DHL phish running on aacihealthcare[.]com

Found: 2018-05-14 02:17:58.349000
URL: http://www.aacihealthcare.com/wp-admin/dhll/DHL.zip
File: www.aacihealthcare.com-dhll-DHL.zip
Domain: aacihealthcare.com
Target: DHL
Name                                               Size Date                 MD5                                DHL/DHL/.htaccess                                   8251 2017-05-02 08:23:16  0b78ed9674e6877625e54c1e3840b6f0
    File appears in 2 kits
DHL/DHL/blocker.php                                 2644 2017-04-28 11:33:46  5aa3f3f406ced12d0bc7742e77b01781
    File appears in 264 kits  and under 5 different file names
DHL/DHL/deliveryform.php                            3494 2017-06-12 14:31:24  68ff5b897a92af9a86c7d3b9bcfe54ce
    File appears in 2 kits
DHL/DHL/done.php                                   31099 2016-08-08 15:56:30  e37774fc174a70a34583642ec8ffa8f1
    File appears in 5 kits
DHL/DHL/images/5_1_dhl_global_locator_all_340_187.gif  4135 2015-04-13 08:45:08  b902d3274524ff1e7d328025bf3e6501
    File appears in 26 kits
DHL/DHL/images/alert-icon-red-md.png               39161 2015-04-13 10:28:02  dcffb50e8b700cef50b4a0a9db375235
    File appears in 25 kits
DHL/DHL/images/aol.jpg                             37211 2015-04-13 09:06:58  0ae6254cdb0e0bf52c6711319bb9deb6
    File appears in 24 kits
DHL/DHL/images/dhl_logo.gif                          443 2015-04-13 08:45:22  749b06c85447bd7bc889ecbaaa0980ee
    File appears in 29 kits
DHL/DHL/images/favicon.gif.ico                      2238 2015-04-13 08:44:54  a6f1af8e79a11829ba9a66474b06bb97
    File appears in 28 kits  and under 2 different file names
DHL/DHL/images/gmail.jpg                           15630 2015-04-13 09:51:10  62f27f7c15772f6017d8420ce347e163
    File appears in 24 kits
DHL/DHL/images/horde.png                            5030 2015-04-13 09:14:00  c603256d7db596d90d695429190a8f14
    File appears in 24 kits
DHL/DHL/images/login.JPG                            8956 2015-06-23 17:13:06  606de1c338b23e21c23720c33928db14
    File appears in 19 kits
DHL/DHL/images/netease_png.png                       992 2015-04-13 08:59:44  dd047422863fbf769906668bcb3c0ad9
    File appears in 29 kits  and under 3 different file names
DHL/DHL/images/outlook.jpg                         17055 2016-12-15 22:55:24  d021f93a585813634c856dcd8f97c204
    File appears in 2 kits
DHL/DHL/images/roundcube.png                       29277 2015-04-13 09:44:58  385c0fbfcc2972e0bd01e1bf92e8ed0b
    File appears in 24 kits
DHL/DHL/images/Squirrelmail_logo.png               41510 2015-04-13 09:11:52  8a5946eca6e1640efdc2c761ecd6b89b
    File appears in 24 kits
DHL/DHL/images/Thumbs.db                           133120 2017-06-12 14:15:48  540275c78455c890935ca6629cb039c9
    File appears in 2 kits
DHL/DHL/images/yahoo.jpg                           16934 2015-04-13 09:03:58  468a044204af6794753ec71d53e8893e
    File appears in 24 kits
DHL/DHL/index.php                                    401 2017-06-12 13:56:36  02d6dde3911caff6b9d19be52ff6e811
    File appears in 2 kits
DHL/DHL/Logon.php                                   2241 2018-02-26 21:58:28  b90ca511561a35b2c70d7e620b5dffff
    File appears in 2 kits
DHL/DHL/Logon2.php                                  2245 2018-02-26 21:58:06  49724a6159692b1544cedb5289a36158
    File appears in 2 kits
DHL/DHL/robots.txt                                  1337 2017-04-28 11:33:46  ba613657ddd17df5e61d5571b9c9d681
    File appears in 127 kits
DHL/DHL/Secinfo.php                                 2654 2018-02-26 21:58:50  48f435725cfa6c2dc14ddd8deb01cc66
    File appears in 2 kits
DHL/DHL/tracking.php                                3768 2017-06-12 14:30:50  a9d1019b91b9f5ed04701054c9cca8a9
    File appears in 2 kits
DHL/DHL/tracking2.php                               4019 2017-06-12 14:31:10  98a5f7c5a88e16de4666886baa0b8203
    File appears in 2 kits

2 Email addresses found:
    kkttddnn@gmail.com (appears in 3 kits)
    info@xsender.com (appears in 2 kits)



https://texasmalwareblog.blogspot.com   @phish_total