Wells Fargo phish running on upgradeservice[.]me

Found: 2018-04-17 17:15:14.375000
URL: https://upgradeservice.me/serfice/mywellz.zip
File: upgradeservice.me-serfice-mywellz.zip
Domain: upgradeservice.me
Target: Wells Fargo
Name                                               Size Date                 MD5                                mywellz/mywellz/mywellz/images/bottom.png          351046 2014-09-25 13:08:30  dd2ee30d56e88a1b8aad37eb29248f34
    File appears in 42 kits
mywellz/mywellz/mywellz/images/conti.png            1082 2014-09-25 13:21:34  a94783c1148ebe0766412c76ab73ac2d
    File appears in 42 kits
mywellz/mywellz/mywellz/images/foo.png             11019 2016-02-13 11:01:12  1ca92262a588bb2b82aaed05440678cd
mywellz/mywellz/mywellz/images/footer.png          57352 2014-09-25 13:10:22  a336b0c519e53934f6afcac752376ae7
    File appears in 42 kits
mywellz/mywellz/mywellz/images/go.png                959 2014-09-25 13:11:26  ccffbcca70c6f19affe15ea72fe14581
    File appears in 42 kits
mywellz/mywellz/mywellz/images/goo.png              1023 2014-11-13 14:52:08  3ee5b1524964ea75868f8cd3ad792aa5
    File appears in 42 kits
mywellz/mywellz/mywellz/images/header.png          246717 2014-09-25 13:41:44  d737f787dfa00c477e10541bb10adc23
    File appears in 42 kits
mywellz/mywellz/mywellz/images/second.png          44758 2014-09-25 13:25:54  f1b25f1bfdea2383e5937afcaa643764
    File appears in 42 kits
mywellz/mywellz/mywellz/images/shape496601500.gif   2186 2014-09-25 13:39:26  c878b988eda057aa4bd477d9bc68ab52
    File appears in 42 kits
mywellz/mywellz/mywellz/images/Thumbs.db           53248 2014-09-25 14:25:00  e7c4fe0baf63631c2b407d6174020560
    File appears in 42 kits
mywellz/mywellz/mywellz/images/Untitled.png        57564 2016-05-21 11:17:52  787a0d7ef4366804009028b163cd1c46
mywellz/mywellz/mywellz/index.html                  2281 2016-05-23 03:53:28  8a6898662dfb317a18166fcb326192fa
mywellz/mywellz/mywellz/luc.php                     1002 2018-04-17 07:25:34  f68afb4a08ddfcbee4707b3825d5dbd9
mywellz/mywellz/mywellz/new.php                      705 2018-04-17 18:41:22  0339fcc03e0eb2141a68ab40af8c2d81
mywellz/mywellz/mywellz/verify.html                 1902 2016-05-23 03:55:18  29c348af0482c8f61d7ed76eefb97e2a

4 Email addresses found:
    larrylarryq12@gmail.com
    sammy.larry@yandex.com
    forthiswirepurpose@gmail.com
    forthiswirepurpose2016@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total