WELLS FARGO phish running on akconnect-tr[.]com

Found: 2018-01-03 07:15:03.755000
URL: http://www.akconnect-tr.com/wellsb.zip
File: www.akconnect-tr.com-foo-wellsb.zip
Domain: akconnect-tr.com
Target: WELLS FARGO
Name                                               Size Date                 MD5                                wellsb/go.htm                                      438138 2017-07-20 20:50:04  39daa0e9cd0b73ecad6248f569871089
wellsb/go.php                                        718 2018-01-02 04:14:46  78a220031c7f16067b2a7197ddbf497f
wellsb/go_files/a                                    471 2017-07-20 20:46:06  aaa92a94c3b8c60cabc5fb753f88b846
wellsb/go_files/atadun.js                           1067 2017-07-20 20:46:06  a5da2c3beec70f1d3a30f8b99a77de79
    File appears in 3 kits  and under 2 different file names
wellsb/go_files/conutils-6.js                       9948 2017-07-20 20:46:06  3334b679f746163002f73f7f7dd79422
    File appears in 3 kits  and under 2 different file names
wellsb/go_files/login-userprefs.js                 146928 2017-07-20 20:46:06  be532c1e182f9fdafc489af19acff160
wellsb/go_files/nd                                 36644 2018-01-02 04:18:00  1ad6b44c90a26d0648fcb4f7c2690fa6

2 Email addresses found:
    donzaza89@gmail.com
    tee@xxx.com (appears in 13 kits)



https://texasmalwareblog.blogspot.com   @phish_total