MICROSOFT phish ** running on starequityfunding[.]com

Found: 2018-04-04 04:15:39.363000
URL: http://starequityfunding.com/bond/PAGE.zip
File: starequityfunding.com-bond-PAGE.zip
Domain: starequityfunding.com
Target: MICROSOFT
Name                                               Size Date                 MD5                                PAGE/PAGE/images/down.png                            577 2018-03-21 13:45:36  4364164f00b08f77f2a01580df230f5b
PAGE/PAGE/images/e1.png                            36083 2018-03-21 13:45:36  fa6a9bd167a21b1f92b89af1c7a8a2c8
PAGE/PAGE/images/e2.png                            80891 2018-03-21 13:45:36  cc954ccb408e1b3ac3de8a36f613e436
PAGE/PAGE/images/e3.png                            116602 2018-03-21 13:45:36  9b45dd3b7aa889b3c7d2f90be44e7c00
PAGE/PAGE/images/e4.png                            17929 2018-03-21 13:45:36  08d1f8bb960bf4634831a9ae476c497d
PAGE/PAGE/images/e5.png                            79744 2018-03-21 13:45:36  791d64539e5dff061439105f3dc89409
PAGE/PAGE/images/favicon.ico                        3432 2018-03-21 13:45:36  75099623c84266df9d4613b6caa88969

PAGE/PAGE/images/Section.jpg                       326631 2018-03-21 13:45:36  2eb408a8ffe1d2f697e7c9e78ff1534d
PAGE/PAGE/index.php                                  144 2018-03-21 13:45:34  0526c242a1f7b6117202fe21d47e31b1
    File appears in 167 kits  and under 4 different file names
PAGE/PAGE/login.php                                 3400 2018-03-21 13:45:36  3b902da357e97b2c8197aeb74845f66d
PAGE/PAGE/post1.php                                 1398 2018-03-21 13:45:36  b09b3625af701d2de81dab0de5dda8ec
PAGE/PAGE/post2.php                                 1431 2018-03-21 13:46:02  ffa295970f2898780df58b4ad331e482
PAGE/PAGE/step2.php                                 6521 2018-03-21 13:45:36  c04eb185f3485873b39ff36e05379367

2 Email addresses found:
    j.gregory.canberrarexhotel.com@gmail.com
    supertool@mxtoolbox.com (appears in 60 kits)



https://texasmalwareblog.blogspot.com   @phish_total