{
    "fb2c03ae-eed2-4370-b83e-241af1168102": {
        "event_id": 19365,
        "created_at": "2025-07-18T07:00:02.344436+00:00",
        "updated_at": "2025-07-18T09:05:03.087458+00:00",
        "name": "Campagna FormBook italiana",
        "description": "",
        "subject": null,
        "tlp": "0",
        "campaign_type": "malware",
        "method": "attached",
        "country": "italy",
        "file_type": [
            "zip",
            "pdf"
        ],
        "theme": "Documenti",
        "malware": "FormBook",
        "phishing": null,
        "via": "email",
        "tag": [],
        "ioc_list": {
            "md5": [
                "c056ef040ed595c88e886d59e8a0e61c",
                "18121770bb3181c6e529d5edd19414b7",
                "c6e19f31fb92c1f090db4c5753939f16"
            ],
            "sha1": [
                "08c76fa376f0cfcfad442b434653b09978f207cc",
                "167ee725bf3d063fbdc05e4b0fa84360003c7427",
                "d5dfa570b852561efe137a0806bc5bdec453e6d7"
            ],
            "sha256": [
                "47476f8794856949179cc2fa4c63ef7e27d3de9b0deb2808927d7ca7a8f6b8aa",
                "e36ae97ebee84334360ee98e040c172cac19c220bc46dd0e23525a2fb82b4d9a",
                "30e8db279ea13ae22d612f9902cdfeae5cea48392400266fa8500297c7656b90"
            ],
            "imphash": [],
            "domain": [
                "www.bonkcoins.xyz",
                "www.techprojectitr.box",
                "lctechengineering.com",
                "www.tmdgtfeoch.com",
                "www.adeptplus4.net",
                "www.technoproject.it",
                "saipem-projects.bid",
                "www.quickcashswap.xyz",
                "www.mdtech.com.bo",
                "astaoffices.com",
                "aramco-files.cloud",
                "petrofac-files.com",
                "www.consorzio-tfc.it",
                "sbsbiz.com.my",
                "petrofac-files.cloud",
                "consorzio-tfc.it",
                "saipem-projects.cloud",
                "www.sbsbiz.com.my",
                "saipem-files.cloud",
                "saipem-project.cloud",
                "technoproject.it"
            ],
            "url": [
                "http://www.zougla.gr/aod5/",
                "http://saipem-projects.bid/emdec/MRList-2339805122.pdf",
                "http://saipem-projects.bid/Downloads/MR%20List%20RFQ%20271621051020%20Documents%20for%20North%20Field%20Project.Pdf.vbs",
                "http://www.mdtech.com.bo/backup/Apraxia.pcx",
                "https://www.techprojectitr.box/sappurfaxia.pacx",
                "http://lctechengineering.com/py/cv.suziki",
                "http://saipem-projects.bid/em/em.vbs",
                "http://www.tmdgtfeoch.com/backup/hacsyraxiga.pcex",
                "http://www.quickcashswap.xyz/57s6/",
                "https://www.technoproject.it/docs/teejoint.bin",
                "http://www.adeptplus4.net/4nzy/",
                "http://www.bonkcoins.xyz/ekhg/",
                "http://petrofac-files.cloud/italy/it.vbs",
                "http://petrofac-files.com/Downloads/MR%20LisT%20RFQ%2053922108612%20for%20GSP7%20Project.pdf.vbs",
                "https://www.consorzio-tfc.it/petro/Christoffel.asd",
                "http://petrofac-files.com/207/MR-List-9062-000-MS-PRQ-020K307.vbs",
                "http://petrofac-files.com/hol/kito.vbs",
                "https://www.consorzio-tfc.it/saip/Astmatikers.psd",
                "http://petrofac-files.com/ap/Christoffel.asd",
                "http://petrofac-files.com/ut/MR-List-27162195122.pdf",
                "http://petrofac-files.com/pet/msword.vbs",
                "http://astaoffices.com/mx/mx.vbs",
                "https://www.technoproject.it/doc/Apraxia.pcx",
                "http://www.consorzio-tfc.it/petro/Birimose.rar",
                "http://www.sbsbiz.com.my/img/Frgningens.qxd",
                "http://www.consorzio-tfc.it/petro/Sternest.inf",
                "https://www.consorzio-tfc.it/project/Arvens.thn",
                "http://astaoffices.com/eu/eu.gut",
                "http://astaoffices.com/am/amteruth.vbs",
                "https://www.technoproject.it/doc/Fllesnavnenes.prm",
                "http://saipem-project.cloud/ms/ms.vbs",
                "https://www.consorzio-tfc.it/petro/Erklringsdelenes.pcz",
                "http://petrofac-files.com/ap/Erklringsdelenes.pcz",
                "https://www.technoproject.it/doc/Sammensvejsendes.fla",
                "http://lctechengineering.com/lx/hypostasy.rod",
                "http://aramco-files.cloud/kr/koa.vbs",
                "https://www.consorzio-tfc.it/project/Udvalgsbehandlingens.deploy",
                "https://www.consorzio-tfc.it/project/Timelnnedes.u32",
                "http://saipem-projects.cloud/italy/it.vbs",
                "https://www.technoproject.it/doc/Frgningens.qxd",
                "http://astaoffices.com/ms/md.vbs",
                "http://lctechengineering.com/ms/md.amg",
                "http://www.sbsbiz.com.my/img/Sammensvejsendes.fla",
                "http://saipem-project.cloud/msdec/list.pdf",
                "https://www.consorzio-tfc.it/petro/Cockles.mdp",
                "http://saipem-project.cloud/Downloads/MR-List%20PR27162012400%20For%20North%20Field%20Project.pdf.vbs",
                "http://saipem-files.cloud/sai/saip.vbs"
            ],
            "ipv4": [],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    }
}