MICROSOFT phish running on salamangounpe[.]gq

Found: 2018-06-05 03:15:45.594000
URL: https://salamangounpe.gq/hotis.zip
File: salamangounpe.gq-foo-hotis.zip
Domain: salamangounpe.gq
Target: MICROSOFT
Name                                               Size Date                 MD5                                hotis/check.php                                      844 2018-01-24 09:53:50  1b486aeec54c1e24df134aca9b98dcb7
hotis/index.php                                    14516 2016-11-23 11:47:16  b8422dd56bccd9509c929e227c01225a
    File appears in 13 kits
hotis/index_files/AppCentipede_Microsoft.svg        7174 2016-11-21 09:17:44  aed5eb9ccea43f119a25b3b74c59c7e7
    File appears in 108 kits
hotis/index_files/Default2057.css                  75295 2016-11-21 09:17:44  79edc980536e8ccc2fea9237701c05a3
    File appears in 14 kits
hotis/index_files/DefaultLoginPaginatedStrings.js  11678 2016-11-21 09:17:46  386d9afa00d91428891ca5ba5cdd7c5d
    File appears in 14 kits
hotis/index_files/DefaultLogin_PCore.js            194377 2016-11-21 09:17:46  78ea3ba4e9bee6a02e0706745b5b9071
    File appears in 14 kits  and under 2 different file names
hotis/index_files/Microsoft_Logotype_Gray.svg       5435 2016-11-21 09:17:46  5feaa482d83c2a69d012f9bff660d373
    File appears in 108 kits
hotis/index_files/prefetch.htm                      3315 2016-11-21 09:17:46  bca1c99c126e0d46c4068ce24ae34ade
    File appears in 13 kits
hotis/index_files/prefetch_data/boot.css           183814 2016-11-21 09:17:44  b5ad5839c267754c302b098755ba0c37
    File appears in 14 kits  and under 2 different file names
hotis/index_files/prefetch_data/boot.js            632898 2016-11-21 09:17:44  2adfcb19e0b8bf09d49f8ea0c3c5b864
    File appears in 14 kits  and under 2 different file names
hotis/index_files/prefetch_data/boot_002.js        630132 2016-11-21 09:17:46  2969fe60171d5e20767d9b321aff20ab
    File appears in 14 kits  and under 3 different file names
hotis/index_files/prefetch_data/boot_003.js        644215 2016-11-21 09:17:46  b27a2cb424fc708abd9ef604b5e78fe1
    File appears in 14 kits  and under 2 different file names
hotis/index_files/prefetch_data/boot_004.js        619046 2016-11-21 09:17:46  42e26520fbefd5e9fd1e7c2f67ea68ec
    File appears in 14 kits  and under 2 different file names
hotis/index_files/prefetch_data/sprite1.css         7584 2016-11-21 09:17:44  0346d135171f20a65334f60ab90ae884
    File appears in 40 kits  and under 3 different file names
hotis/index_files/prefetch_data/sprite1.png        16967 2016-11-21 09:17:44  934d28f5d1967abbde9663d01344bf24
    File appears in 40 kits  and under 3 different file names
hotis/step2-authen.php                             17403 2016-11-23 11:46:56  9920066f6dcd88d1587f1efc89fd2dae
    File appears in 13 kits

1 Email addresses found:
    keithpower25@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total