Wells Fargo phish running on makeupartistsd[.]com

Found: 2018-02-19 17:15:25.236000
URL: http://makeupartistsd.com/wp-admin/WlssazabeWells.zip
File: makeupartistsd.com-wp-admin-WlssazabeWells.zip
Domain: makeupartistsd.com
Target: Wells Fargo
Name                                               Size Date                 MD5                                WlssazabeWells/wellsFFN/images/confirm.png          1238 2017-09-25 19:20:50  a57209d7b292eb6b9a52f3dce25ccc71
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/favicon.ico          1078 2017-09-25 19:20:48  24e461019c9c8e9701d55f8408cde993
    File appears in 26 kits  and under 2 different file names
WlssazabeWells/wellsFFN/images/logo.png             2440 2017-09-25 19:20:48  2b77a8dc547c82d3aac77ada2e39bbe2
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/s1.png              13672 2017-09-25 19:20:48  b6dc7c07f0c33c8b6605791df0b9db64
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s10.png             11974 2017-09-25 19:20:48  2cd5539524addfd3207cbfb99b1b55f7
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s11.png              1429 2017-09-25 19:20:48  fcc294af3b4969bc70e5a11a16a282e5
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s12.png              2617 2017-09-25 19:20:48  6b6e8d5e2855a8380b1d26543e608636
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s4.png              180386 2017-09-25 19:20:46  b3eb9085923e5a3df50615e68db5e00f
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s42.png             122389 2017-09-25 19:20:48  632a80aba4e3e6cd266c3526bfaf60bd
    File appears in 2 kits
WlssazabeWells/wellsFFN/images/s43.png             14990 2017-09-25 19:20:50  8e0d8d02b68cbc508b7b11a3a337de5a
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s5.png              369096 2017-09-25 19:20:50  e24579b0c239dfd3f38aaf74f68f90e5
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s6.png              434632 2017-09-25 19:20:50  a4fc2b11149664573d109eb3863be9e2
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s7.png              465206 2017-09-25 19:20:50  c5ffdda8f13c3ece496230ea1d16a055
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s8.png              31379 2017-09-25 19:20:48  aa3e1c89d61f0fe23171f8b1c6468ec5
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/s9.png              27072 2017-09-25 19:20:50  3e88a7b7bc0d77b36a036c58d3a3b509
    File appears in 3 kits
WlssazabeWells/wellsFFN/images/secu.png              907 2017-09-25 19:20:46  f37e12eb200d3301d5ee6e16275f6550
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/ssign.png             710 2017-09-25 19:20:48  35a90625af359f6f74f5377aa697210f
    File appears in 2 kits
WlssazabeWells/wellsFFN/images/wf.gif              45034 2017-09-25 19:20:48  56f2a72f82d98a724835cd275ac2d0bf
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/wf17.png              265 2017-09-25 19:20:48  fd54ad94c29d6047cbcaed26326061c6
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/wf18.png             7384 2017-09-25 19:20:50  c1fddcbae4d661c265e7494e20d9684c
    File appears in 2 kits
WlssazabeWells/wellsFFN/images/wf20.png             3350 2017-09-25 19:20:48  4fcfc121efb08faf46de689b45221c6a
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/wf21.png             1287 2017-09-25 19:20:48  909ac8aac8490e9719bd2cad173fcb1c
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/wf22.png              274 2017-09-25 19:20:50  2c92fc9c7305b8b239325f385d967652
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/wf25.png             4400 2017-09-25 19:20:48  03b34be17fd91501ee745af451027248
    File appears in 4 kits
WlssazabeWells/wellsFFN/images/ws3.png              2638 2017-09-25 19:20:50  f17a5c15bb3d2a1bd580327c3973d098
    File appears in 2 kits
WlssazabeWells/wellsFFN/index.php                    144 2017-09-25 19:20:46  0526c242a1f7b6117202fe21d47e31b1
    File appears in 130 kits  and under 4 different file names
WlssazabeWells/wellsFFN/login.php                   8292 2017-09-25 19:20:46  770bd43f21992e5ae06d29bb5bc9c3cd
    File appears in 2 kits
WlssazabeWells/wellsFFN/next1.php                   1449 2018-01-05 23:36:18  fac51c42c5e0cfb5097589a8a088d65b
WlssazabeWells/wellsFFN/next2.php                   1415 2018-01-05 23:36:08  50644f1fea665326513ae1592c2fdc5a
WlssazabeWells/wellsFFN/step2.php                   4060 2017-09-25 19:20:46  358380d29c906d571978062ec3b213bf
    File appears in 2 kits
WlssazabeWells/wellsFFN/step3.php                   2420 2017-09-25 19:20:46  f986837840b710b024919aa62b441836
    File appears in 2 kits

3 Email addresses found:
    attachese.667.11@gmail.com
    attachese667@yandex.com
    supertool@mxtoolbox.com (appears in 44 kits)



https://texasmalwareblog.blogspot.com   @phish_total