Yahoo! phish running on edonenergia[.]pl

Found: 2018-02-20 10:13:34
URL: http://edonenergia.pl/wp/wp-contentt/Yfileg.zip
File: Yfileg-edonenergia.pl.zip
Domain: edonenergia.pl
Target: Yahoo!
Name                                               Size Date                 MD5                                Yfileg/action.php                                   1542 2016-11-02 10:13:26  64a57ae6c9610c1668f7c6ad92bd9310
Yfileg/index.html                                  137002 2016-10-31 15:46:20  e99a36e122ab1fa36979b78d240cf891
Yfileg/index_files/combo                           36977 2016-10-31 15:46:20  cd9e43683db291f5c2cc7280e0afd50b
    File appears in 10 kits  and under 3 different file names
Yfileg/index_files/combo.css                       15301 2016-10-31 15:46:20  178994417f1791625810dff3bb0d42ba
Yfileg/index_files/combo.js                        16778 2016-10-31 15:46:20  83b749a7a46062f94e4ed99a301e9f82
Yfileg/index_files/combo_002                       67058 2016-10-31 15:46:20  186eef3996162378bce054db64b9cba4
    File appears in 10 kits  and under 3 different file names
Yfileg/index_files/combo_002.js                    106952 2016-10-31 15:46:22  8ac2258b532f8c13194c27cfcd3bf9aa
    File appears in 2 kits
Yfileg/index_files/container-min-1.css              4767 2016-10-31 15:46:22  3ce7d5bde56b8f21819aa0fc0e91d47d
    File appears in 11 kits
Yfileg/index_files/cs_0.js                          1420 2016-10-31 15:46:22  0e8f77ffd7c5f7225727ad8e4a3dac89
    File appears in 10 kits  and under 2 different file names
Yfileg/index_files/darla-secure-pre-min.js         54141 2016-10-31 15:46:22  f06fe5fa1deef8da89e4156b0c08729a
    File appears in 3 kits
Yfileg/index_files/ext-render-secure.htm            6084 2016-10-31 15:46:22  ecc5a471d6ad6d83e6296db378f2fd37
Yfileg/index_files/ext-render-secure_data/darla-ers-min.js 20652 2016-10-31 15:46:22  e5631548534ce13cb2d9817db5bd275d
    File appears in 3 kits
Yfileg/index_files/ext-render-secure_data/p.gif       43 2016-10-31 15:46:22  fc94fb0c3ed8a8f909dbc7630a0987ff
    File appears in 118 kits  and under 32 different file names
Yfileg/index_files/login.gif                          43 2016-10-31 15:46:22  13e1c7a2184e36d7ae519e99b1aa226f
    File appears in 6 kits  and under 2 different file names
Yfileg/index_files/webtrends.js                    55037 2016-10-31 15:46:22  84812f8254281c56c5422672a845e7a6
Yfileg/index_files/wtid.js                           201 2016-10-31 15:46:22  65f43329b898c1f343390736093eb59a
Yfileg/index_files/yahoo_container-min_json-min_connection_main-min-new.js 132448 2016-10-31 15:46:22  327e72cc56a0c684abccb0fbbce13521
    File appears in 11 kits
Yfileg/index_files/yregbase_sec_ui_1_9.css         11776 2016-10-31 15:46:22  707c8dc0551d6b5f911d4368b4ac282f
    File appears in 11 kits
Yfileg/index_files/yui-min.js                      68018 2016-10-31 15:46:22  08b2b1cb0a45bc705db87a37129be5f3
    File appears in 11 kits  and under 2 different file names

2 Email addresses found:
    davederek30@gmail.com
    new@tooolz.com (appears in 8 kits)



https://texasmalwareblog.blogspot.com   @phish_total