DROPBOX phish running on aretuzasballerinaproject[.]com

Found: 2018-05-07 14:23:21.249000
URL: http://www.aretuzasballerinaproject.com/wp-admin/css/dropnow.zip
File: www.aretuzasballerinaproject.com-css-dropnow.zip
Domain: aretuzasballerinaproject.com
Target: DROPBOX
Name                                               Size Date                 MD5                                dropnow/dropnow/action.php                          1352 2017-11-06 04:38:00  b74df904559b8ffe77e2a127beee2a00
    File appears in 9 kits
dropnow/dropnow/action2.php                         1237 2017-11-06 04:38:36  dad2a8d453bfcc2ed464208d49ddef9d
    File appears in 9 kits
dropnow/dropnow/antiboots.php                       2620 2017-09-14 04:40:16  6b3386c86f6f32a4ece607a5cb8e3d16
    File appears in 75 kits  and under 2 different file names
dropnow/dropnow/autoblock.php                        821 2017-09-14 04:40:16  5e0a3e7c6e81d4310442ce8b64d82881
    File appears in 42 kits
dropnow/dropnow/css/style1.css                      2471 2017-09-14 04:40:16  abb631fc9c76a3c0b1daea176e391ae8
    File appears in 42 kits
dropnow/dropnow/img/confirm_text.PNG                4985 2017-09-14 04:40:16  69f9de2f2c69a07cdcd37694a0051f7a
    File appears in 40 kits
dropnow/dropnow/img/footer.jpg                     15983 2017-09-14 04:40:16  af51da560c778aff89540f4f36e94465
    File appears in 40 kits
dropnow/dropnow/img/help.png                        1218 2017-09-14 04:40:16  224a26dd8447d7f2e4c761559b4749e7
    File appears in 40 kits
dropnow/dropnow/img/left.png                       96390 2017-09-14 04:40:16  30c3a04ccbad81cc99c4af725d578f1d
    File appears in 40 kits
dropnow/dropnow/img/logo.png                        1427 2017-09-14 04:40:16  38928e53077a706aa26ba249717dd63d
    File appears in 52 kits  and under 2 different file names
dropnow/dropnow/img/multi.png                      29225 2017-09-14 04:40:16  748e60e2c4c203e0490ff42829c4b736
    File appears in 19 kits
dropnow/dropnow/img/next.png                        2081 2017-09-14 04:40:16  55ac166497e536b95afef791d422d4b9
    File appears in 40 kits
dropnow/dropnow/img/texto_23.PNG                    3613 2017-09-14 04:40:16  363b0b31b2673d36aa53afd2c2e3cbc8
    File appears in 40 kits
dropnow/dropnow/index.php                           2479 2017-09-14 04:40:16  33550962adcaff72dc5afad87d313cb8
    File appears in 24 kits
dropnow/dropnow/phone_number.php                    1962 2017-09-14 04:40:16  d491703235d432cd554abc53dcc1486a
    File appears in 14 kits
dropnow/dropnow/processing.php                      1600 2017-09-14 04:40:16  ba932def08ab6288c1090a4e0338b37c
    File appears in 40 kits
dropnow/dropnow/thanks.php                           808 2017-09-14 04:40:16  96ea7f7c5052ad4c47b264536c1e43dc
    File appears in 14 kits
dropnow/dropnow/to.php                                50 2018-02-02 14:55:06  0e880e320c931b90bfc5297d12e4614b
    File appears in 6 kits

2 Email addresses found:
    vip@163.goooo (appears in 14 kits)
    rich.mcmiller14@gmail.com (appears in 7 kits)



https://texasmalwareblog.blogspot.com   @phish_total