PAYPAL phish running on villa[.]of[.]by

Found: 2018-03-19 14:24:00.027000
URL: http://www.villa.of.by/Pay.zip
File: www.villa.of.by-foo-Pay.zip
Domain: villa.of.by
Target: PAYPAL
Name                                               Size Date                 MD5                                Pay/account/.htaccess                              11488 2014-03-25 10:30:24  9240ac2ab2977afbacf4a0284aecf082
    File appears in 49 kits
Pay/account/a.png                                   9032 2018-03-14 19:04:10  4a8d23b3b58efe800970255dc168da5e
    File appears in 2 kits
Pay/account/EPN.php                                  426 2018-03-14 20:28:22  0ffe1c250ca204b4aefca2e4373b1ebc
    File appears in 2 kits
Pay/account/finish.php                              1074 2018-03-15 13:34:16  f3e9c7337951184ae70d18bb31f38598
    File appears in 2 kits
Pay/account/htaccess                               35221 2014-03-25 10:30:24  cdaecc08ad15d69f4a2102ea081df047
    File appears in 70 kits
Pay/account/index.php                               1782 2018-03-14 20:29:30  703033f6badeb6a87adbae2c5e1cd1b1
    File appears in 2 kits
Pay/account/Na-Na.php                               3812 2015-08-27 00:14:22  8fbfcaa591d5fbd9c0e548f2d71c9f02
    File appears in 27 kits  and under 4 different file names
Pay/account/s.png                                   1002 2018-03-14 18:03:10  69e09348362742957199cd2793f794d3
    File appears in 2 kits
Pay/account/style.css                                634 2014-12-27 08:01:36  6d28cdf9309a3510588c5ef58228d74c
    File appears in 24 kits
Pay/index.php                                        672 2018-03-14 20:02:30  c4184efc4f5839de5e0a25dbed74e143
    File appears in 2 kits
Pay/Na-Na.php                                       3812 2015-11-26 03:51:40  8fbfcaa591d5fbd9c0e548f2d71c9f02
    File appears in 27 kits  and under 4 different file names

1 Email addresses found:
    646434o9@gmail.com (appears in 2 kits)



https://texasmalwareblog.blogspot.com   @phish_total