WELLS FARGO phish running on aurovideo[.]com

Found: 2018-01-28 15:15:06.383000
URL: http://aurovideo.com/wells.zip
File: aurovideo.com-foo-wells.zip
Domain: aurovideo.com
Target: WELLS FARGO
Name                                               Size Date                 MD5                                wells/desktop.ini                                     46 2017-08-31 22:36:50  15478b340a8362bb79fd2a6ea0dde1a0
    File appears in 2 kits
wells/wells/wellfullshort/confirm.php               5751 2016-10-17 06:32:26  89498e24e066f13f321dfc67f8c992f1
    File appears in 2 kits
wells/wells/wellfullshort/images/1.png              2265 2016-10-17 06:32:26  65a897a97719cef928d6b3213419ce6b
    File appears in 4 kits
wells/wells/wellfullshort/images/111.png           175598 2016-10-17 06:32:26  46e876604c0bda9135e0a472be9dcf34
    File appears in 17 kits  and under 2 different file names
wells/wells/wellfullshort/images/2.png              1820 2016-10-17 06:32:26  173c06c2b9b4407e2d5c717c9d470758
    File appears in 4 kits
wells/wells/wellfullshort/images/22.png            248807 2016-10-17 06:32:26  cb42cd82ec3666ec36471932ff6eeaf4
    File appears in 17 kits
wells/wells/wellfullshort/images/3.png              5936 2016-10-17 06:32:26  99927a5a9e25c1f34e684fbaf6aff5fc
    File appears in 4 kits
wells/wells/wellfullshort/images/4.png              2885 2016-10-17 06:32:26  cd916df84e82500c7905c985777391dc
    File appears in 4 kits
wells/wells/wellfullshort/images/5.png              6384 2016-10-17 06:32:26  bf06cdda01a63a6846b952ff2df53790
    File appears in 4 kits
wells/wells/wellfullshort/images/6.png               439 2016-10-17 06:32:26  2841515b5d419cb8e32a7bc19d2ec587
    File appears in 4 kits
wells/wells/wellfullshort/images/7.png               966 2016-10-17 06:32:26  92569b5ce8996fed98144f7a8caef850
    File appears in 4 kits
wells/wells/wellfullshort/images/8.png              3905 2016-10-17 06:32:26  a47ab75d56684a8a4bed9e791fa20edd
    File appears in 4 kits
wells/wells/wellfullshort/images/9.png               339 2016-10-17 06:32:26  b287daab84f027855d60dc81edd0861f
    File appears in 4 kits
wells/wells/wellfullshort/images/as.png              930 2016-10-17 06:32:26  141cbdd4bfeedf7cd6202a3548749a05
    File appears in 4 kits
wells/wells/wellfullshort/images/edit.png           5018 2016-10-17 06:32:26  cd36b298ba96cfa1c3b9ec8dc19dac8b
    File appears in 2 kits
wells/wells/wellfullshort/images/favicon.ico        1406 2016-10-17 06:32:26  810bb3a6832ef853ea51c25badad05b7
    File appears in 7 kits
wells/wells/wellfullshort/images/ff.png            16025 2016-10-17 06:32:26  88853e603f11051ce984ff09e722d298
    File appears in 4 kits
wells/wells/wellfullshort/images/footter.png       71567 2016-10-17 06:32:26  42f735acf0bed541ee58251084dff0dc
    File appears in 4 kits
wells/wells/wellfullshort/images/go.png              872 2016-10-17 06:32:26  0e2d32d00346adf42d920a3a042a9455
    File appears in 17 kits
wells/wells/wellfullshort/images/header.png        11405 2016-10-17 06:32:26  7127e4db6b3ac0ea7fe36c616d5f9212
    File appears in 17 kits  and under 2 different file names
wells/wells/wellfullshort/images/help.png           1547 2016-10-17 06:32:26  3877004b01f6994d614acc3e4ca3695d
    File appears in 4 kits
wells/wells/wellfullshort/images/logg.png          278947 2016-10-17 06:32:26  2296b8ca14f6a86dbeb73dfcbdd0846f
    File appears in 17 kits
wells/wells/wellfullshort/images/searc.png           895 2016-10-17 06:32:26  fdc2ca4c9d6c1d2e08bfb1450613c326
    File appears in 4 kits
wells/wells/wellfullshort/images/shape1041325109.gif  3235 2016-10-17 06:32:26  865c2bbc6abbdb553ebb0db99a7e1887
    File appears in 2 kits
wells/wells/wellfullshort/images/shape1042986859.gif  4046 2016-10-17 06:32:26  2f541dc9fc97057de13c847517d5e48e
    File appears in 4 kits
wells/wells/wellfullshort/images/signup.png         2229 2016-10-17 06:32:26  275152dff7659562025862f52d988556
    File appears in 17 kits
wells/wells/wellfullshort/index.php                  144 2016-10-17 06:32:26  0526c242a1f7b6117202fe21d47e31b1
    File appears in 122 kits  and under 4 different file names
wells/wells/wellfullshort/login.php                 3073 2016-10-17 06:32:26  da7215782a32b99c189ffd66f76bf9b7
    File appears in 4 kits
wells/wells/wellfullshort/result1.php               1997 2018-01-28 15:01:42  0bcd2cef31488db21405d1efcaed49b5
wells/wells/wellfullshort/result2.php               1940 2018-01-28 15:01:22  7a01a2d972a1d24660696dfbae42d27c

2 Email addresses found:
    ml333832@gmail.com
    wirez@googledocs.org (appears in 125 kits)



https://texasmalwareblog.blogspot.com   @phish_total