil:BHKGojPFEzRCrXIaYgi+Kr5T16Cxoil"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784433995",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9bcfdec0-cbe6-4de2-9956-76fbc5f33608",
            "value": "3093085"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "vhash",
            "timestamp": "1784433995",
            "to_ids": true,
            "type": "vhash",
            "uuid": "34a0a9a4-d2db-4349-83ba-701cd763085c",
            "value": "ce2cf0868afe24df92e5b4fd25db3b2e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-16T13:41:48+00:00",
            "last_seen": "2026-07-16T13:41:48+00:00",
            "object_relation": "filename",
            "timestamp": "1784433995",
            "to_ids": true,
            "type": "filename",
            "uuid": "be5f1ddd-e885-4f45-a7a3-1765734add09",
            "value": "decrypted.js"
          }
        ]
      }
    ]
  }
}