Zoominfo.com phish ** running on steelsurvivors[.]com

Found: 2018-01-06 04:15:13.824000
URL: http://steelsurvivors.com/wp-admin/js/zoominfo/working.zip
File: steelsurvivors.com-zoominfo-working.zip
Domain: steelsurvivors.com
Target: Zoominfo.com
Name                                               Size Date                 MD5                                working/working/assets/font-awesome.min.css        32270 2017-09-08 18:14:20  bcd6727deec45f9d04b2ec0a2779c93b

working/working/assets/images/events.php             975 2017-09-08 18:14:16  390ed1ea308cc13eb6bedc04cc545802

working/working/assets/images/events/summit/BGs/summit_promotion.png 3573103 2017-09-08 18:14:08  e4abf6fad626e4e90ed6384f403c88aa

working/working/assets/images/events/summit/logos/logo.png  7693 2017-09-08 18:14:12  6ee5d92e786ae3907227807d52e6cb0e

working/working/common/css/simple-login-page-min.css  8731 2017-09-08 18:14:26  78c1ec531d8cd4991497243e74ef1e26

working/working/geoplugin.class.php                 4647 2017-09-08 18:14:50  c8ea1e960b48a620c00bc65d525a721c
    File appears in 1075 kits  and under 3 different file names
working/working/index.html                         25722 2017-09-08 18:14:52  51d25dbdd1c368de70e2f9f5908ceabf

working/working/js/zoomLogin-min.js                554485 2017-09-08 18:14:38  bf32d766aad0aee499959ce6b5dca714

working/working/login.php                           1058 2017-11-21 12:37:38  fa8ee86e8da1813e91b372510c5f47c1
working/working/stylesheets/general.min.css        19173 2017-09-08 18:14:42  9f74a82e23b8bdf113eccfe2e6271ded

working/working/stylesheets/login.min.css           5121 2017-09-08 18:14:44  9f08e861ba963320ad0809aa0c8ceea9


2 Email addresses found:
    gp_support@geoplugin.com (appears in 1052 kits)
    annagals506@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total