{ "Event": { "analysis": "1", "date": "2026-07-28", "extends_uuid": "", "info": "[Threat Intel] Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan", "protected": false, "publish_timestamp": "1785643437", "published": true, "threat_level_id": "2", "timestamp": "1785643437", "uuid": "ae86db69-21f3-44b1-8ce3-3087a05aaaf9", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#4985d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#9dc839", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#7628f7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#d596aa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": "" }, { "colour": "#7d37d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"", "relationship_type": "" }, { "colour": "#865fd1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Credential Manager - T1555.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#18005e", "local": false, "name": "rectifyq:topic=\"supply-chain\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted/Encoded File - T1027.013\"", "relationship_type": "" }, { "colour": "#1a0063", "local": false, "name": "rectifyq:topic=\"web3\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"npm\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380417", "to_ids": false, "type": "link", "uuid": "a89b01b8-0a46-48a5-a243-8167bc88b7ff", "value": "https://socket.dev/blog/joyfill-npm-beta-releases-compromised" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1785380417", "to_ids": false, "type": "text", "uuid": "bb807d0a-46d8-4478-a85c-e265500b4b32", "value": "Two npm beta releases in the @joyfill namespace were compromised with an import-time JavaScript implant that uses blockchain transactions on Tron, Aptos, and BNB Smart Chain to retrieve encrypted payloads. The malicious code leads to a 77 KB Node.js remote-access trojan identified as DEV#POPPER, which establishes Socket.IO connections for remote control and can execute commands, upload files, read clipboard data, and persist through developer tools. A parallel execution branch downloads additional payloads including an 82 KB Python infostealer assessed to be OmniStealer, targeting browser credentials, Git configurations, and wallet extensions. The compromise affected @joyfill/layouts version 0.1.2-2773.beta.0 and @joyfill/components version 4.0.0-rc24-2773-beta.4, with approximately 16,000 weekly downloads. The loader exhibits exact code overlap with the PolinRider family and DEV#POPPER operations." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1785380417", "to_ids": false, "type": "text", "uuid": "b09a4772-bead-4528-8f47-7c0179f46e29", "value": "Name: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan\nAuthor: AlienVault\nAdversary: \nTags: [\"polinrider\", \"remote access trojan\", \"dev#popper\", \"blockchain loader\", \"infostealer\", \"developer targeting\", \"omnistealer\", \"npm supply chain\"]\nTgtd countries: []\nMlwr families: [\"DEV#POPPER\", \"OmniStealer\"]\nAttack_ids: [\"T1113\", \"T1059.007\", \"T1547\", \"T1204.002\", \"T1115\", \"T1082\", \"T1106\", \"T1005\", \"T1140\", \"T1560\", \"T1555.003\", \"T1059.004\", \"T1027\", \"T1195.002\", \"T1059.006\", \"T1555.004\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Technology\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785642077", "to_ids": true, "type": "ip-dst", "uuid": "77c2a20e-045f-449d-aaee-762e03da1653", "value": "23.27.202.27", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785642099", "to_ids": true, "type": "ip-dst", "uuid": "adb5f31a-eae2-4168-af96-726cf72d0890", "value": "198.105.127.210", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785642120", "to_ids": true, "type": "ip-dst", "uuid": "beed1023-26db-4fd1-b245-c0d5b16e14b3", "value": "166.88.134.62", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785642141", "to_ids": true, "type": "ip-dst", "uuid": "55dfc155-a8c8-40d7-955b-b66561097056", "value": "23.27.13.43", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633227", "to_ids": true, "type": "sha256", "uuid": "a862c20a-25f1-4d12-acda-fb90c2e2182a", "value": "36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633228", "to_ids": true, "type": "sha256", "uuid": "68522c43-26e2-4646-9bcd-8f72e8c0ac46", "value": "bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633230", "to_ids": true, "type": "sha256", "uuid": "ea5c5875-894a-4abd-bdf3-2dd6bcc62b68", "value": "1352ad22c99983d91e600348b7cbf58235131b1ee34cea9f09623206d5b7dea7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633231", "to_ids": true, "type": "sha256", "uuid": "ba20023d-abb6-4d21-9a86-eb5fe6dbe99d", "value": "67c6ef602cc850f10d935fee53fa40440df841adf081563bf4fc2631a71249ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633232", "to_ids": true, "type": "sha256", "uuid": "db83edca-bda8-4185-813f-c1c9f30d5f48", "value": "c5742ea1875ecd2360022624149994909cd0546e221e4203dffd01f48de45469", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633233", "to_ids": true, "type": "sha256", "uuid": "4574ff18-bc6f-4922-b4ac-3dd26e7451f5", "value": "cb46f12d70824ea24ed1f8bcf45bf3f86680e02a9089aafc03b27f691be57be3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633234", "to_ids": true, "type": "sha256", "uuid": "b09b8e25-5e0a-49a3-8179-62740d1f9820", "value": "f452f9cfa539f4a1fe25187a99a484391290d5dbaa422ba455edf6b04f81b7d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633235", "to_ids": true, "type": "sha256", "uuid": "81c1f042-3e4e-4a4c-a686-aef8f8bad7fc", "value": "ae7565109fd01b88d82acf7f73ab20709cbc2c9f26fdea13e429ccc87a55d4fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633236", "to_ids": true, "type": "sha256", "uuid": "6798f047-ea29-4659-acbf-7401ae77082c", "value": "26e679eaf1e9baeb7c55eb48db482301171d4d26e1728544b23734a90dc70e1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...2 IPs, the Sec-V header, and outbound requests to api[.]trongrid[.]io or bsc-dataseed[.]binance[.]org from build agents...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785642162", "to_ids": true, "type": "domain", "uuid": "b5721626-56d1-4681-ae1b-c95371bc640d", "value": "api.trongrid.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"..., and outbound requests to api[.]trongrid[.]io or bsc-dataseed[.]binance[.]org from build agents or developer workstations. Bloc...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785642183", "to_ids": true, "type": "domain", "uuid": "d79e057e-e07d-4d41-9cc5-0c2243ee1b45", "value": "bsc-dataseed.binance.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...twork and protocol indicators api[.]trongrid[.]io fullnode[.]mainnet[.]aptoslabs[.]com bsc-dataseed[.]binance[.]org bsc-rpc[.]publicnode...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785642204", "to_ids": true, "type": "domain", "uuid": "a1892e25-1a59-4696-897c-f924e0c4daf8", "value": "fullnode.mainnet.aptoslabs.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...et[.]aptoslabs[.]com bsc-dataseed[.]binance[.]org bsc-rpc[.]publicnode[.]com 166[.]88[.]134[.]62:443 166[.]88[.]134[.]62:80 23...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785642226", "to_ids": true, "type": "domain", "uuid": "7c1da6d0-a63f-4f82-9217-f2df132118d1", "value": "bsc-rpc.publicnode.