Ameli.FR phish running on ameli-fr[.]com

Found: 2018-04-24 15:22:04.471000
URL: http://www.ameli-fr.com/softaculous/PortailAS.zip
File: www.ameli-fr.com-softaculous-PortailAS.zip
Domain: ameli-fr.com
Target: Ameli.FR
Name                                               Size Date                 MD5                                PortailAS/appmanager/ameliassurane/assure_somtc=true/index.php   534 2015-06-16 00:21:00  dfd0be4b5ce7d9ffebe0aa78477ccbc3
    File appears in 32 kits
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/.htaccess 114361 2015-07-16 21:53:00  a5d2a7df065881a8aa53685ea3fac5e9
    File appears in 49 kits  and under 2 different file names
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/antibots.php  2733 2015-07-16 21:53:00  5f3b15fbb02e002ee17aa5e71cf0b937
    File appears in 26 kits  and under 5 different file names
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/final.php 19207 2018-04-23 15:13:08  fe5bcd4745b946fe9b29c8093a5c5ce7
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/index.php 33822 2018-04-23 15:13:50  6a7c06029e709ff5b2f150f20cd20949
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/loading.php 19095 2018-04-23 15:14:40  c59ae5b4923a4b926041a574ac7612d8
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/loading2.php 19072 2018-04-23 15:15:00  a8ac84fc78986c5caa66ba90f74492cc
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/sms.php 20714 2018-04-23 15:15:36  c8f24c05ad685e9ac04e7de39f75f53a
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/sms2.php 20889 2018-04-23 15:16:04  be39c5701777410b2b02e51cf59fce9e
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/snd.php  1079 2018-04-23 15:08:48  44fed347bac2f5192fe391e54e5116b2
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/snd2.php   593 2018-04-23 15:09:00  9e32a35bf2f2875345be4de7182e76fe
PortailAS/appmanager/ameliassurane/assure_somtc=true/po/snd3.php   590 2018-04-23 15:09:10  013ad0d653e154b54b195a1cd1ceb6a0

1 Email addresses found:
    matriochkkaa@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total