ALIBABA.COM phish running on edictosucesorio[.]com

Found: 2018-03-16 09:17:55.743000
URL: https://www.edictosucesorio.com/wp-includes/newarrivalalibaba.zip
File: www.edictosucesorio.com-wp-includes-newarrivalalibaba.zip
Domain: edictosucesorio.com
Target: ALIBABA.COM
Name                                               Size Date                 MD5                                newarrivalalibaba/images/clear.png                    81 2017-08-23 02:12:16  1b6d2de2867a3e11063ba25aa1cd4209
    File appears in 28 kits  and under 9 different file names
newarrivalalibaba/images/data/89.js                166101 2017-08-23 02:12:16  33a3b039ef1c11349209a3f003f908a2
    File appears in 8 kits  and under 2 different file names
newarrivalalibaba/images/data/clear.png               81 2017-08-23 02:12:16  1b6d2de2867a3e11063ba25aa1cd4209
    File appears in 28 kits  and under 9 different file names
newarrivalalibaba/images/data/havana.css            4760 2017-08-23 02:12:16  f720eb7e550b99282a990906758d8b22
    File appears in 8 kits
newarrivalalibaba/images/data/JSocket.swf           1513 2017-08-23 02:12:16  e9724572d37e5ca98abd364302146b6a
    File appears in 8 kits
newarrivalalibaba/images/data/mini-login-form-min.css 20083 2017-08-23 02:12:16  83fed11ae6615bab01049bc0f08f8c52
    File appears in 8 kits
newarrivalalibaba/images/data/mini-login-min.js    146702 2017-08-23 02:12:16  4076ec66d46bdf4be807047527cfff74
    File appears in 7 kits
newarrivalalibaba/images/data/nc.js                105988 2017-08-23 02:12:16  bf72a11f68986b6b02fc90d5e9bd7e4b
    File appears in 8 kits
newarrivalalibaba/images/data/uab.js                 542 2017-08-23 02:12:16  49246308b1fdac8b564e28b96446b44e
    File appears in 8 kits
newarrivalalibaba/images/data/um.js                32896 2017-08-23 02:12:16  b70676a69b87663f8b9b9f4dce08bdef
    File appears in 8 kits
newarrivalalibaba/images/footer.css                 7310 2017-08-23 02:12:16  374e2b45e8ee13c1dabc598767ef6168
    File appears in 10 kits
newarrivalalibaba/images/login.htm                 37712 2017-08-23 02:12:16  834c68fd8a779b02f8d002089e94935c
    File appears in 5 kits
newarrivalalibaba/images/TB1awf5PXXXXXXLXFXXXXXXXXXX-585-350.jpg 28956 2017-08-23 02:12:16  b4ea5d8bed9945018ea3a324425871a1
    File appears in 8 kits
newarrivalalibaba/images/TB1ROn8OpXXXXbZaXXXXXXXXXXX-32-31.png  1699 2017-08-23 02:12:16  c738d961dd8d36206c8956302a703041
    File appears in 8 kits
newarrivalalibaba/Login.htm                        13318 2017-08-23 02:12:16  514751d79f62f345f915154021d17a4e
newarrivalalibaba/redirect.php                       771 2018-01-21 21:27:56  1afa6d22e6fc5c2a4eeec9454e37c501

2 Email addresses found:
    legitbloodmoni666@gmail.com (appears in 4 kits)
    logzz@cok.edu (appears in 7 kits)



https://texasmalwareblog.blogspot.com   @phish_total