Wells Fargo phish running on one30nine.com

Found: 2017-10-21 08:16:57.401000
URL: http://one30nine.com/wellsnew.zip
File: one30nine.com-foo-wellsnew.zip
Domain: one30nine.com
Target: Wells Fargo
Name                                               Size Date                 MD5                                wellsnew/wellsnew/wellsnew/index.php                 521 2017-07-20 09:27:16  d74898c0bf59d1cfe0795dbca5b4b2d2
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/confirm.png 502651 2017-07-20 09:27:16  dd2fde7f61789e28d2acc477937064d3
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/confirm2.png  6986 2017-07-20 09:27:16  70b16496baa9671b84d7860305bdd791
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/continue.png  3925 2017-07-20 09:27:16  30a30c95623130cc4baba4a97e6eb1d5
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/image1.png 311948 2017-07-20 09:27:16  342c9e619e9314f4817f1e695f7b942f
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/image2.png 33668 2017-07-20 09:27:16  7d97f401de51ae666946a06985aa5098
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/img1.png   14068 2017-07-20 09:27:18  298d3a3f238474ae0a7723014c339fb3
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/img2.png    8543 2017-07-20 09:27:18  c71800fa9f73fd3864076ee1a620939f
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/logo.png    6063 2017-07-20 09:27:18  549b8ab2c78c4306ece745baa623e214
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/logos.png   5648 2017-07-20 09:27:18  902cc0f99bef72ff8c385f7de7ebb613
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/images/signon.png  3496 2017-07-20 09:27:18  f4f3ce19795565e818d75432614ae9d9
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/index.php          2314 2017-07-20 09:27:16  6dfd0cb6de9aecb52e67c89bf5d19fe5
    File appears in 2 kits
wellsnew/wellsnew/wellsnew/Login/postr.php          1798 2017-08-29 06:30:08  4547f34c2afd57b8ff08a4f667586776
wellsnew/wellsnew/wellsnew/Login/posts.php          1835 2017-08-29 06:30:16  907e1e806412d33ddb1337240386523d
wellsnew/wellsnew/wellsnew/Login/update.php         2051 2017-07-20 09:27:16  c52b4bba860e31b4eb5d3ba278424695
    File appears in 2 kits

2 Email addresses found:
    fatwire3@yandex.com
    ss@ssss.org (appears in 2 kits)



texasmalwareblog.blogspot.com   @phish_total