L0Psec
Here's an interesting one shared by @malwrhunterteam: 795034792aa705f730dd498c51cbd6e472bae2e823d3a865f52bc3814fdeafd0 - vscode related and feels like DPRK. 5 VT hits. Script does a bunch of legit node stuff, but there is a section for downloading required files 🧵