2021-09-15 Griffon IOCs

THREAT IDENTIFICATION:  GRIFFON (aka Harpy)

SUBJECTS OBSERVED
Bill for mobile service
Obligations of vaccination companies

SENDERS OBSERVED
fzfba@jobs.okimotocorp.com
jmsmpyk@evolvingdesk.nl

IMPERSONATED SENDERS
bill@t-mobile.com
us.company-policy@hrsa.gov

GRIFFON ZIP FILE HASHES
Bill T-Mobil.zip
740c2b846cde9517f07f31fa538a08e4

Vaccine appointment - employees list.zip
9ff6639fdaf77621d0af5e34b388f223

GRIFFON JAVASCRIPT FILE HASH PAYLOAD
T-Mobille Bill #098709..13.2021  - To view successfully open on Windows.txt.js
f1680aa55c88220bcf83e24d89628cc9

10.2021 - Current list of employees who were included to the vaccine schedule.txt.js
f1680aa55c88220bcf83e24d89628cc9

GRIFFON C2
https://civilizationidium.com/

SUPPORTING EVIDENCE
https://app.any.run/tasks/18addfaa-d7a0-4ce8-9cd3-50904ada4c7f/