phish at hasotyw.tk leads to stuff

phish at :
hasotyw.tk/mnt_1

hosted at :
94.177.249.118

these domains had history there :
http://zatowog.ml/js/Stightly.htm
http://zatowog.ml/image/fgaofficepge/oFFiCe.php
http://zatowog.ml/image/fgaofficepge/office365.htm
http://zatowog.ml/image/fgaofficepge.zip
http://zatowog.ml/login.mail.office.live.com.324567877666890798/fgaofficepge/oFFiCe.php
http://zatowog.ml/login.mail.office.live.com.324567877666890798/fgaofficepge/office365.htm
http://zatowog.ml/login.mail.office.live.com.324567877666890798/fgaofficepge.zip
http://veqydit.tk/+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM/microsoft.php
http://veqydit.tk/+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM/office.php
http://veqydit.tk/+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM/
http://cilegux.ga/sayed/sayed_output30B2400.exe
http://cilegux.ga/ff/build_outputAF457FF.exe
http://duqoduf.cf/jamisiboboyi/login/office/
http://veqydit.tk/+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM+_)(*&%5e%25$%23@!~NNM/
http://nehafeb.ml/home.zip

loki :
http://cilegux.ga/sayed/sayed_output30B2400.exe
c2 :
http://ontime52.com/e7/five/fre.php
see also :
http://ontime52.com/e7/five/PvqDq929BSx_A_D_M1n_a.php
http://ontime52.com/won/PvqDq929BSx_A_D_M1n_a.php

loki :
http://cilegux.ga/ff/build_outputAF457FF.exe
c2 :
http://timenolonger20.com/e7/five/fre.php
see also :
http://timenolonger20.com/e7/five/PvqDq929BSx_A_D_M1n_a.php


ontime52.com and timenolonger20.com at :
46.21.147.252

these domains had history there :
http://accessc-itgroupb.com/cgb/
http://accesslloy-dlb.com/online-en/
http://accessonesavingb.com/en/os/
http://accessunionib.com/online/
http://airtradel.com/Order_Quotation.LZH
http://annieberners.com/annieber/Bank_Information_pdf.exe
http://arrelormittal.com/benalpha/cpanel/
http://arrelormittal.com/benalpha/cpanel.zip
http://arrelormittal.com/WebPanel/login.php
http://atikaluminyum-tr.com/love/login.php
http://atikaluminyum-tr.com/oldlov/webpanel.zip
http://brixtrading.org/a1/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://brixtrading.org/dprove/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://brixtrading.org/dream/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://brixtrading.org/e7/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://erobinhood.com/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://facebook-892.security-7463.com/account-765457652.html
http://log-in.register-online-hmrc.tax.refund.hm-revenue.paye.customs.payment.services.gov.secure.ssl.cnd.php.techniquefleet.com.au/Tax-Refund.php
http://gaccess-sb.com/b/
http://kojucome.us/file/file.exe
http://newdawn18.com/doors/five/PvqDq929BSx_A_D_M1n_a.php
http://udopom.com/web/login.php
http://updatetmt.us/alaska/
http://updatetmt.us/chase/
http://updatetmt.us/chase1/
http://updatetmt.us/hawaiiantel/
http://updatetmt.us/leowells/
http://updatetmt.us/login/
http://updatetmt.us/logout/
http://updatetmt.us/phemy/phemy/Login.html
http://updatetmt.us/phemy/phemy.zip
http://updatetmt.us/uwec/


kojucome.us
registered by :
james_philip28@hotmail.co.uk
also with malicious xls :
http://jamesphilip28.org/myproperty/MY%20PROPERTIES%20LISTING.xls


updatetmt.us
registered by :
aaakinkumi115@gmail.com
11 crappy domains, only the 1 alive.


http://jamesphilip28.org/myproperty/MY%20PROPERTIES%20LISTING.xls
downloads orcus rat:
http://www.infiltratools.com/botnet/putt2.exe
c2 :
wh1t3h0rs3.duckdns.org:7007



downloads

https://www.virustotal.com/#/file/fa056283327cab90cfb48bf4feaf51fde9eef6f0478969c858450531c2841fb9



infiltratools.com/botnet/putt2.exe


#orcus #orcusrat

dl from :
http://infiltratools.com/botnet/putt2.exe
by :
http://jamesphilip28.org/myproperty/MY%20PROPERTIES%20LISTING.xls
https://www.virustotal.com/#/file/ad46da6fd4a86e072a708dfafd26859b7505031d6b13e9f014fa21e24d731eb1/community

c2 :
wh1t3h0rs3.duckdns.org:7007

jamesphilip28.org reg'ed by james_philip28@hotmail.co.uk
other domain same dude : kojucome.us with bad IP GBA history


infiltratools.com is at :
46.21.147.250

with :
http://access-firstmb.com/personal/
http://access-firstrb.com/firstrebuplic.zip
http://access-firstrb.com/online/
http://accessa-lliantb.com/Online/
http://accessgsb-online.com/goldmansachsbank/
http://accessi-ngb.com/ing/
http://accessi-ngb.com/ings.zip
http://accesslloy-db.com/online/
http://euroaccessb.com/gr/
http://faninemae.com/file/View/
http://faninemae.com/file/god/lnnn/
http://faninemae.com/file/god.zip