ALIBABA phish running on sunilwoollenmills[.]com

Found: 2018-05-11 18:15:11.432000
URL: http://sunilwoollenmills.com/wp-admin/css/alibaba.zip
File: sunilwoollenmills.com-css-alibaba.zip
Domain: sunilwoollenmills.com
Target: ALIBABA
Name                                               Size Date                 MD5                                alibaba/alibaba/images/img1.jpg                    55712 2015-05-21 23:27:44  46713f96240c9f875faeb8a1dc331ac7
    File appears in 108 kits  and under 2 different file names
alibaba/alibaba/images/img2.png                    335152 2015-05-21 23:27:56  bb34415167f5776f8918e004bd05ab0d
    File appears in 173 kits  and under 2 different file names
alibaba/alibaba/images/img3.gif                     1380 2015-05-21 23:28:04  de1d32379d27e9caa603ee7fdbfcc4e2
    File appears in 185 kits  and under 2 different file names
alibaba/alibaba/images/img4.gif                    59977 2015-05-21 23:28:12  62db9d89ce236e6410884ecb6e803f0c
    File appears in 162 kits
alibaba/alibaba/images/Thumbs.db                   10752 2015-05-21 23:29:24  ab70cfa9398e49b27437bd05540f4ed5
    File appears in 157 kits
alibaba/alibaba/index.php                           6688 2015-05-21 04:10:02  0beb292dcb247c3e1de3764702ab9a59
    File appears in 90 kits
alibaba/alibaba/loader1.htm                         8312 2015-05-21 04:08:54  d712cfa1587f05c1f9c7d9a5fb28cee8
    File appears in 102 kits
alibaba/alibaba/post1.php                            740 2017-03-13 03:54:36  cf10e85c34ec8b19f4ef537619152f29
    File appears in 54 kits

2 Email addresses found:
    salesdepartmental147@hotmail.com (appears in 50 kits)
    salesdepartmental147@gmail.com (appears in 51 kits)



https://texasmalwareblog.blogspot.com   @phish_total