WEBMAIL phish running on kvme[.]cl

Found: 2018-09-27 03:15:35.525000
URL: https://kvme.cl/gozypage.zip
File: kvme.cl-foo-gozypage.zip
Domain: kvme.cl
Target: WEBMAIL
Name                                               Size Date                 MD5                                gozypage/chines/chines/auth.php                     1134 2018-09-05 20:17:48  0c26994f7d25be6f957524de3b6c084c

gozypage/chines/chines/geoplugin.class.php          4493 2012-12-30 22:25:56  1e63694db090c37403b39236526ce9dd
    File appears in 125 kits
gozypage/chines/chines/hellion/logos.png           41796 2015-11-19 10:18:46  da29b5868f74377ff10b5893685cf643
    File appears in 83 kits
gozypage/chines/chines/hellion/postmaster.png       5496 2015-11-19 10:18:46  c1ead276fc29903252146f2d6e90beae
    File appears in 83 kits
gozypage/chines/chines/index.php                    4154 2017-03-23 08:38:18  6f24c681778e71ed31d737b61d79bf64
    File appears in 11 kits
gozypage/chines/index.php                            812 2017-03-23 08:42:40  7a5ba70d6db706dad903818d663bd3f9
    File appears in 11 kits

2 Email addresses found:
    lamadurg76@gmail.com
    gp_support@geoplugin.com (appears in 1312 kits)



https://texasmalwareblog.blogspot.com   @phish_total