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785642247", "uuid": "00effb46-8caf-44c7-9d8e-6c6705081e47", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "object_relation": "md5", "timestamp": "1785642247", "to_ids": true, "type": "md5", "uuid": "74bde831-85e0-4ac4-9cf6-7cfbc5970e52", "value": "b7c8c84d1729e78ca9d64d1d6dd97fe4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "object_relation": "sha1", "timestamp": "1785633220", "to_ids": true, "type": "sha1", "uuid": "848769b5-d417-45ec-9e43-c211ebb4bee8", "value": "e147076dd588df4e2bc9db25fcc306fb34a04a55", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "object_relation": "sha256", "timestamp": "1785633220", "to_ids": true, "type": "sha256", "uuid": "613df27d-3334-4ad1-81cc-cdbd40814911", "value": "2cfede38fb121a71a2f3607474aa8cd588a99f51b37e5e6f0d8cb789fa275032", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "object_relation": "text", "timestamp": "1785632459", "to_ids": false, "type": "text", "uuid": "616e52bd-eb66-4202-897a-e1902f23c8d2", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 32/75\nFirst Submission: 2026-06-15T12:27:14+00:00\nLast Submission: 2026-07-03T02:31:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "object_relation": "ssdeep", "timestamp": "1785632459", "to_ids": true, "type": "ssdeep", "uuid": "c6a47874-ec9c-4cdc-af13-b46f11510924", "value": "1536:QzZ8FblZf+mZcnvmACPDnuGAUuukbVi4M4NYi:pX2m5AKDiUuLhip4NYi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632459", "to_ids": false, "type": "size-in-bytes", "uuid": "f3997093-c2ec-49c5-8de6-f2b6b0b01b36", "value": "65438" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T12:27:14+00:00", "last_seen": "2026-07-03T02:31:09+00:00", "object_relation": "filename", "timestamp": "1785632459", "to_ids": true, "type": "filename", "uuid": "614a9fa8-5075-4301-a307-0957aa725f16", "value": "boot-decoded-1.js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785642268", "uuid": "cc707fd5-c31f-41ec-a591-4dc450f93c81", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "md5", "timestamp": "1785642268", "to_ids": true, "type": "md5", "uuid": "515d5d58-4d0d-4559-858a-309bcc01e00d", "value": "73acb6dfdd54d57290730b450760aca1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "sha1", "timestamp": "1785633222", "to_ids": true, "type": "sha1", "uuid": "3c5865e7-b01a-4a96-9849-4506cbdf716d", "value": "7783d77eda74124a08528c1490e9455676a1d9bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "sha256", "timestamp": "1785633222", "to_ids": true, "type": "sha256", "uuid": "b22ebcd0-8bea-4fe5-af92-92037a54a392", "value": "26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "text", "timestamp": "1785632480", "to_ids": false, "type": "text", "uuid": "89094346-8520-4855-95c9-c1612cec948f", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 13/75\nFirst Seen In The Wild: 2026-07-13T11:14:35+00:00\nFirst Submission: 2026-06-25T18:42:19+00:00\nLast Submission: 2026-07-02T22:36:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "ssdeep", "timestamp": "1785632480", "to_ids": true, "type": "ssdeep", "uuid": "d61beff8-e5ae-4acc-a366-703164ca502e", "value": "1536:YMaSOS5w+Tdf8JzF1hpC06d/lk5R/lk5IRa/G/9RzQL4s8QxJPmg9gZ:wZx++a/G/9RzQ8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632480", "to_ids": false, "type": "size-in-bytes", "uuid": "cf76185d-4d8d-4783-b7ee-80a13a91956c", "value": "77276" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "vhash", "timestamp": "1785632480", "to_ids": true, "type": "vhash", "uuid": "cbda2dc4-8be6-41ce-af9a-c2cf8a18705d", "value": "e9492d05460d44e08cb6f0b17ba39d26" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T18:42:19+00:00", "last_seen": "2026-07-02T22:36:55+00:00", "object_relation": "filename", "timestamp": "1785632480", "to_ids": true, "type": "filename", "uuid": "4d028bd4-5a91-4287-8f58-4f4440905881", "value": "path1-stage3-encoded.js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785642289", "uuid": "4781c721-c209-42c3-b275-62c0f902cc31", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "md5", "timestamp": "1785642289", "to_ids": true, "type": "md5", "uuid": "7713f423-bf94-4635-8fe3-199f51014768", "value": "f136f722e741edf0e203ec50fd9d06fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "sha1", "timestamp": "1785633222", "to_ids": true, "type": "sha1", "uuid": "9d4ca1c9-79ff-4ab2-8db9-30de7d17dfa2", "value": "8914e6907acd0de0210cea04a15c22b82325fbff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "sha256", "timestamp": "1785633222", "to_ids": true, "type": "sha256", "uuid": "818c6f0b-b2cc-49a6-8bef-a546f1f52147", "value": "adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "text", "timestamp": "1785632523", "to_ids": false, "type": "text", "uuid": "de014368-a83b-4a93-8e88-67c50707e738", "value": "Type