{
  "Event": {
    "analysis": "1",
    "date": "2026-05-14",
    "extends_uuid": "",
    "info": "[Threat Intel] Popular node-ipc npm Package Infected with Credential Stealer",
    "protected": false,
    "publish_timestamp": "1780284547",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780284547",
    "uuid": "ba313d52-d178-491a-ab42-0a79bdd9755b",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#f055aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0add7f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d11f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#3909cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"",
        "relationship_type": ""
      },
      {
        "colour": "#3eb869",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418850",
        "to_ids": false,
        "type": "link",
        "uuid": "1ff2f29a-a72d-413c-87be-26aec2498a7a",
        "value": "https://socket.dev/blog/node-ipc-package-compromised"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418850",
        "to_ids": false,
        "type": "text",
        "uuid": "c7726d31-4894-4fd0-999d-9b59e246b5a7",
        "value": "A supply chain attack has compromised the node-ipc npm package, with malicious versions 9.1.6, 9.2.3, and 12.0.1 containing obfuscated stealer and backdoor functionality. The attack vector involved takeover of a dormant maintainer account through an expired email domain. The malware fingerprints host environments, enumerates and reads local files including SSH keys, cloud credentials, database configurations, and various developer secrets. Collected data is compressed into a gzip archive and exfiltrated via DNS TXT queries to attacker-controlled infrastructure disguised as legitimate Azure domains. The payload targets over 100 file patterns across macOS and Linux systems, focusing on developer credentials from AWS, Azure, GCP, Kubernetes, Docker, npm, GitHub, and numerous other services. The malicious code executes during CommonJS module loading, forking a detached child process to perform credential harvesting while avoiding detection through obfuscation and DNS-based covert channels."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779418850",
        "to_ids": false,
        "type": "text",
        "uuid": "b2dde2a6-9396-413f-bee0-7914114e2852",
        "value": "Name: Popular node-ipc npm Package Infected with Credential Stealer\nAuthor: AlienVault\nAdversary: \nTags: [\"supply chain attack\", \"npm package compromise\", \"credential stealer\", \"DNS exfiltration\", \"maintainer account takeover\", \"developer secrets harvesting\", \"node-ipc compromise\"]\nTgtd countries: []\nMlwr families: [\"node-ipc\"]\nAttack_ids: [\"T1195.002\", \"T1078\", \"T1136\", \"T1098\", \"T1071.004\", \"T1048.003\", \"T1041\", \"T1567\", \"T1005\", \"T1552.001\", \"T1552.004\", \"T1087\", \"T1082\", \"T1083\", \"T1119\", \"T1074.001\", \"T1560.001\", \"T1027\", \"T1027.002\", \"T1059.007\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199568",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d351c2f9-86f2-44b3-b94b-e3ab759616c5",
        "value": "sh.azurestaticprovider.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199589",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ee9f68f0-feab-4452-9807-621208558a7d",
        "value": "37.16.75.69",
        "Tag": [
          {
            "colour": "#b5af8f",
            "local": false,
            "name": "asn:asn=\"43641\"",
            "relationship_type": ""
          },
          {
            "colour": "#c3fbbc",
            "local": false,
            "name": "asn:as-owner=\"SOLLUTIUM-NL\"",
            "relationship_type": ""
          },
          {
            "colour": "#ec0428",
            "local": false,
            "name": "asn:as-country=\"PL\"",
            "relationship_type": ""
          },
          {
            "colour": "#c9412f",
            "local": false,
            "name": "misp-galaxy:country=\"poland\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197850",
        "to_ids": true,
        "type": "sha256",
        "uuid": "132534d6-40bd-4fc9-b354-9367770db8ba",
        "value": "c2f4dc64aec4631540a568e88932b61daebbfb7e8281b812fa01b7215f9be9ea",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197851",
        "to_ids": true,
        "type": "sha256",
        "uuid": "35a7f45d-6613-4e83-b1ef-d67a3658b425",
        "value": "449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199610",
        "to_ids": true,
        "type": "url",
        "uuid": "d426fa8e-8e8f-4109-a708-e2c182ef09bb",
        "value": "http://sh.azurestaticprovider.net:443",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:31/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780197852",
        "to_ids": true,
