T-Mobile phish ** running on alfazemadecor[.]com[.]br

Found: 2018-04-07 01:16:43.996000
URL: http://alfazemadecor.com.br/wp-admin/telekom.zip
File: alfazemadecor.com.br-wp-admin-telekom.zip
Domain: alfazemadecor.com.br
Target: T-Mobile
Name                                               Size Date                 MD5                                telekom/saxrix/co.intex/auth12a1.html               8488 2017-03-31 06:57:46  c1efb6d0b3d54526ad982d216f84788c
telekom/saxrix/co.intex/post.php                     976 2018-04-06 22:14:44  4207a6933f10dd8c35bff8491f19d14f
telekom/saxrix/static/factorx/vdplus/css/login.css  6290 2016-12-14 09:30:00  b702358c9447cef3679936e57e10b567
telekom/saxrix/static/factorx/vdplus/images/load.gif  3789 2016-12-14 09:30:00  38e8aeeb5e6a8ccb957960d4697a2b7b
telekom/saxrix/static/factorx/vdplus/js/login.js    6892 2016-12-14 09:30:00  691a91fd9b8d764aef7cd94a4649594a
telekom/saxrix/static/vdplus/css/components.min.css 89759 2015-11-18 13:49:40  80265498463345a73c98700d6f5c86e1
telekom/saxrix/static/vdplus/js/components.min.js  67839 2015-10-28 10:54:14  efb6c6b1ec8ecf9d048753ff30423bee
telekom/saxrix/static/vdplus/js/jquery-1.11.3.min.js 95957 2015-10-28 10:37:38  895323ed2f7258af4fae2c738c8aea49
    File appears in 5 kits  and under 2 different file names

2 Email addresses found:
    kelvin@tf-info.com
    'sandramaxy57@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total