Microsoft phish running on regruhosting[.]ru

Found: 2018-01-05 13:19:37.252000
URL: http://u0000171.cp.regruhosting.ru/office/Officeand365.zip
File: u0000171.cp.regruhosting.ru-office-Officeand365.zip
Domain: regruhosting.ru
Target: Microsoft
Name                                               Size Date                 MD5                                Officeand365/Officeand365/blocker.php               2644 2014-12-03 06:17:00  5aa3f3f406ced12d0bc7742e77b01781
    File appears in 196 kits  and under 4 different file names
Officeand365/Officeand365/images/1.png             822800 2016-11-14 09:58:52  b4d8d1d72ed10dc78b2bb39c3432c0f5
    File appears in 4 kits
Officeand365/Officeand365/images/2.jpg             31321 2017-03-22 19:38:06  56c3b333306527ee6e77b62d8ee0ab9e
    File appears in 3 kits
Officeand365/Officeand365/images/2i.png            41118 2017-03-22 19:50:26  2fa3a1e04c4d2ee202c46ccb253c324b
    File appears in 3 kits
Officeand365/Officeand365/images/favicon.ico       17174 2016-11-14 11:49:16  12e3dac858061d088023b2bd48e2fa96
    File appears in 234 kits  and under 8 different file names
Officeand365/Officeand365/images/index.css          1996 2016-11-14 11:42:30  630d12dcaa8de9c6c2b33a2bdec5269b
    File appears in 4 kits
Officeand365/Officeand365/images/index1.css         2026 2016-11-14 14:26:52  9694d40d200eab073d8b7bb70a9d5b53
    File appears in 4 kits
Officeand365/Officeand365/images/main1_css.css      1995 2016-11-14 14:26:52  b0aac2b3d347e4a350bd3dfa46f63b94
    File appears in 17 kits  and under 3 different file names
Officeand365/Officeand365/images/main_css.css       1995 2016-11-14 11:42:30  b0aac2b3d347e4a350bd3dfa46f63b94
    File appears in 17 kits  and under 3 different file names
Officeand365/Officeand365/images/Thumbs.db         34304 2016-11-14 12:48:28  a31c370c1beb579d72180806b7f7de44
    File appears in 4 kits
Officeand365/Officeand365/index.php                 1321 2016-09-05 19:06:04  54d568572ecb837d95431e8cfd640d41
    File appears in 4 kits
Officeand365/Officeand365/Login2.php                1694 2016-11-14 15:15:00  b126218869fc14d9c7a562077554982d
    File appears in 4 kits
Officeand365/Officeand365/Logon.php                 2800 2017-11-29 00:04:14  0d433a4183b520d5fbb331def3e64470
Officeand365/Officeand365/Logon2.php                2813 2017-11-29 00:04:34  df6c709ffa614ade9ed75c40ac9c6e36
Officeand365/Officeand365/robots.txt                1337 2016-08-07 03:33:46  ba613657ddd17df5e61d5571b9c9d681
    File appears in 81 kits
Officeand365/Officeand365/rqpozv8f9kkaow6kapwenjcw.php  1687 2017-03-22 20:00:10  65d471f5d9b0eef336b5ae38ce2dd864
    File appears in 4 kits  and under 3 different file names

3 Email addresses found:
    someone@example.com (appears in 66 kits)
    jcgmaimi@gmail.com
    tee@ttcpanel.com (appears in 3 kits)



https://texasmalwareblog.blogspot.com   @phish_total