MICROSOFT phish running on teamtechnologyperu[.]com

Found: 2018-01-28 15:15:34.019000
URL: http://teamtechnologyperu.com/wp-includes/xhp.zip
File: teamtechnologyperu.com-wp-includes-xhp.zip
Domain: teamtechnologyperu.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                xhp/officiar/adhoc/cofiguare/incorrect.php         44546 2018-01-09 10:16:28  fde877fcb52b992434582bf9f5a66021
xhp/officiar/adhoc/cofiguare/index.php             40412 2017-06-22 11:36:38  d21cc0a5685176db2bc8939623e3603c
xhp/officiar/adhoc/cofiguare/secondpageloader.gif   5601 2017-06-22 10:10:32  f94d045802343974442538d9fc35f37d
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/aad.js 167628 2016-09-06 17:09:40  c50aabf94f3a014af12c196b4f5538cb
    File appears in 8 kits  and under 2 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/bannerlogo.png  4585 2016-09-06 17:09:40  9f09a27d4f69b3557c7433574a29d726
    File appears in 81 kits  and under 4 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/heroillustration.jpg 203294 2016-09-06 17:09:40  65283b123eb235e6176ae98c02ac5b1c
    File appears in 154 kits  and under 4 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/jquery.js 109078 2016-09-06 17:09:40  f274d523a09ce908f4bd2bd2fdb0e7cb
    File appears in 20 kits  and under 3 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/login.css 21664 2016-09-06 17:09:40  aa60dd57b752f9c4ba945e4f8718552a
    File appears in 9 kits  and under 2 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/login_hover.css    89 2016-09-06 17:09:40  2c957834356b9ca6570167adec33573f
    File appears in 32 kits  and under 2 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/microsoft_logo.png  1040 2016-09-06 17:09:40  e4b675007dc6492ee590131d1f7dfbb3
    File appears in 50 kits  and under 2 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch.htm  3325 2016-09-06 17:09:40  3db3f558c29763df615a1ede472992a4
    File appears in 5 kits
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch_data/boot.css 182391 2016-09-06 17:09:40  b139499248bd2fb2a99ff1436dd0ecd1
    File appears in 5 kits
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch_data/boot.js 624440 2016-09-06 17:09:40  8974e7be8f47f5fc026557ada72297dd
    File appears in 5 kits
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch_data/boot_002.js 624182 2016-09-06 17:09:40  294fec24d190c065cb9cf17e2e926ff5
    File appears in 5 kits
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch_data/boot_003.js 622132 2016-09-06 17:09:40  ac535e9d7352cabb642e7cb5c180a822
    File appears in 5 kits
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch_data/boot_004.js 623111 2016-09-06 17:09:40  abf6b0ab0dc9ac32471c461beaa472ed
    File appears in 5 kits
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch_data/sprite1.css  7584 2016-09-06 17:09:40  0346d135171f20a65334f60ab90ae884
    File appears in 29 kits  and under 3 different file names
xhp/officiar/adhoc/cofiguare/Sign in to your account_files/prefetch_data/sprite1.png 16967 2016-09-06 17:09:40  934d28f5d1967abbde9663d01344bf24
    File appears in 29 kits  and under 3 different file names
xhp/officiar/adhoc/cofiguare/successful.php         4703 2018-01-09 10:17:24  4c63544caa0c3f3e08a1ef9f150ec396

6 Email addresses found:
    textofficeplus@gmail.com
    someone@contoso.com (appears in 10 kits)
    someone@contoso.onmicrosoft.com (appears in 10 kits)
    someone@example.com (appears in 68 kits)
    someone@example.onmicrosoft.com (appears in 15 kits)
    'someone@example.com (appears in 10 kits)



https://texasmalwareblog.blogspot.com   @phish_total