WEBMAIL phish running on 000webhostapp.com

Found: 2017-11-29 05:15:54.685000
URL: http://tsarism-swallow.000webhostapp.com/accountteam/VALIDATE%20NOW.zip
File: tsarism-swallow.000webhostapp.com-accountteam-VALIDATE%20NOW.zip
Domain: 000webhostapp.com
Target: WEBMAIL
Name                                               Size Date                 MD5                                VALIDATE NOW/index.htm                               127 2012-11-28 05:57:40  ed9d6e04a557423f14a5cf467c8efb6e
    File appears in 8 kits
VALIDATE NOW/mail.htm                               1593 2013-09-04 17:06:46  9b9c9a0d3d4410e57cc9241aa842acf5
    File appears in 8 kits
VALIDATE NOW/up.php                                  917 2016-04-28 22:25:34  12ed20669cf0b3ba7d2d4277cc7b09a5

VALIDATE NOW/validation.html                         930 2013-09-04 17:24:40  10c641abb8539cae6d2d6b1821584b24
    File appears in 8 kits  and under 2 different file names

2 Email addresses found:
    'postmasterlog@gmail.com
    irus@amaslim.com (appears in 2 kits)



https://texasmalwareblog.blogspot.com   @phish_total