{
    "0860e596-bebb-4fbe-81cd-6be8962a889a": {
        "event_id": 10301,
        "created_at": "2020-10-21T07:11:12.434047+00:00",
        "updated_at": "2020-10-21T09:10:21.180081+00:00",
        "name": "Campagna Ursnif a tema Agenzia delle Entrate",
        "description": "Il direttore Agenzie delle Entrate (e altri oggetti)\r\npassword: agenzia",
        "subject": "Informazione Agenzia delle Entrate",
        "tlp": "0",
        "campaign_type": "malware",
        "method": "attached",
        "country": "italy",
        "file_type": [
            "xls"
        ],
        "theme": "Agenzia Entrate",
        "malware": "Ursnif",
        "phishing": null,
        "tag": [],
        "ioc_list": {
            "md5": [
                "45957e252f6012a65ce822a30b43b66f",
                "2acdb2399a8ca54b25252c9091ec9eca",
                "91879159c1ca8dc6ad335373f71daef6",
                "4a1c280556a3282a166795e2e573dc5b"
            ],
            "sha1": [
                "9727059f82c24ab39e687a289d5f70bfa52fd504",
                "73d58928fe65be8e4bc5b2a402d58e3b81013e21",
                "205fb106cb696e9df5acf519d7b7cea7ac0e3480",
                "419f8243c559c3b6814ad3d87eab62ca25f4caee"
            ],
            "sha256": [
                "0f43f8a619aa9088852927e51615afec983721b811505bc369af6d64e12421e6",
                "fa616e8b2fc9a3f5814e60cf5cdc4db40d628ad3c1677c6271110c10be7d3dec",
                "a29c21e7e5685f18d6b2f933c6e4f0ff59a939bca5c7b351ceea966705c7c40d",
                "e02117414978e7e9b5d87ebad5b7312d3f47f46b32b72c8116db8d296081e045"
            ],
            "imphash": [
                "16bb7cf0c8612df459ac3deb44729245"
            ],
            "domain": [
                "gstat.secundato.net",
                "gstat.premiamo.eu",
                "gstat.securezzas.com",
                "gstat.secundamo.com",
                "gstat.securezal.xyz",
                "gstat.secundato.com",
                "windowstats.com",
                "gstat.sloleaks.com",
                "gstat.securezal.com",
                "gstat.securezzis.net",
                "gstat.secutanto.net"
            ],
            "url": [
                "http://livesystems.casa/installa.dll",
                "http://blogilive.casa/installa.dll",
                "http://windowstats.com/images/",
                "http://livesystems.bar/installa.dll",
                "http://livesystems.cyou/installa.dll",
                "http://blogilive.bar/installa.dll"
            ],
            "ipv4": [],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    }
}