MICROSOFT phish ** running on ralliwolfmotors[.]com

Found: 2018-04-04 07:16:34.934000
URL: http://ralliwolfmotors.com/0001222/microsoftexcelverification.zip
File: ralliwolfmotors.com-0001222-microsoftexcelverification.zip
Domain: ralliwolfmotors.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                microsoftexcelverification/microsoftexcelverification/images/favicon.ico  3432 2017-05-30 06:28:40  75099623c84266df9d4613b6caa88969

microsoftexcelverification/microsoftexcelverification/images/m1.png  6602 2017-05-30 06:13:32  11e1afcb5b8b06b7672e12b8358cd7cc

microsoftexcelverification/microsoftexcelverification/images/m2.png 16157 2017-05-30 06:14:02  19c90e7e30656e11cc0e51cd13530727

microsoftexcelverification/microsoftexcelverification/images/m3.png   914 2017-05-30 06:14:46  a2a52b27eba21f8d98a7eb9ae67962e3

microsoftexcelverification/microsoftexcelverification/images/m4.png 380622 2017-05-30 06:16:00  ff38a5ca3aae4478ef67036add59d372

microsoftexcelverification/microsoftexcelverification/images/m5.png  1188 2017-05-30 06:23:22  d0ba8000f01444afa23c1b63d303040a

microsoftexcelverification/microsoftexcelverification/images/m6.png  1756 2017-05-30 06:23:34  3879d6766021d78a425efa2fddffc89f

microsoftexcelverification/microsoftexcelverification/index.php   144 2016-03-11 03:42:24  0526c242a1f7b6117202fe21d47e31b1
    File appears in 167 kits  and under 4 different file names
microsoftexcelverification/microsoftexcelverification/login.php  3435 2017-05-30 08:29:54  8ad062a99fa9a19180e168b80824102b

microsoftexcelverification/microsoftexcelverification/phone.php  1791 2018-04-04 15:32:14  360b81294dd64b2b3953b439ef9cfaab
microsoftexcelverification/microsoftexcelverification/post.php  1403 2018-04-04 15:32:36  9c504cf3fc04d3ea4eb3c68d30dca011
microsoftexcelverification/microsoftexcelverification/verification.php  2772 2016-11-04 02:55:50  e8e2648d7aa9056ee30426e7a6ace2dd


3 Email addresses found:
    marvis.goldenson@gmail.com
    wirez@googledocs.org (appears in 173 kits)
    supertool@mxtoolbox.com (appears in 60 kits)



https://texasmalwareblog.blogspot.com   @phish_total