MICROSOFT phish running on scoalamameipitesti[.]ro

Found: 2018-04-05 16:23:34.741000
URL: http://scoalamameipitesti.ro/wp-admin/images/serviceupdate.zip
File: scoalamameipitesti.ro-images-serviceupdate.zip
Domain: scoalamameipitesti.ro
Target: MICROSOFT
Name                                               Size Date                 MD5                                serviceupdate/serviceupdate/action.php               745 2016-03-16 07:09:50  c13ae1e4fb32e5901fa21cc726282616
    File appears in 3 kits
serviceupdate/serviceupdate/files/163.ico            318 2015-06-12 19:43:48  a14e5365cc2b27ec57e1ab7866c6a228
    File appears in 45 kits
serviceupdate/serviceupdate/files/bootstrap.css    123256 2015-06-12 19:43:48  e1044d37a3279a28f345eab75bc5e2ac
    File appears in 9 kits
serviceupdate/serviceupdate/files/domain.ico        1150 2015-06-12 19:43:48  228ba3f6d946af4298b080e5c934487c
    File appears in 52 kits  and under 2 different file names
serviceupdate/serviceupdate/files/element.js        1472 2015-06-12 19:43:48  d7f4f10157d75566a03208a91dcb999b
    File appears in 124 kits  and under 2 different file names
serviceupdate/serviceupdate/files/elementa0d8.js    1472 2015-06-12 19:43:48  d7f4f10157d75566a03208a91dcb999b
    File appears in 124 kits  and under 2 different file names
serviceupdate/serviceupdate/files/errors.css       20194 2015-06-12 19:43:48  8c128c27fd2d17b7669cb47db5b6b4da
    File appears in 9 kits
serviceupdate/serviceupdate/files/favicon.ico       5430 2015-06-12 19:43:48  9796ed786d95606d51be9dab54fb5350
    File appears in 134 kits  and under 4 different file names
serviceupdate/serviceupdate/files/i.css            218094 2015-06-12 19:43:48  3e4e39d2090a2e43a464de3b8ff75128
    File appears in 9 kits
serviceupdate/serviceupdate/files/ii.css           24206 2015-06-12 19:43:48  a5ca8a215dc535fce8f1b82bd9f06d30
    File appears in 9 kits
serviceupdate/serviceupdate/files/index.html        1313 2015-06-12 19:43:48  3cfdf7515bd2ce4ea19df4541020546d
    File appears in 9 kits
serviceupdate/serviceupdate/files/load.gif         53202 2015-06-12 19:43:48  7523f2f789027d756e4c0df1f008a859
    File appears in 28 kits
serviceupdate/serviceupdate/files/logo_strip_2x.png 11156 2015-06-12 19:43:48  384a868cf5a995d033c4ac6e30c60355
    File appears in 1276 kits  and under 5 different file names
serviceupdate/serviceupdate/files/notice-error.png  1026 2015-06-12 19:43:48  a3265cc598ae28633c060889e790f80c
    File appears in 27 kits
serviceupdate/serviceupdate/files/OLFav.ico         1150 2015-06-12 19:43:48  a54b3a2f0867ea6edd1d0d18a212a121
    File appears in 46 kits
serviceupdate/serviceupdate/files/outlook.ico      17174 2015-06-12 19:43:48  12e3dac858061d088023b2bd48e2fa96
    File appears in 356 kits  and under 9 different file names
serviceupdate/serviceupdate/files/outlook5e1f.ico  17174 2015-06-12 19:43:48  12e3dac858061d088023b2bd48e2fa96
    File appears in 356 kits  and under 9 different file names
serviceupdate/serviceupdate/files/signin.css         765 2015-06-12 19:43:48  b8f95ee3c79ba70801bff1db9841c62f
    File appears in 25 kits
serviceupdate/serviceupdate/files/Snapshot_2014-11-20_161431.png 23472 2015-06-12 21:59:44  b45630be2559fc93885c860f00816153
    File appears in 9 kits
serviceupdate/serviceupdate/index.php               3105 2015-12-09 15:26:16  83bd8922dd88f196a1071f0477eb1b56
    File appears in 3 kits
serviceupdate/serviceupdate/loading.html            8218 2015-12-09 15:32:00  dc7de427fce7c593efde2ba9f4922403
    File appears in 3 kits
serviceupdate/serviceupdate/success.html            5071 2015-12-09 15:03:26  02220bbd9bf16d43aeafed132fed0d20
    File appears in 3 kits

4 Email addresses found:
    bruce.forrlong@gmail.com
    wirez@googledocs.org (appears in 173 kits)
    'bruce.forrlong@gmail.com
    bla-bruce.forrlong@gmail.com-bla



https://texasmalwareblog.blogspot.com   @phish_total