MICROSOFT phish running on 000webhostapp[.]com

Found: 2018-04-14 19:15:08.102000
URL: http://joeypohbca.000webhostapp.com/xls.zip
File: joeypohbca.000webhostapp.com-foo-xls.zip
Domain: 000webhostapp.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                xls/block_detectors.php                             3385 2017-09-14 11:52:10  6978d9ddabf165a1fdbeeb78621c6b96
xls/cwfoeoafor505k757jdk4xds.php                   88763 2018-03-05 17:01:08  16697338dcfb4131f85550734eb21aa9
xls/files/.robots.txt                               1863 2018-03-05 15:49:56  5883d22970da99d151293bdd63748b66
xls/files/block_detectors.php                       3385 2017-09-14 11:52:10  6978d9ddabf165a1fdbeeb78621c6b96
xls/files/hack-run.png                             24875 2017-09-14 10:12:50  b699624a0522d0737d830ecbdd9d45fe
xls/files/hello.php                                 1899 2018-02-26 22:19:32  ade5962d8047e8e11eb1c7e6077d0167
xls/files/login.php                                39998 2017-09-14 13:25:50  222b1f28b7b5be5a87d8147a203587f1
xls/files/login_data/ga.js                         43082 2017-09-14 10:12:50  7d5a4c301dcb0ddde72ee50c8230f73d
    File appears in 14 kits
xls/files/login_data/ga_002.js                     43082 2017-09-14 10:12:50  7d5a4c301dcb0ddde72ee50c8230f73d
    File appears in 14 kits
xls/files/login_data/ga_003.js                     43082 2017-09-14 10:12:50  7d5a4c301dcb0ddde72ee50c8230f73d
    File appears in 14 kits
xls/files/login_data/jquery.js                     96381 2017-09-14 10:12:50  8fc25e27d42774aeae6edbc0a18b72aa
    File appears in 61 kits  and under 5 different file names
xls/files/login_data/jquery_popup.css               2231 2017-09-14 10:12:50  bba8a0b29e927e1d2de363f7368dbac6
xls/files/login_data/jquery_popup.js                1807 2017-09-14 10:12:50  ab682fa8b1e5257c5eb0cba1bdeb2b16
xls/index.php                                       1325 2017-10-03 16:10:34  11c750d135f11c9a0f8f57a5f2ca9d8d
xls/pobg.gif                                       87582 2017-10-25 17:27:30  21c58f6f773ac904cabefe2c962034cb

1 Email addresses found:
    m.windowcityinc@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total