MICROSOFT phish running on foryou560[.]com

Found: 2018-04-24 17:15:53.721000
URL: http://foryou560.com/12.zip
File: foryou560.com-foo-12.zip
Domain: foryou560.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                12/12/authenticate.php                              4085 2018-04-23 12:19:38  1a4f0ccaebfc25feb9d2576205c82978
12/12/error.php                                    18429 2018-02-11 03:53:32  2a20f45f102fb176654abe3ce8a2b360

12/12/geoplugin.class.php                           4647 2017-09-21 16:13:48  c8ea1e960b48a620c00bc65d525a721c
    File appears in 1279 kits  and under 3 different file names
12/12/index.php                                    13326 2018-02-11 03:53:18  0ef5603333d7294e103d175c5e7bb08e

12/12/login.php                                     1300 2018-04-23 12:19:12  cbde85e0e2985d0ff2b9c1069fedb532
12/12/pass.php                                     18316 2018-02-11 03:53:04  8db8ef246a13dc3e6d30aac188c1fa3a

12/12/Sign in to your Microsoft account_files/AppCentipede_Microsoft.svg  7174 2017-09-21 16:15:52  aed5eb9ccea43f119a25b3b74c59c7e7
    File appears in 84 kits
12/12/Sign in to your Microsoft account_files/Default1033.css 73727 2017-09-21 16:15:44  902952e2e05ab3451fb7438bb77059fb
    File appears in 60 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/DefaultLoginStrings1033.js.txt  9898 2017-09-21 16:15:28  b507b90640721b4e47154d97609105bc
    File appears in 56 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/DefaultLogin_Core.js.txt 126766 2017-09-21 16:15:34  a85dcfb7c3eda9c13ad3690c2dd27822
    File appears in 55 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/logo.jpg  3602 2017-09-21 16:15:20  885531c6229490a82386b12b01cc5553
    File appears in 41 kits
12/12/Sign in to your Microsoft account_files/Microsoft_Logotype_Gray.svg  5435 2017-09-21 16:15:12  5feaa482d83c2a69d012f9bff660d373
    File appears in 84 kits
12/12/Sign in to your Microsoft account_files/prefetch.htm  3326 2017-09-21 16:15:06  68b1e3007431d49789c66d75b9f606c6
    File appears in 41 kits
12/12/Sign in to your Microsoft account_files/prefetch_data/boot.css 159658 2017-09-21 16:17:24  30da6f6f4e2d60d8aacbe2ed1583ae7f
    File appears in 41 kits
12/12/Sign in to your Microsoft account_files/prefetch_data/boot.js.txt 650764 2017-09-21 16:17:16  3fcf01abd2872c7fe233a3abaa50e122
    File appears in 41 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/boot_002.js.txt 646615 2017-09-21 16:17:08  9c766769f81c9884d74819f3dfe915be
    File appears in 41 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/boot_003.js.htm 650184 2017-09-21 16:16:58  4cfbdab231025e8b0ee7d08368516d5c
    File appears in 41 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/boot_004.js.txt 648527 2017-09-21 16:16:50  1b403af938697ddd9ed483405ff47cd4
    File appears in 41 kits  and under 2 different file names
12/12/Sign in to your Microsoft account_files/prefetch_data/sprite1.css  7304 2017-09-21 16:16:44  7c23768ca9a97f74fc7b0486747deeaf
    File appears in 41 kits
12/12/Sign in to your Microsoft account_files/prefetch_data/sprite1.png 14983 2017-09-21 16:16:38  d502a13c4f154e9fe86802b1f0338466
    File appears in 41 kits

2 Email addresses found:
    gp_support@geoplugin.com (appears in 1219 kits)
    christiangonzalo393@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total