MICROSOFT phish running on aretuzasballerinaproject[.]com

Found: 2018-05-07 11:26:56.160000
URL: http://aretuzasballerinaproject.com/wp-admin/outlook.zip
File: aretuzasballerinaproject.com-wp-admin-outlook.zip
Domain: aretuzasballerinaproject.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                outlook/blocker.php                                 2672 2016-06-11 02:45:36  2447910e0f2a74a6bb975b7b61fdb441
    File appears in 90 kits  and under 3 different file names
outlook/index.php                                    621 2017-08-10 13:34:36  8846dfc65c8cd1e2b893141165b5273e
    File appears in 3 kits
outlook/outlook/authentication.php                  6936 2017-07-31 06:52:18  ecda63a2a3796f4e08e478b20d35e5fd
    File appears in 3 kits
outlook/outlook/images/continue.png                  401 2017-07-31 06:48:50  68ee0bf2d67020afcf0f6c5561fa0361
    File appears in 3 kits
outlook/outlook/images/favicon.ico                 17174 2015-04-21 23:59:36  12e3dac858061d088023b2bd48e2fa96
    File appears in 360 kits  and under 9 different file names
outlook/outlook/images/logn.png                      385 2017-07-31 06:48:50  cf237d2b25334a381a6a62cc92cba5d6
    File appears in 3 kits
outlook/outlook/images/m1.png                      33334 2017-07-31 06:48:50  731986b18bddcf949a40bdd86a46aa80
    File appears in 3 kits
outlook/outlook/images/m10.png                       372 2017-07-31 06:48:50  0f912b7ac74f3d78d9f540df14ffcf85
    File appears in 3 kits
outlook/outlook/images/m2.png                      61439 2017-07-31 06:48:50  9bd0b2cb90935a91f839a15352ff04d2
    File appears in 3 kits
outlook/outlook/images/m3.png                      118907 2017-07-31 06:48:50  d9c566425ef2385eb0785c5ff856a079
    File appears in 3 kits
outlook/outlook/images/m4.png                      189081 2017-07-31 06:48:50  ff694312bcc58fc9c20dc9cfbb6c488b
    File appears in 3 kits
outlook/outlook/images/m5.png                       1921 2017-07-31 06:48:50  cbfa20df831553c3036a53241bd32be3
    File appears in 3 kits
outlook/outlook/images/m6.png                        465 2017-07-31 06:48:50  b416baec444fe07fe788afe20088cee9
    File appears in 3 kits
outlook/outlook/images/m7.png                        358 2017-07-31 06:48:50  fad5a0916fdf910ed6d3353bd6a26808
    File appears in 3 kits
outlook/outlook/images/m8.png                      11012 2017-07-31 06:13:26  5bb2aeff928e724a540a3bc9c52f5dfe
    File appears in 3 kits
outlook/outlook/images/m9.png                        535 2017-07-31 06:48:50  16e5461fe2764f6d5abd3df41c224818
    File appears in 3 kits
outlook/outlook/index.php                            144 2016-03-11 02:42:24  0526c242a1f7b6117202fe21d47e31b1
    File appears in 178 kits  and under 4 different file names
outlook/outlook/login.php                           3594 2017-08-10 14:09:08  9c73e67d098e9cba7e62de4205ab5c04
    File appears in 3 kits
outlook/outlook/post.php                            1367 2018-04-11 05:10:50  40142bdc157f48a2b1843e6e8d9327c3
outlook/robots.txt                                  1337 2016-08-07 07:33:48  ba613657ddd17df5e61d5571b9c9d681
    File appears in 119 kits

2 Email addresses found:
    rich.mcmiller14@gmail.com (appears in 5 kits)
    supertool@mxtoolbox.com (appears in 65 kits)



https://texasmalwareblog.blogspot.com   @phish_total