WEBMAIL phish running on cip-consortium[.]ro

Found: 2018-03-21 00:15:52.892000
URL: http://cip-consortium.ro/js/joenneded/autolink_confirmpass.zip
File: cip-consortium.ro-joenneded-autolink_confirmpass.zip
Domain: cip-consortium.ro
Target: WEBMAIL
Name                                               Size Date                 MD5                                autolink_confirmpass/autolink_confirmpass/autolink/autolinkauto/mailboxx/mailbox/confirmindex.php  1733 2017-06-25 15:15:28  40375c88c2a847de60da351dcc2bdb3e

autolink_confirmpass/autolink_confirmpass/autolink/autolinkauto/mailboxx/mailbox/confirmpost.php  1005 2017-06-25 15:17:36  1583dcb7680a140932167ac82534cea2
autolink_confirmpass/autolink_confirmpass/autolink/autolinkauto/mailboxx/mailbox/index.php  1679 2017-01-12 11:22:04  013024eb88860d5ce1a6ed2f26f2cbce

autolink_confirmpass/autolink_confirmpass/autolink/autolinkauto/mailboxx/mailbox/post.php  1015 2017-06-25 23:42:04  ed1209d7a84e0564d19d9517676e9270

autolink_confirmpass/autolink_confirmpass/autolink/autolinkauto/mailboxx/mailbox/thankyou.php  4185 2015-11-03 14:47:02  427f7baf2abd27638bfd2ce2513b5873
    File appears in 39 kits

2 Email addresses found:
    spywirelogs@gmail.com
    nicholasgodfrey38@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total