{
    "da41c844-11e8-4e11-802d-df3379d1ea06": {
        "event_id": 12633,
        "created_at": "2022-03-22T09:52:13.920148+00:00",
        "updated_at": "2022-03-23T08:25:49.937260+00:00",
        "name": "Campagna Ursnif Ministero della Transizione Ecologica",
        "description": "",
        "subject": "Adattamento obbligatorio problema energetico in Italia, come si dovr\u00e0 comportare la vostra impresa",
        "tlp": "0",
        "campaign_type": "malware",
        "method": "attached",
        "country": "italy",
        "file_type": [
            "zip",
            "hta"
        ],
        "theme": "MITE",
        "malware": "Ursnif",
        "phishing": null,
        "via": "email",
        "tag": [],
        "ioc_list": {
            "md5": [
                "eb49b94834bee4084c92c5a37dfb05fb",
                "22d650a31a62a779399d05d13c7f9e26",
                "e9c544f515a8affe8e3847242535f381",
                "beece52ff90384f1ba474598ddf81a0e",
                "fc2ba56fa7ac963930620d91316cb843"
            ],
            "sha1": [
                "7ca966ee7b912368567e54a2a198def2fe1f1fe8",
                "397c0d61e8673dacb52fdde8f5b9d44ad3c75ae0",
                "233eb18e7bfa8616dfa6de5ab3754db60470c603",
                "c878c2decb971fce2b70a56c22f099cc3b75dccb",
                "49f4fea60b8f763e373ab015a1e60998154a263d"
            ],
            "sha256": [
                "1d3fa819ab6e67af9841d0e69a01c2678c7867033123498340e96da7de8bec31",
                "b3221179e8ad59ff65e892f8a4dfadd59f440f60e4d9374a01281a325a64fb88",
                "0650ef83b3fa0ba158db8f846b2702a03b90ce85d691c2cbcade2b95e8d9271f",
                "870532ff8e1ca69b42ab8b5863b9c5080973dad99059f8c1397bd0e38b04b737",
                "55a4efa75b8b71fa60c98a2c2dca697035ffdf8bfdfbb3cb09b15c44de384c8a"
            ],
            "imphash": [
                "8db49d690390954da94a6b4156eaf4e5"
            ],
            "domain": [
                "moendorf.top",
                "checksound.xyz",
                "blogspoints.com",
                "blogspoints.ru",
                "linespremium.pw",
                "premiumlines.top",
                "interforum.top",
                "premiumlists.ru",
                "linkspremium.ru",
                "interblog.top",
                "linespremium.ru",
                "blogerslives.com",
                "filmspoints.com",
                "blogerslines.com",
                "buredom.top",
                "barisola.top"
            ],
            "url": [
                "http://checksound.xyz/readme.txt",
                "http://moendorf.top/index.php",
                "http://barisola.top/index.php"
            ],
            "ipv4": [],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    },
    "7dc9532f-1d4d-4262-bb8a-62c6310ab8f5": {
        "event_id": 12636,
        "created_at": "2022-03-23T07:58:03.779072+00:00",
        "updated_at": "2022-03-23T08:35:58.745676+00:00",
        "name": "Campagna Ursnif Ministero della Transizione Ecologica",
        "description": "allega ZIP con password: mite2022#",
        "subject": "Adeguamento obbligatorio crisi energetica in Italia, come si dovr\u00e0 comportare la vostra attivit\u00e0",
        "tlp": "0",
        "campaign_type": "malware",
        "method": "attached",
        "country": "italy",
        "file_type": [
            "zip",
            "hta"
        ],
        "theme": "MITE",
        "malware": "Ursnif",
        "phishing": null,
        "via": "email",
        "tag": [],
        "ioc_list": {
            "md5": [
                "aee2282abdac6b006eec6e075cfc2f81",
                "9e8a0ecb11cc4b4a2f03f73e52bcd31c",
                "9a47dc7bd667726ca814b0ed63eed798",
                "f80d324c58330924265109d0074ebbf1",
                "16148e750ccd357e150a30ddc08a4780",
                "63ffe6f920f5d4278f94a3300a78e284",
                "4df662c751a7dde0d80589769988d9e0"
            ],
            "sha1": [
                "b3e2de2695347ba0f4a2771a20bf1a949a3250bf",
                "e45c6ed4c47c7057ec6126f8c0418393fc21c4c0",
                "a5ccb54093ab13e87f846dab9c6244d53662eee8",
                "fd4c4f7a3abb7b7e991fa4f3d908d5b59fc7376e",
                "b38ce5b0fc7537fa6418ea0fbea07776aa811539",
                "bd69083d00c33e7b7f884aaacf2a9f6bbfe2513b",
                "cb83c26372e41da4f7f9dbbd6278181705c1a8f6"
            ],
            "sha256": [
                "2183cc86b81c8dcba83981a3bc5e82797839072a27c09f26eede09fc91647da4",
                "627165bc8af599f4380a62cfda524848ef3c88e1bdbd6ce9a72438e28ba4df1b",
                "5b33e1de431d3e2f0914a27e3100a5dec4ed4b1bb127579dcfea371c2ad0323b",
                "84085969e3d0effdc92707ce694e91400673ea11ac52b1a423bbba55738a6e95",
                "42a1d2a7885898c85524a6b18550a9e01b86e5ad1c33af845b6ae1450ef69bfe",
                "d3b545e878af74578eac217c13fd3261d95f723fe7d8df410736606a3a2ab0c7",
                "0666a55041e8c1247fb0b485b453e0235d120c854031e4b8db7f6f22354c6924"
            ],
            "imphash": [],
            "domain": [
                "educatiolink.com",
                "educationlink.xyz",
                "blogspoints.com",
                "blogspoints.ru",
                "vilogerta.top",
                "linespremium.pw",
                "premiumlines.top",
                "premiumlists.ru",
                "linkspremium.ru",
                "interblog.top",
                "linespremium.ru",
                "blogerslives.com",
                "filmspoints.com",
                "blogerslines.com",
                "interforum.top",
                "educatiolines.com",
                "educationlink.su",
                "droelong.top"
            ],
            "url": [
                "http://educationlink.xyz/readme.txt",
                "http://educatiolink.com/index.php",
                "http://educatiolines.com/index.php",
                "http://droelong.top/index.php",
                "http://educationlink.su/readme.txt"
            ],
            "ipv4": [],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    }
}