Description: GZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 10/75\nFirst Submission: 2026-07-28T12:21:37+00:00\nLast Submission: 2026-07-28T12:21:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "ssdeep", "timestamp": "1785632523", "to_ids": true, "type": "ssdeep", "uuid": "81c9e8dd-2bfd-4ef8-bd31-2d4c08eb1e79", "value": "6144:5wp8346RXyMevc0TlTEsuhwHYi6/3ZWwTQaG3k:mp8346wD2LiHH6PZZQaGU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632523", "to_ids": false, "type": "size-in-bytes", "uuid": "7a36d16a-b1f5-48c4-a30f-40d9517a1389", "value": "232618" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "vhash", "timestamp": "1785632523", "to_ids": true, "type": "vhash", "uuid": "03024a19-1ff4-4289-b79f-f1ebee5d67ed", "value": "1c4946d0f677d2e5d3100206f18803f9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-28T12:21:37+00:00", "last_seen": "2026-07-28T12:21:37+00:00", "object_relation": "filename", "timestamp": "1785632523", "to_ids": true, "type": "filename", "uuid": "0b1deca1-f974-4b71-a541-e25c74181a63", "value": "joyfill-layouts-0.1.2-2773.beta.0.tgz" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785642310", "uuid": "636df7ad-6e7e-4f61-83e7-217b639586e4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "md5", "timestamp": "1785642310", "to_ids": true, "type": "md5", "uuid": "18b7e7fc-e2cb-4aaf-a1ff-61dc5cb9c953", "value": "e7d70f16df21a2c4c8a86fb31d97beb7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "sha1", "timestamp": "1785633223", "to_ids": true, "type": "sha1", "uuid": "cba2e043-0951-4188-93ec-7df6a3ea3f6f", "value": "292719fc1df6e53dbc165c3d1ef9e6aeefff0ee8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "sha256", "timestamp": "1785633223", "to_ids": true, "type": "sha256", "uuid": "3d1d1423-e804-47d9-acce-ecf8153c4484", "value": "8e8b90dedd456ded0c5748119836e1ca1066112bc569c1b41ca70eb931d1d4dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "text", "timestamp": "1785632544", "to_ids": false, "type": "text", "uuid": "86a55fc3-234d-481c-b277-b0d8e037823a", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 8/75\nFirst Submission: 2026-07-29T11:49:56+00:00\nLast Submission: 2026-07-29T11:49:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "ssdeep", "timestamp": "1785632544", "to_ids": true, "type": "ssdeep", "uuid": "897f4b0a-195c-4a30-97d0-29509fa436c5", "value": "768:1FoFXufWPI5060Pk6rbc9B3dFLpi4bsYTco9OpQXsXX0Gn+hqcezHYLrUtlmMFkF:12YfWI0PiQb0YYrulrt8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632544", "to_ids": false, "type": "size-in-bytes", "uuid": "8c39c52c-01ef-4e0c-8269-529be65462ec", "value": "45738" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "vhash", "timestamp": "1785632544", "to_ids": true, "type": "vhash", "uuid": "2934a4cc-ee4b-4ef8-9c0f-99e89d43bbbe", "value": "94019b170c49f45cfb6b85ab6233c87e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-29T11:49:56+00:00", "last_seen": "2026-07-29T11:49:56+00:00", "object_relation": "filename", "timestamp": "1785632544", "to_ids": true, "type": "filename", "uuid": "3dcbe9ea-daf6-4c52-9629-87ba2c83e2e9", "value": "index.cjs.js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785642332", "uuid": "e73d62ac-60f1-4aef-8cc3-03f386e43ecd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "md5", "timestamp": "1785642332", "to_ids": true, "type": "md5", "uuid": "7dd34644-c497-4ba1-b85f-1039111b6483