Webmail phish ** running on afterthefx.com

Found: 2017-11-07 01:18:31.352000
URL: http://afterthefx.com/crypt.zip
File: afterthefx.com-foo-crypt.zip
Domain: afterthefx.com
Target: Webmail
Name                                               Size Date                 MD5                                crypt/go.php                                         265 2017-03-08 03:19:38  0f0c0655dfeaadb9f01b2e331cbbb586
    File appears in 6 kits
crypt/index.php                                    25131 2017-03-08 03:32:56  8c22e8ed5c058c85257cdafefce5ea3b
crypt/loader.gif                                   276027 2017-03-08 03:20:08  3a4e3b4fc1fae5f7929fad357223c184

crypt/loader.php                                    5197 2017-03-08 03:20:20  f785b8a6f6c7b601d96c5896fe994772

crypt/Message.txt                                   1996 2017-03-08 03:33:52  691936361296cb55c6b3d7f9aa68f4dc
crypt/post.php                                      3990 2017-03-08 03:20:30  341c9d269eda4f810a6bb6769fdd2a82

1 Email addresses found:
    'blackhat4477@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total