{
  "Event": {
    "analysis": "1",
    "date": "2026-07-14",
    "extends_uuid": "",
    "info": "[Threat Intel] Supply Chain Compromise via GitHub Actions",
    "protected": false,
    "publish_timestamp": "1784437731",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1784437730",
    "uuid": "681a8d93-3d82-4032-bb76-86e1b3dcb921",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#52774b",
        "local": false,
        "name": "misp-galaxy:producer=\"Wiz Blog\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#838eb9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keychain - T1555.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d11f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#1acf09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Shai-Hulud\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"npm\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084415",
        "to_ids": false,
        "type": "link",
        "uuid": "6d07a47d-a1a3-411c-a8ac-9c25277cb70e",
        "value": "https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084415",
        "to_ids": false,
        "type": "text",
        "uuid": "b2d08a23-3f9b-4b8f-b2d5-e115a1dd5a93",
        "value": "On July 14, 2026, an attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository through a 'pwn request' vulnerability. The attacker opened 37 pull requests, with one containing obfuscated JavaScript that exfiltrated a highly privileged Personal Access Token belonging to asyncapi-bot. Using the stolen credentials, the attacker published five malicious npm package versions under the @asyncapi namespace, which collectively receive over three million downloads weekly. The malware features a multi-stage payload that establishes persistence and connects to command and control infrastructure, executing on import rather than install. It includes capabilities for credential theft targeting browsers, SSH keys, cloud credentials, and cryptocurrency wallets. The payload shares technical characteristics with the Miasma malware framework but shows unique features including a comprehensive command framework."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784084415",
        "to_ids": false,
        "type": "text",
        "uuid": "b70327a5-1f5e-43de-890a-f16f0a797185",
        "value": "Name: Supply Chain Compromise via GitHub Actions\nAuthor: AlienVault\nAdversary: \nTags: [\"github actions\", \"nostr relay\", \"npm supply chain attack\", \"pwn request\", \"m-red-team\", \"ipfs\", \"credential theft\", \"miasma\", \"asyncapi\"]\nTgtd countries: []\nMlwr families: [\"Miasma\", \"M-RED-TEAM\"]\nAttack_ids: [\"T1132.001\", \"T1059.007\", \"T1071.004\", \"T1555.001\", \"T1573.001\", \"T1106\", \"T1005\", \"T1140\", \"T1555.003\", \"T1552.004\", \"T1083\", \"T1552.001\", \"T1528\", \"T1041\", \"T1199\", \"T1027\", \"T1195.002\", \"T1071.001\", \"T1543.002\", \"T1105\", \"T1078.004\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434564",
        "to_ids": true,
        "type": "sha1",
        "uuid": "a0a9f299-8425-48d7-aa76-0ed8470f46ab",
        "value": "9890950adcbc2478e7a080234f053214adbad44e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434565",
        "to_ids": true,
        "type": "sha1",
        "uuid": "402aecc1-c482-459a-9c58-b4f16f832da0",
        "value": "a7e18d96efd3cdb127ef4cdcad9e3ad26c482bf2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 19/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784434566",
        "to_ids": true,
        "type": "sha1",
        "uuid": "ccfb8249-6fe4-4d6c-98d0-3426994fa3bf",
        "value": "c70e105e212ff3c1daa04bb2a62507717f296b0b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437520",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d7a3e076-1218-488f-bc3e-7d27e8154f3c",
        "value": "85.137.53.71",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437541",
        "to_ids": true,
        "type": "domain",
        "uuid": "a0c06f3c-f5ad-44fc-bf4f-2ae3099974c3",
        "value": "ipfs.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784437563",
        "to_ids": true,
        "type": "domain",
        "uuid": "71ac196a-8370-411e-8205-733f13db9c3b",
        "value": "rentry.co",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-15T05:12:39+00:00",
        "last_seen": "2026-07-15T16:50:27+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784437584",
        "uuid": "261c39ca-d8e8-42b5-b5a2-c60200c6d661",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "md5",
            "timestamp": "1784437584",
            "to_ids": true,
            "type": "md5",
            "uuid": "d3ef72b7-1b05-491f-a864-f6f26af1c5b9",
            "value": "d8a6b102c1715bd80393ce510931b1f6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "sha1",
            "timestamp": "1784434561",
            "to_ids": true,
            "type": "sha1",
            "uuid": "1b82fa54-c012-4021-a33d-e9e5f713b1ce",
            "value": "22bf76fe317ea6769bd38619bd440e42d119bd6b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "sha256",
            "timestamp": "1784434561",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9ea57bf1-be39-4321-b4c4-b1efd1ca6580",
            "value": "b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "text",
            "timestamp": "1784434060",
            "to_ids": false,
            "type": "text",
            "uuid": "c21a76fe-7af5-4b15-b42c-ac8beb1e8ef3",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/SupplyChainRisk.A\nClamAV: None\nVT Total Detection: 11/74\nFirst Submission: 2026-07-15T05:12:39+00:00\nLast Submission: 2026-07-15T16:50:27+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784434060",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "fa4129ba-a8d0-4cdc-a575-a3d85dc7cc4e",
            "value": "384:ZlKU3M2cyyBouN/xgVsFJgKdLQvKGSLE9JJk:ZlDhcyyBouNZgVY6fvKGIJ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784434060",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "3ab12638-b904-4b6c-b615-680735e557fe",
            "value": "16288"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "vhash",
            "timestamp": "1784434060",
            "to_ids": true,
            "type": "vhash",
            "uuid": "5cc837cf-9955-4cbd-ae76-ce2012f01eaf",
            "value": "5190a2922e3721dffb06475804b98f7f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-15T16:50:27+00:00",
            "object_relation": "filename",
            "timestamp": "1784434060",
            "to_ids": true,
            "type": "filename",
            "uuid": "299ca512-2213-4cdb-8298-23486433df35",
            "value": "validator.js"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-14T12:48:12+00:00",
        "last_seen": "2026-07-14T12:48:12+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784437605",
        "uuid": "7279638c-548f-45a2-a3b8-938b3efae162",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "md5",
            "timestamp": "1784437605",
            "to_ids": true,
            "type": "md5",
            "uuid": "8597edf3-5653-472d-b547-c7d8707694a6",
            "value": "ea895416fe585a5c2a5dce207190ff1c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "sha1",
            "timestamp": "1784434562",
            "to_ids": true,
            "type": "sha1",
            "uuid": "dda3da1b-8a79-4d48-8a43-35dc614ba50f",
            "value": "c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "sha256",
            "timestamp": "1784434562",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1a0c87bc-e525-4513-a747-62fb6e854e74",
            "value": "24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "text",
            "timestamp": "1784434144",
            "to_ids": false,
            "type": "text",
            "uuid": "cf0b41bd-2eb3-43d0-bd84-5b88a2ec3517",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Supychain.A\nClamAV: None\nVT Total Detection: 4/74\nFirst Submission: 2026-07-14T12:48:12+00:00\nLast Submission: 2026-07-14T12:48:12+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784434144",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a922bbd2-5fc1-4cfd-9a51-53ca017f841c",
            "value": "49152:o5U89pssHmTdE95gZZlU7q+tafdQWr38MCZ2qbHUY1QwkHbK/nld7bW9Hpom5U8z:5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784434144",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "fb12d5cc-ba89-437d-9b58-2146523b530b",
            "value": "8254481"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "filename",
            "timestamp": "1784434144",
            "to_ids": true,
            "type": "filename",
            "uuid": "5e710335-16c6-4405-bbdb-ab60eccd7427",
            "value": "QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9"
          }
        ]
      }
    ]
  }
}