{
    "d55d3ed3-7d0a-4ae8-8397-ff6bd9210df9": {
        "event_id": 15324,
        "created_at": "2023-10-19T11:13:20.784503+00:00",
        "updated_at": "2023-10-19T11:13:21.125891+00:00",
        "name": "Campagna ScreenConnect italiana",
        "description": "",
        "subject": null,
        "tlp": "0",
        "campaign_type": "malware",
        "method": "attached",
        "country": "italy",
        "file_type": [
            "vbs",
            "pdf"
        ],
        "theme": "Pagamenti",
        "malware": "ScreenConnect",
        "phishing": null,
        "via": "email",
        "tag": [
            "ShortUrl"
        ],
        "ioc_list": {
            "md5": [
                "28bffb01262b653b5948dd837bc9ded4",
                "1d3c8727b94269c98777185bc5a5e140",
                "cc9e080d1766d43008cfe5e5deba584f"
            ],
            "sha1": [
                "bcd13b47bc9f5ab3d1d4c0a0b34c112c5920a273",
                "836bd1d60c643f2e98096218a093dd404c8d66c4",
                "c8d06d1269bc10dd8a0b696c5fd90fa84a3425af"
            ],
            "sha256": [
                "78aff05aa2ad11f42353bfbded5b8539b95c3fcbfbc35053641e8d902eecd8b5",
                "5dda5b868b0c3af3ae72aceeb80c159789cbf6260de5d3db26ea41f5c90e6f04",
                "cb513781bcbf9fa820bdc3061089722795adf1d48a8788416b8e38dc9d287027"
            ],
            "imphash": [],
            "domain": [
                "cryptoapex-invests.com"
            ],
            "url": [
                "https://cryptoapex-invests.com/js/exploit.ps1",
                "https://cryptoapex-invests.com/js/any.exe",
                "https://www.mediafire.com/file/xc4aj1auw1l8zhr/Fattura10.18.23.vbs/",
                "https://bit.ly/Fattura181023",
                "https://instance-ln8lsc-relay.screenconnect.com",
                "https://cryptoapex-invests.com/js/install.bat"
            ],
            "ipv4": [],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    },
    "356c8709-c5e7-456a-9e7e-4e033805e913": {
        "event_id": 15320,
        "created_at": "2023-10-19T08:31:33.173394+00:00",
        "updated_at": "2023-10-19T08:55:55.738308+00:00",
        "name": "Campagna ScreenConnect veicola UltraVNC",
        "description": "Campagna rilevata da fonti OSINT. Il file ha nome Fattura_XXX.vbs.",
        "subject": "Conferma pagamento fattura dal 18/10/2023",
        "tlp": "0",
        "campaign_type": "malware",
        "method": "attached",
        "country": "italy",
        "file_type": [
            "vbs",
            "exe",
            "rar",
            "pdf"
        ],
        "theme": "Pagamenti",
        "malware": "ScreenConnect",
        "phishing": null,
        "via": "email",
        "tag": [
            "UltraVNC"
        ],
        "ioc_list": {
            "md5": [
                "6a120d996e457a9de75298d341d6d1a5",
                "dd4589f4f685e5cad105ec0a3aa3f96b",
                "193a7c86091ca535bfd8cecefd66db92",
                "81d8cd93c1c042209fb194fdfc67f3dc",
                "da08e8d5ec04d00523750aba37ddbf26",
                "a6244a2ccb3cb10f19f66a74b7e9ae19",
                "45d773e41548d4d615944db5d19445f4",
                "f24f62eeb789199b9b2e467df3b1876b",
                "cb6983e1dbaaf2391c9b4ea582e2b8c1",
                "b9b8c2ad3f16dd1ee7518b5b4ed165b1",
                "fd877ae342e4e8b246d11700eb90b23d"
            ],
            "sha1": [
                "fc8d881bf7b13df8e7bf31b6f811f53c44f8336d",
                "2ddf1b3eebef8458cc023cc9faa9c98eebf36171",
                "9c1790db6b9cbd9c5bf2b12b8fbcf6a342a6fd3a",
                "c7cff685f59287f36134a6e14c915491ff9fd9fa",
                "d3368caccf096fe27b5c2b77e867e465f7d248d2",
                "b5eb3a6a35f645432e0bf18acd2ef10824b48d8c",
                "4d07b1d06c531c52bd3f2fb38b6fa338d3b4ba6b",
                "8e7a46f0bd61516f23a2ebb217fa8e81f18e1a7d",
                "b48c5c09d0c62fb3db625ec6c9b3b3667a075e02",
                "0adfc8ca4273d6e027d47dbf7de2d978ccaf036e",
                "de3ac21778e51de199438300e1a9f816c618d33a"
            ],
            "sha256": [
                "1ce4768f825372d55c1d30ce3ac41afb913de6299a64ae5b0ac1b3b752421d64",
                "4da74a42d11588679227d5c6573d693939638a796f0775a38055fea997597153",
                "210011d881a2d92ab622dbfab0c75d9ed05f2bee2d3cafb1b4ebdcefbc161e21",
                "85bdf691ddbeebf9a11faa642fc7767507014483a7d43ede19406bfe46b8969f",
                "852edfa00a80b02cd48ff063f9c62a2ba0e9a90acb289b96f29b4d5faeda63b7",
                "e596899f114b5162402325dfb31fdaa792fabed718628336cc7a35a24f38eaa9",
                "a1914ce3c6554fc7df5ca914ae25d1b2e5566418341c7dbc7d867d312041c6e3",
                "c2ab7b8701bdc36198a8f01791c8a3479ef3e8bcc6ccd3bd8c2f60dd9672e8e1",
                "4528489ea4bc2cf115c05db55cd1077a4f4854293ecd240821c8c4c64b16c3b1",
                "c573aceb69a23904d9b8989997d573819332ca56ab015615248b732ff7666675",
                "d658f722760324a9e866c6aff9b739ee59976c60a96b1ed3bc3d4048f8491b24"
            ],
            "imphash": [],
            "domain": [
                "studioaziende.click",
                "spm23.casacam.net"
            ],
            "url": [
                "https://studioaziende.click/madona.mp3",
                "https://www.agendepoint.it/6628-thickbox_default/ricevuta-di-pagamento-attivita-sportive-2-copia-autor-9x17-pezzi-2.jpg",
                "https://studioaziende.click/",
                "https://studioaziende.click/pink.mp3"
            ],
            "ipv4": [],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    }
}