WELLS FARGO phish running on nepaligeetlahar[.]com

Found: 2018-05-06 18:15:18.386000
URL: https://nepaligeetlahar.com/wellsf.zip
File: nepaligeetlahar.com-foo-wellsf.zip
Domain: nepaligeetlahar.com
Target: WELLS FARGO
Name                                               Size Date                 MD5                                wellsf/wellsf/wellsonlione/.htaccess                1533 2014-08-27 19:04:54  758e36fa8a0601bf7e3412e6f412a8bd
    File appears in 158 kits  and under 2 different file names
wellsf/wellsf/wellsonlione/1/a1.php                  159 2017-02-20 17:29:18  d052595a99ab9647a3957790e7cc7ee4
    File appears in 8 kits
wellsf/wellsf/wellsonlione/1/css/style.css         10562 2017-04-29 10:02:46  f5e73da88692d257c3aec5d79bf01454
    File appears in 7 kits
wellsf/wellsf/wellsonlione/1/hostname_check.php      521 2014-08-27 19:30:12  020f2c620eefe7e9bbd70664ebadeced
    File appears in 77 kits  and under 2 different file names
wellsf/wellsf/wellsonlione/1/images/favicon.ico     1078 2017-04-29 08:23:16  24e461019c9c8e9701d55f8408cde993
    File appears in 47 kits  and under 3 different file names
wellsf/wellsf/wellsonlione/1/images/icon1.jpg       1008 2017-04-29 08:58:00  ea57e7cee42fd1359b58df2e72b8859b
    File appears in 8 kits
wellsf/wellsf/wellsonlione/1/images/icon1.png       1114 2016-05-27 08:47:48  c4673b02b6568b28c8c4cd5426d6e596
    File appears in 11 kits
wellsf/wellsf/wellsonlione/1/images/icon2.jpg       1257 2017-04-29 08:57:04  bb2ef3ddb66faae16f9243da31677c50
    File appears in 8 kits
wellsf/wellsf/wellsonlione/1/images/icon2.png       1150 2016-05-27 08:47:48  68aadbd2c1a73e2f366d58b25807ad4d
    File appears in 11 kits
wellsf/wellsf/wellsonlione/1/images/icon3.png       1108 2016-05-27 08:47:50  b1f2220d162273cc35f3458ad747f019
    File appears in 13 kits  and under 2 different file names
wellsf/wellsf/wellsonlione/1/images/img1.png        3072 2017-04-29 10:23:28  abacf27a0408017dd0969bcee925e0e6
    File appears in 8 kits
wellsf/wellsf/wellsonlione/1/images/img2.png        3123 2016-05-27 08:47:50  64693f6ecaf19bd02c67b1e6744668db
    File appears in 13 kits  and under 2 different file names
wellsf/wellsf/wellsonlione/1/images/logo.jpg       12523 2017-04-29 08:15:22  87673e142907da15d749c074f102e286
    File appears in 7 kits
wellsf/wellsf/wellsonlione/1/images/unnamed.png    19061 2017-04-29 08:12:18  7a9718bbcac1e49a96c65fa38c95e48c
    File appears in 11 kits  and under 2 different file names
wellsf/wellsf/wellsonlione/1/images/us_icon.gif     1477 2017-04-29 08:27:36  2a481c3be513b24aab3c938b03ab3ec2
    File appears in 7 kits
wellsf/wellsf/wellsonlione/1/images/wf_mobile_logo@2x.jpg 46702 2017-04-29 08:12:02  d410d6d83a64a51b9c495308fc768b5e
    File appears in 8 kits
wellsf/wellsf/wellsonlione/1/index.html             3924 2018-05-01 15:14:44  dc4d84993201dedc82884edc4db8c8a9
wellsf/wellsf/wellsonlione/1/inner_page.html       12261 2018-05-01 15:15:42  66e71b0019d5731b8fa8f835f34dc282
wellsf/wellsf/wellsonlione/1/l2.php                 1477 2018-05-07 00:36:28  96f0dff3c243cfcf2c73964318fe674f
wellsf/wellsf/wellsonlione/index.php                 237 2016-03-29 06:04:12  90153f34c958abf171e30f79355d8932
    File appears in 10 kits

2 Email addresses found:
    momboy2018@gmail.com
    pr0fe@yandex.com



https://texasmalwareblog.blogspot.com   @phish_total