New Ursnif Campaign is targetting Italian users

ALL IOCs
Malspam:
Oggetto:
“Relata di notifica sentenza #<10NUM> Del DD/MM/18”
Mittenti:
@hobokengourmetcatering .com
@healthychoicenyc .com
@healthychoicekitchenbushwick .com
@holechanphilly .com
@hobokenburritonyc .com
@healthkingmidtown .com
@healthfullyorganicmarketnyc .com
@holeycreamnyc .com
@hobokenburritonyc .com
@hobokengourmetcatering .com
@hollywoodchicshollywood .com
Dropurl:
hxxps ://drive.google[.com/file/d/1nmXBN6clkUNByRiNXIvqEJeyxygQLORS/view
hxxps ://drive.google[.com/file/d/1czUcMDCAQe1COhkN59zbMsBscr3RCjTL/view
hxxps ://drive.google[.com/file/d/1Dj787P7vlyM51nDhc_mI9HJ1pO_UF1n9/view
http:// nupp.810delicafe[.com/jogptfbuu=w?bba=1
http:// kiki.33gourmetdelinyc[.com/pagjfut54.php
kiki.33gourmetdelinyc[.com
nupp.810delicafe[.com
nopp.ajisaijapanesenyc[.com
mino.aghapyfoodridgewood[.com
C2 (ursnif):
195.123.237[.165
loads[.smallworld-parties[.com
hxxp:// loads.smallworld-parties[.com/images/
Hash:
66d7b726ccc02c873d947b9b9968664dd7b1eaf534edc84138bbc67dc2977749  zip
c480986ec7bd8cf2dcba58e2f5e8c90345f2a478aec07405273f7112a72baab7 vbs
07ec43f438865d3b5e91b6e49de15c44023ad48ee86acfb84b8618f87b6e932c exe


OLD CAMPAIGN IOCs:
Malspam:
Relata di notifica atto N.9491385473 Del 11/07/18 (o varianti)
Dropurl:
hxxps:// drive .google[.com/file/d/14INdiQU0T4ekU5dVQdm7zGhTjnaxlakB/view
hxxp:// burypo.gihealthrecords[.info/jkfwefbgdkj=kshlw?pbba=2
hxxp:// burypo.giondemanduniversity[.com/pagjfut54.php
C2 (ursnif):
load.kapswholesale[.com
pool.jfklandscape[.com
hxxp:// 93.179.68[.182/images/
Hash:
7ace3d42ef11b44ac0ed688b662722febf8d272cf490e66504d97ee362f6411c vbs
3de58246d88d6bf3b2e042098caa14dccccab39c37e78888ed33bc4016caae54 zip
7a4d40b9baf389d09eee6e02af126477bf8b24afcbea79a179b45121b7a6210b exe