MICROSOFT phish running on botomaluco[.]com[.]br

Found: 2018-06-20 13:16:45.125000
URL: http://www.botomaluco.com.br/sharepoint.zip
File: www.botomaluco.com.br-foo-sharepoint.zip
Domain: botomaluco.com.br
Target: MICROSOFT
Name                                               Size Date                 MD5                                sharepoint/blocker.php                              2644 2018-05-07 07:05:50  5aa3f3f406ced12d0bc7742e77b01781
    File appears in 281 kits  and under 5 different file names
sharepoint/blocker2.php                             2644 2018-05-07 07:05:50  5aa3f3f406ced12d0bc7742e77b01781
    File appears in 281 kits  and under 5 different file names
sharepoint/file.html                                4404 2018-05-07 07:49:02  addbabfd20380d53095beddfb9c513c0
    File appears in 2 kits
sharepoint/file2.html                               4407 2018-05-07 20:18:22  7ef42a4db4acfe632e8921c637a84af0
    File appears in 2 kits
sharepoint/final.php                                 767 2018-06-17 10:50:12  6c0b61bea2a6632b1e896e4376df7be7

sharepoint/final2.php                                869 2018-06-17 10:50:50  83ab53240ce752c8bce61a40e66558e5

sharepoint/images/1.png                            26392 2018-05-08 07:16:42  0839798080e3dd5fcf044e1c67f5c7ee
    File appears in 2 kits
sharepoint/images/2.png                            28107 2018-05-08 07:17:08  74bf0bd65b55ab456db62e432434912c
    File appears in 2 kits
sharepoint/images/button.png                         636 2018-05-07 07:05:50  5b023acca5ce08dac6b659aa85805f1c
    File appears in 2 kits  and under 2 different file names
sharepoint/images/button2.png                        636 2018-05-07 07:05:50  5b023acca5ce08dac6b659aa85805f1c
    File appears in 2 kits  and under 2 different file names
sharepoint/images/favicon.ico                      17174 2018-05-07 07:05:50  12e3dac858061d088023b2bd48e2fa96
    File appears in 379 kits  and under 10 different file names
sharepoint/images/favicon2.ico                     17174 2018-05-07 07:05:50  12e3dac858061d088023b2bd48e2fa96
    File appears in 379 kits  and under 10 different file names
sharepoint/index.php                                 395 2018-05-07 07:05:50  47710b29f0b416bb94f6cd3274563abd
    File appears in 2 kits
sharepoint/index2.php                                398 2018-05-07 20:10:44  db8d22d61151e01a44a318f9e8c77b1f
    File appears in 2 kits

1 Email addresses found:
    words30405060@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total