        "type": "sha256",
        "uuid": "24eddac0-0f52-4bb4-b8ec-324fad17510d",
        "value": "bf9d8c0c3ed3ceaa831a13de27f1b1c7c7b7f01d2db4103bfdba4191940b0301",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199645",
        "to_ids": true,
        "type": "domain",
        "uuid": "16e3edc4-b7aa-4e32-b62d-82595f342e9a",
        "value": "atlantis-software.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780199666",
        "to_ids": true,
        "type": "domain",
        "uuid": "b64c8afe-ebe4-4468-8ef4-360450624bc5",
        "value": "child.channel",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199688",
        "uuid": "12164b92-118a-49b0-af3c-0b996abb58e3",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199688",
            "to_ids": true,
            "type": "md5",
            "uuid": "69a5935e-ff19-4d1d-a2f1-1fe0a14ae6ed",
            "value": "d1ba0419cb5e5de91b9b58e87b8322e1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197847",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e3fd6bb3-082a-4e3d-a1fb-bf8020cf80c4",
            "value": "ab7388363936bf527afd4173b5728c7cdbdd01ab",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197848",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b3f9bae4-e060-464c-ade1-3ff1ea935c5e",
            "value": "96097e0612d9575cb133021017fb1a5c68a03b60f9f3d24ebdc0e628d9034144",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197390",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6b6f99ad-6336-4bf9-95b7-d0d5f2f767e3",
            "value": "1536:CWTZrAiHfqELz9EysNv7GK9qSwM+Hon2eSn5ydN0n:M7v9z+InmMdNw"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197390",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6381aa18-a3f1-4dc1-9cdd-fc9c8a75e2b7",
            "value": "117315"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197390",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9f912b18-31df-482f-89f7-f44fb7babba8",
            "value": "6f8c76769037befb7ece4d97a402e410"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197390",
            "to_ids": true,
            "type": "filename",
            "uuid": "f92eaaa4-8c5e-47b1-a2cc-9a0aa333a655",
            "value": "node-ipc.cjs"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197390",
            "to_ids": false,
            "type": "text",
            "uuid": "35e6eb56-5a2e-4357-aa1f-65f1e31d5c6b",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/Stealgen.LTSN!MTB\nVT Total Detection:28/61\nFirst Submission:2026-05-14T19:12:53.000000+00:00\nLast Submission:2026-05-15T09:43:39.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780199709",
        "uuid": "65e890a9-f6ed-4108-983c-27deb4f96e24",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780199709",
            "to_ids": true,
            "type": "md5",
            "uuid": "37e5ab66-de8d-4ec8-a9b5-377c67360fb7",
            "value": "0c0fe9862433b6a0e37d2fa782449899",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780197848",
            "to_ids": true,
            "type": "sha1",
            "uuid": "eb25b137-3531-457a-a24a-de0d8c3c1c91",
            "value": "fe5d107b9d285327af579259a32977c4f475fa26",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780197848",
            "to_ids": true,
            "type": "sha256",
            "uuid": "07f2633b-7bc2-4f11-a2d1-43fa732acd76",
            "value": "78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780197412",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2e049767-8710-4d1d-8e4f-270383d14d30",
            "value": "1536:mqnTMQC6kQLGw+jpdsPdgPxEemX6VF7skgGHbFyrYLvd6:mqTkGLGZXcCPyemX6V2kvHBy0Lo"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780197412",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9c4ab98e-f868-4997-913d-d1e511c80531",
            "value": "59381"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780197412",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8a5637f1-fdac-41b4-b987-567abd474f11",
            "value": "5af12d314475975fff2d036fedf7757c"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780197412",
            "to_ids": true,
            "type": "filename",
            "uuid": "c403bbb8-a2ba-4a4a-9703-0e6e4e4a0cc6",
            "value": "node-ipc-12.0.1.tgz"
          },
          {
            "category": "Other",
            "comment": "Checked: 31/05/2026\nLast-scan\t:  30/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780197412",
            "to_ids": false,
            "type": "text",
            "uuid": "080a2170-eef8-47d5-b212-a2c7c8127592",
            "value": "Type Description: GZIP\nMicrosoft: None\nVT Total Detection:25/62\nFirst Submission:2026-05-16T14:32:33.000000+00:00\nLast Submission:2026-05-16T14:32:33.000000+00:00"
          }
        ]
      }
    ]
  }
}