{
  "Event": {
    "analysis": "1",
    "date": "2026-07-15",
    "extends_uuid": "",
    "info": "[Threat Intel] Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery",
    "protected": false,
    "publish_timestamp": "1784560888",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1784560888",
    "uuid": "90f4f656-3590-460a-b38d-2d32f23fdde0",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f4f6",
        "local": false,
        "name": "misp-galaxy:producer=\"Microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#cdf945",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Winlogon Helper DLL - T1547.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b4369",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Container API - T1552.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"npm\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"Azure\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"aws\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"hashicorp\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784199606",
        "to_ids": false,
        "type": "link",
        "uuid": "5f63feb9-90a9-43bc-b0ec-ab01ef3620e9",
        "value": "https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784199606",
        "to_ids": false,
        "type": "text",
        "uuid": "2e007e91-4832-401c-865c-49676b6ac076",
        "value": "On July 14, 2026, a coordinated supply chain attack compromised the @asyncapi npm organization, affecting five package versions across four packages. The attack originated from a GitHub Actions workflow vulnerability that exposed privileged credentials, enabling unauthorized code injection. Unlike typical postinstall attacks, this campaign executes at module import time, bypassing common npm install --ignore-scripts protections. The malicious code spawned hidden processes that fetched a second-stage payload from IPFS, deploying the Miasma modular runtime with command-and-control capabilities, persistence mechanisms, and credential harvesting features. The payload included disabled modules for supply-chain propagation, AI-tool poisoning, and sandbox evasion. All compromised packages were published through legitimate GitHub OIDC workflows with valid provenance signatures, masking the malicious activity within trusted release processes."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784199606",
        "to_ids": false,
        "type": "text",
        "uuid": "ffbc8191-51d2-464d-a4b7-63432453bf4a",
        "value": "Name: Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery\nAuthor: AlienVault\nAdversary: \nTags: [\"bluerabbit\", \"miasma\", \"npm compromise\", \"gigawiper\", \"asyncapi\"]\nTgtd countries: []\nMlwr families: [\"Miasma\", \"BLUERABBIT\", \"GigaWiper\"]\nAttack_ids: [\"T1132.001\", \"T1059.007\", \"T1071.004\", \"T1036.005\", \"T1082\", \"T1106\", \"T1005\", \"T1140\", \"T1555.003\", \"T1547.004\", \"T1090\", \"T1083\", \"T1552.001\", \"T1547.001\", \"T1027\", \"T1573\", \"T1195.002\", \"T1543.001\", \"T1071.001\", \"T1543.002\", \"T1105\", \"T1102.001\", \"T1552.007\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784558555",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bb475d8c-b363-4cb4-8db6-bcc571a775b7",
        "value": "85.137.53.71",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557284",
        "to_ids": true,
        "type": "sha256",
        "uuid": "fc89147f-07fa-4a0e-b4f9-5261447eb615",
        "value": "34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557285",
        "to_ids": true,
        "type": "sha256",
        "uuid": "38fdc850-9669-4e65-b649-7004e96c99b6",
        "value": "082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557287",
        "to_ids": true,
        "type": "sha256",
        "uuid": "76a3a165-abe6-42e1-8a32-118a2e228791",
        "value": "9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557287",
        "to_ids": true,
        "type": "sha256",
        "uuid": "90100187-5da1-4f55-9383-e47dbf458074",
        "value": "d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557288",
        "to_ids": true,
        "type": "sha256",
        "uuid": "8e2ca3f5-760f-4dd6-81e1-b8202fb53e37",
        "value": "8351d251cf0b5a0bd82242deaa0a14e3e1394418d55c0f4259dac4303b79fc0c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557289",
        "to_ids": true,
        "type": "sha1",
        "uuid": "89534e63-ba0d-46b3-af96-f2ae5bbfde83",
        "value": "c70e105e212ff3c1daa04bb2a62507717f296b0b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557290",
        "to_ids": true,
        "type": "md5",
        "uuid": "76ff6e1c-1602-4e7b-ba2c-4061e881e342",
        "value": "69813c330d52f2a93082651c071a302c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557291",
        "to_ids": true,
        "type": "md5",
        "uuid": "69e985cf-ef3e-4518-ad67-9443b008a402",
        "value": "71e67d32d2a6e052893dc0c679f9f7fd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557292",
        "to_ids": true,
        "type": "md5",
        "uuid": "0f0a9798-05f1-49f0-bb2d-63297c36aa9d",
