DROPBOX phish running on vandalier[.]com

Found: 2018-02-20 15:21:38.975000
URL: http://vandalier.com/dpr/dropnow.zip
File: vandalier.com-dpr-dropnow.zip
Domain: vandalier.com
Target: DROPBOX
Name                                               Size Date                 MD5                                dropnow/dropnow/action.php                          1355 2016-09-20 14:58:20  44a826a51ccca5695e7ffde0a8df4bed
    File appears in 3 kits
dropnow/dropnow/action2.php                         1240 2016-10-21 12:21:10  64e766b902eef3f81c7443cd48a88fad
    File appears in 2 kits
dropnow/dropnow/antiboots.php                       2620 2016-09-02 19:43:26  6b3386c86f6f32a4ece607a5cb8e3d16
    File appears in 63 kits  and under 2 different file names
dropnow/dropnow/autoblock.php                        821 2016-09-02 19:47:58  5e0a3e7c6e81d4310442ce8b64d82881
    File appears in 31 kits
dropnow/dropnow/css/style1.css                      2471 2016-09-08 20:53:32  abb631fc9c76a3c0b1daea176e391ae8
    File appears in 31 kits
dropnow/dropnow/img/confirm_text.PNG                4985 2016-09-02 17:16:26  69f9de2f2c69a07cdcd37694a0051f7a
    File appears in 29 kits
dropnow/dropnow/img/footer.jpg                     15983 2016-09-02 16:16:06  af51da560c778aff89540f4f36e94465
    File appears in 29 kits
dropnow/dropnow/img/help.png                        1218 2016-09-02 16:17:20  224a26dd8447d7f2e4c761559b4749e7
    File appears in 29 kits
dropnow/dropnow/img/left.png                       96390 2016-09-02 18:45:20  30c3a04ccbad81cc99c4af725d578f1d
    File appears in 29 kits
dropnow/dropnow/img/logo.png                        1427 2016-09-02 14:40:44  38928e53077a706aa26ba249717dd63d
    File appears in 40 kits  and under 2 different file names
dropnow/dropnow/img/multi.png                      29225 2016-10-01 07:44:46  748e60e2c4c203e0490ff42829c4b736
    File appears in 11 kits
dropnow/dropnow/img/next.png                        2081 2016-09-02 19:01:36  55ac166497e536b95afef791d422d4b9
    File appears in 29 kits
dropnow/dropnow/img/texto_23.PNG                    3613 2016-09-08 20:41:30  363b0b31b2673d36aa53afd2c2e3cbc8
    File appears in 29 kits
dropnow/dropnow/index.php                           2479 2016-09-29 01:40:48  33550962adcaff72dc5afad87d313cb8
    File appears in 14 kits
dropnow/dropnow/phone_number.php                    1962 2016-10-13 05:41:46  d491703235d432cd554abc53dcc1486a
    File appears in 11 kits
dropnow/dropnow/processing.php                      1600 2016-09-08 22:14:38  ba932def08ab6288c1090a4e0338b37c
    File appears in 29 kits
dropnow/dropnow/thanks.php                           808 2016-10-09 14:32:20  96ea7f7c5052ad4c47b264536c1e43dc
    File appears in 11 kits
dropnow/dropnow/to.php                                52 2018-01-29 22:05:56  d39d97fc9492225ad2d87858a9f765b7

2 Email addresses found:
    vip@163.goooo (appears in 3 kits)
    maxwellwester1234@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total