Microsoft phish ** running on gavakou[.]gr

Found: 2018-01-08 21:17:36
URL: http://gavakou.gr/wp-content/ewww/officeq.zip
File: officeq-gavakou.gr.zip
Domain: gavakou.gr
Target: Microsoft
Name                                               Size Date                 MD5                                officeq/blocker.php                                 2644 2016-01-24 15:14:20  5aa3f3f406ced12d0bc7742e77b01781
    File appears in 193 kits  and under 4 different file names
officeq/docusign/incorrect.php                     50365 2017-10-25 10:28:28  9d68963f09e24fe527749f488c8f76fd
officeq/docusign/index.php                         49650 2017-10-25 10:27:28  bd50d4a7bebaadd8dd2776c72b9d7f94
officeq/docusign/login.php                           825 2017-10-23 17:27:56  cb2113fcb94749b6de86dc155a411f3b
officeq/docusign/login1.php                          832 2017-10-23 17:34:08  f52597e0eaccdd99169c0e2c4c55c4ab
officeq/index.php                                    793 2017-08-02 16:33:22  75b676c5aceb74bcd85cd58485dc143d

4 Email addresses found:
    someone@example.com (appears in 64 kits)
    someone@example.onmicrosoft.com (appears in 13 kits)
    admastw@gmail.com
    alibaba@info.lt



https://texasmalwareblog.blogspot.com   @phish_total