        "value": "8c09a52a15a6e617e2b6ccee11046805",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557294",
        "to_ids": true,
        "type": "md5",
        "uuid": "4225a053-41a4-49dd-beba-ca4593af35e8",
        "value": "cd961d0b7b29996b795ddc80c09cc5d9",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557295",
        "to_ids": true,
        "type": "md5",
        "uuid": "850ed8d2-1a7a-4d76-848c-002fc7fda092",
        "value": "e67c6be63e55148de424e030cf6bed3b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557296",
        "to_ids": true,
        "type": "sha1",
        "uuid": "efa55e65-656f-4430-afeb-d40151d11171",
        "value": "1f5c2e809d1ebd369d34ac22b771c522ced6e5b4",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557297",
        "to_ids": true,
        "type": "sha1",
        "uuid": "2128d7ad-f9ce-48f8-8c55-c5ea6fbea7b0",
        "value": "46a236cc9f140deb62bbcfb055e7865d5b23ad81",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557298",
        "to_ids": true,
        "type": "sha1",
        "uuid": "2c5f0e5f-efa2-44ba-9788-b0a2cf43f54e",
        "value": "9b65b9f1bb27cef7b8a2b0327a47a539b8e473fb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557299",
        "to_ids": true,
        "type": "sha1",
        "uuid": "923807ee-92df-41f3-a24e-aacd2bdf158b",
        "value": "ef2d28477befaa103031c7182a6f0dd6b4bb82dd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784467206",
        "to_ids": true,
        "type": "email-src",
        "uuid": "9f76cd9d-248b-4893-a1a6-0777118b1c33",
        "value": "npm-oidc-no-reply@github.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784558577",
        "to_ids": true,
        "type": "url",
        "uuid": "7ee4ae75-4703-47c1-a80d-726a72d786ae",
        "value": "https://ipfs.io/ipfs/Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557299",
        "to_ids": true,
        "type": "sha256",
        "uuid": "7ab1801e-bddc-40b5-889c-2b3649eb3e8c",
        "value": "b270bdf8e2274ea1af0a6eed74d8f10e5fe61012d6cc226a43cc7cc7fd9f6292",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 20/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784557300",
        "to_ids": true,
        "type": "sha256",
        "uuid": "61a97999-8e54-43d7-bee2-be43646c5a49",
        "value": "6e78713b75bd34828d49896176627f7face7aa9036cd874f2e02d9f23a9a9c71",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784467206",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "87c21827-eba4-41e5-a5bc-8eef68140ca3",
        "value": "85.137.53.71|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8081",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784467206",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "3852be2d-9094-4a19-98e7-24d6e4dbbf36",
        "value": "85.137.53.71|8081"
      },
      {
        "category": "Network activity",
        "comment": "On port 8091",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784467206",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "1a4b2beb-e574-4b97-97f2-0fe27f69b984",
        "value": "85.137.53.71|8091"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-14T17:34:20+00:00",
        "last_seen": "2026-07-14T17:34:20+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784558598",
        "uuid": "f289338b-2136-45ab-b007-a48b80810c86",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "md5",
            "timestamp": "1784558598",
            "to_ids": true,
            "type": "md5",
            "uuid": "9178bc46-499e-4a0d-ad46-0d1c3b8c31d6",
            "value": "d602f4eeb914cf32782799376a8c5953",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "sha1",
            "timestamp": "1784557281",
            "to_ids": true,
            "type": "sha1",
            "uuid": "364de88e-b321-4b8e-b9e5-96beffaf91d1",
            "value": "93d8cffab1171a115228808e526d9bd7fe935e4e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "sha256",
            "timestamp": "1784557281",
            "to_ids": true,
            "type": "sha256",
            "uuid": "48bdbddc-5ecb-485e-8415-576c75d1cb25",
            "value": "bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "text",
            "timestamp": "1784554021",
            "to_ids": false,
            "type": "text",
            "uuid": "c4628b3e-2fb6-43df-a189-43de75b65cc3",
            "value": "Type Description: GZIP\nMicrosoft: Trojan:JS/ObfuseJS\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-07-14T17:34:20+00:00\nLast Submission: 2026-07-14T17:34:20+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784554021",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3c570b4a-c85c-41c9-98a1-b2c42b8e7f40",
            "value": "3072:Xx/VYOSZdaaXSrxv0lAyB14hH+ulg1UiVNdJe0ZV/Z:rSn2VEeEyiVNdzZVR"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784554021",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0afbbdf9-ef9f-4d1f-98ee-77e25db61af4",
            "value": "168416"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T17:34:20+00:00",
            "last_seen": "2026-07-14T17:34:20+00:00",