", "value": "540bb87981c540e2149b8d9ffc4e0493", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "sha1", "timestamp": "1785633225", "to_ids": true, "type": "sha1", "uuid": "fcc2baff-98ad-4e4a-bf2f-97cf14333308", "value": "eacd4e7110e2a29bda115ac4b865e917e413b619", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "sha256", "timestamp": "1785633225", "to_ids": true, "type": "sha256", "uuid": "e54d2adb-6304-4721-bcaa-65dc7e2502c3", "value": "5f6a92006ca2ea4b464d66fb41af777edce7296939a7c6ee491e2b3cbfe09848", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "text", "timestamp": "1785632566", "to_ids": false, "type": "text", "uuid": "ab29223b-c000-4e4e-93cc-8b7c401f00de", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 9/75\nFirst Submission: 2026-07-28T12:21:45+00:00\nLast Submission: 2026-07-28T12:21:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "ssdeep", "timestamp": "1785632566", "to_ids": true, "type": "ssdeep", "uuid": "b6980560-9c83-4f0e-a4ba-b7e8c26d0bf7", "value": "768:1FoFXuSW0f60P7EtKuQsX0ZhqcezHYLrUtlmMFkxZxjKjV9IB:12YSWT0P23n0yYrulKDH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632566", "to_ids": false, "type": "size-in-bytes", "uuid": "dd15aa2c-94ad-4015-9d11-a26480fb3ec8", "value": "45285" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "vhash", "timestamp": "1785632566", "to_ids": true, "type": "vhash", "uuid": "4cb83d65-0a03-4e76-bd15-73b3c67e9780", "value": "afcdc844eba1bd91adec0c9acc1afe56" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-28T12:21:45+00:00", "last_seen": "2026-07-28T12:21:45+00:00", "object_relation": "filename", "timestamp": "1785632566", "to_ids": true, "type": "filename", "uuid": "eba49c0b-60bf-43e6-afec-0979cfa3ca20", "value": "index.es.js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785642354", "uuid": "5adcc8ca-8851-4360-9981-0a972c1aa99a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "md5", "timestamp": "1785642354", "to_ids": true, "type": "md5", "uuid": "a74e1c74-fa1a-43c6-a9e3-523c1ca225b8", "value": "26c0f0dd6f4faabde31c49ab52c367e3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "sha1", "timestamp": "1785633226", "to_ids": true, "type": "sha1", "uuid": "5cabf0f6-c9e3-4e11-b6b0-f0f6db0223bf", "value": "765ffcd0eca0682bd2221a78e8fed32e1acb3bc0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "sha256", "timestamp": "1785633226", "to_ids": true, "type": "sha256", "uuid": "e14cd1c2-22b2-4002-88d9-1f80d1e15376", "value": "78f0de8682e0e894a5784eb7e95db4da6088f528918ca3107dd1e76f80a561d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "text", "timestamp": "1785632712", "to_ids": false, "type": "text", "uuid": "76d8df72-361a-4fee-9169-9ee78c8b2c26", "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/JoyfillRAT.LBC!MTB\nClamAV: None\nVT Total Detection: 34/75\nFirst Submission: 2026-06-20T15:17:51+00:00\nLast Submission: 2026-06-22T08:55:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "ssdeep", "timestamp": "1785632712", "to_ids": true, "type": "ssdeep", "uuid": "3f485eb0-a3d0-4986-a596-f5116f2915bc", "value": "96:UXyypVXS6IT3U2YfMM21og6CuI9PhYx4S2I:yyypVkTU5fvKF8VxSI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632712", "to_ids": false, "type": "size-in-bytes", "uuid": "dd5b0556-339f-45d6-b1d7-2973472517cf", "value": "3525" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "vhash", "timestamp": "1785632712", "to_ids": true, "type": "vhash", "uuid": "9714fc11-ea20-4401-a65d-3dcb63f4459d", "value": "f4e472fefd6a6d39351717077ad1c162" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T15:17:51+00:00", "last_seen": "2026-06-22T08:55:15+00:00", "object_relation": "filename", "timestamp": "1785632713", "to_ids": true, "type": "filename", "uuid": "347abc3a-a550-4270-8838-001e0e885a92", "value": "78f0de8682e0e894a5784eb7e95db4da6088f528918ca3107dd1e76f80a561d8.js" } ] } ] } }