WELLS FARGO phish running on 000webhostapp[.]com

Found: 2018-04-28 15:22:38.494000
URL: http://wells47340.000webhostapp.com/wellsf.zip
File: wells47340.000webhostapp.com-foo-wellsf.zip
Domain: 000webhostapp.com
Target: WELLS FARGO
Name                                               Size Date                 MD5                                wellsf/wellsonlione/.htaccess                       1533 2014-08-27 19:04:54  758e36fa8a0601bf7e3412e6f412a8bd
    File appears in 153 kits  and under 2 different file names
wellsf/wellsonlione/1/a1.php                         159 2017-02-20 17:29:18  d052595a99ab9647a3957790e7cc7ee4
    File appears in 6 kits
wellsf/wellsonlione/1/css/style.css                10562 2017-04-29 09:02:46  f5e73da88692d257c3aec5d79bf01454
    File appears in 5 kits
wellsf/wellsonlione/1/hostname_check.php             521 2014-08-27 19:30:12  020f2c620eefe7e9bbd70664ebadeced
    File appears in 73 kits  and under 2 different file names
wellsf/wellsonlione/1/images/favicon.ico            1078 2017-04-29 07:23:16  24e461019c9c8e9701d55f8408cde993
    File appears in 41 kits  and under 2 different file names
wellsf/wellsonlione/1/images/icon1.jpg              1008 2017-04-29 07:58:00  ea57e7cee42fd1359b58df2e72b8859b
    File appears in 6 kits
wellsf/wellsonlione/1/images/icon1.png              1114 2016-05-27 07:47:48  c4673b02b6568b28c8c4cd5426d6e596
    File appears in 9 kits
wellsf/wellsonlione/1/images/icon2.jpg              1257 2017-04-29 07:57:04  bb2ef3ddb66faae16f9243da31677c50
    File appears in 6 kits
wellsf/wellsonlione/1/images/icon2.png              1150 2016-05-27 07:47:48  68aadbd2c1a73e2f366d58b25807ad4d
    File appears in 9 kits
wellsf/wellsonlione/1/images/icon3.png              1108 2016-05-27 07:47:50  b1f2220d162273cc35f3458ad747f019
    File appears in 11 kits  and under 2 different file names
wellsf/wellsonlione/1/images/img1.png               3072 2017-04-29 09:23:28  abacf27a0408017dd0969bcee925e0e6
    File appears in 6 kits
wellsf/wellsonlione/1/images/img2.png               3123 2016-05-27 07:47:50  64693f6ecaf19bd02c67b1e6744668db
    File appears in 11 kits  and under 2 different file names
wellsf/wellsonlione/1/images/logo.jpg              12523 2017-04-29 07:15:22  87673e142907da15d749c074f102e286
    File appears in 5 kits
wellsf/wellsonlione/1/images/unnamed.png           19061 2017-04-29 07:12:18  7a9718bbcac1e49a96c65fa38c95e48c
    File appears in 8 kits  and under 2 different file names
wellsf/wellsonlione/1/images/us_icon.gif            1477 2017-04-29 07:27:36  2a481c3be513b24aab3c938b03ab3ec2
    File appears in 5 kits
wellsf/wellsonlione/1/images/wf_mobile_logo@2x.jpg 46702 2017-04-29 07:12:02  d410d6d83a64a51b9c495308fc768b5e
    File appears in 6 kits
wellsf/wellsonlione/1/index.html                    3748 2017-04-29 08:05:58  29cd6d848fdb221aa95440bb7557421e
    File appears in 5 kits
wellsf/wellsonlione/1/inner_page.html              12082 2017-04-30 13:04:14  ab0e17bfb98a34183e13cb9a547d88f5
    File appears in 5 kits
wellsf/wellsonlione/1/l2.php                        1477 2017-05-01 15:05:08  00798c2593230a5b6a1bf6452d36ff04
    File appears in 5 kits
wellsf/wellsonlione/index.php                        237 2016-03-29 06:04:12  90153f34c958abf171e30f79355d8932
    File appears in 8 kits

3 Email addresses found:
    n=========||xxxat0sxxx@aol.com (appears in 2 kits)
    at0snba@gmail.com (appears in 6 kits)
    =========||xxxat0sxxx@aol.com (appears in 6 kits)



https://texasmalwareblog.blogspot.com   @phish_total