            "object_relation": "vhash",
            "timestamp": "1784554021",
            "to_ids": true,
            "type": "vhash",
            "uuid": "99359faf-dabf-4333-b0e7-39072477ab1a",
            "value": "b8a2c23f93b42e5bd4070c65b2c05f9f"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-15T05:12:39+00:00",
        "last_seen": "2026-07-20T07:42:50+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784558620",
        "uuid": "707c3e7b-7bd8-4140-8522-0ab140fe2376",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "md5",
            "timestamp": "1784558620",
            "to_ids": true,
            "type": "md5",
            "uuid": "311590cb-e9c3-430d-9286-9a2b9f70b679",
            "value": "d8a6b102c1715bd80393ce510931b1f6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "sha1",
            "timestamp": "1784557282",
            "to_ids": true,
            "type": "sha1",
            "uuid": "fadfd6cf-b4d5-44e4-be36-b5a7112d4760",
            "value": "22bf76fe317ea6769bd38619bd440e42d119bd6b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "sha256",
            "timestamp": "1784557282",
            "to_ids": true,
            "type": "sha256",
            "uuid": "be40b681-c0a3-4a86-8c3d-961af3dfe951",
            "value": "b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 20/07/2026\nLast-scan: 19/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "text",
            "timestamp": "1784554314",
            "to_ids": false,
            "type": "text",
            "uuid": "b28c88c9-ea3a-43a7-8e5b-7aa79c319d4f",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/SupplyChainRisk.A\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-07-15T05:12:39+00:00\nLast Submission: 2026-07-20T07:42:50+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784554314",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e9f86888-adfe-4c11-b8f0-2edae582fce6",
            "value": "384:ZlKU3M2cyyBouN/xgVsFJgKdLQvKGSLE9JJk:ZlDhcyyBouNZgVY6fvKGIJ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784554314",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "7f3a3f8f-e420-41b4-b20c-ada05e15a590",
            "value": "16288"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "vhash",
            "timestamp": "1784554314",
            "to_ids": true,
            "type": "vhash",
            "uuid": "37d00d89-845a-4788-b68f-4e733b3f9ab7",
            "value": "5190a2922e3721dffb06475804b98f7f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-15T05:12:39+00:00",
            "last_seen": "2026-07-20T07:42:50+00:00",
            "object_relation": "filename",
            "timestamp": "1784554314",
            "to_ids": true,
            "type": "filename",
            "uuid": "df52fb51-e683-455e-af80-fc51bcd35a1a",
            "value": "validator.js.dumpFile"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-14T12:48:12+00:00",
        "last_seen": "2026-07-14T12:48:12+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784558641",
        "uuid": "89ec14b8-b5a3-4d77-ba40-453ec1a7480d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "md5",
            "timestamp": "1784558641",
            "to_ids": true,
            "type": "md5",
            "uuid": "6112e857-c93b-4251-844d-efa2fa3af6ec",
            "value": "ea895416fe585a5c2a5dce207190ff1c",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "sha1",
            "timestamp": "1784557283",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2e6f8028-da5f-463c-8143-edc74a4b76f8",
            "value": "c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "sha256",
            "timestamp": "1784557284",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7c24689e-ff3f-489a-ba78-bd39fd59426c",
            "value": "24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "text",
            "timestamp": "1784554377",
            "to_ids": false,
            "type": "text",
            "uuid": "0eb85583-5c11-4200-af69-93ea4a8e7a7f",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/MiasmStealer.SC\nClamAV: None\nVT Total Detection: 8/74\nFirst Submission: 2026-07-14T12:48:12+00:00\nLast Submission: 2026-07-14T12:48:12+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784554377",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "37516afd-54fc-4a9e-bb65-e4fcfd4c4042",
            "value": "49152:o5U89pssHmTdE95gZZlU7q+tafdQWr38MCZ2qbHUY1QwkHbK/nld7bW9Hpom5U8z:5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784554377",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4a652661-973e-4d09-ae62-886dee9bfadf",
            "value": "8254481"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-14T12:48:12+00:00",
            "last_seen": "2026-07-14T12:48:12+00:00",
            "object_relation": "filename",
            "timestamp": "1784554377",
            "to_ids": true,
            "type": "filename",
            "uuid": "ee183629-e989-44f8-8093-1092fd41e2a5",
            "value": "QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9"
          }
        ]
      }
    ]
  }
}