MICROSOFT phish running on myprivatemail[.]org

Found: 2017-12-28 22:12:43
URL: http://myprivatemail.org/office101.zip
File: office101-myprivatemail.org.zip
Domain: myprivatemail.org
Target: MICROSOFT
Name                                               Size Date                 MD5                                officeee/incorrect.php                             45321 2017-07-10 08:07:22  228250aff4eb46da19c7565ea9cb903c
officeee/index.php                                 41021 2017-02-07 13:53:40  aa17444b491440f532184f210b336e5d
officeee/not.htm                                   41779 2016-09-06 16:09:40  7c4b1426615f01a4039885fa1685e959
    File appears in 3 kits
officeee/Sign in to your account_files/aad.js      167628 2016-09-06 16:09:40  c50aabf94f3a014af12c196b4f5538cb
    File appears in 5 kits  and under 2 different file names
officeee/Sign in to your account_files/bannerlogo.png  4585 2016-09-06 16:09:40  9f09a27d4f69b3557c7433574a29d726
    File appears in 67 kits  and under 4 different file names
officeee/Sign in to your account_files/heroillustration.jpg 203294 2016-09-06 16:09:40  65283b123eb235e6176ae98c02ac5b1c
    File appears in 137 kits  and under 4 different file names
officeee/Sign in to your account_files/jquery.js   109078 2016-09-06 16:09:40  f274d523a09ce908f4bd2bd2fdb0e7cb
    File appears in 15 kits  and under 3 different file names
officeee/Sign in to your account_files/login.css   21664 2016-09-06 16:09:40  aa60dd57b752f9c4ba945e4f8718552a
    File appears in 6 kits  and under 2 different file names
officeee/Sign in to your account_files/login_hover.css    89 2016-09-06 16:09:40  2c957834356b9ca6570167adec33573f
    File appears in 25 kits  and under 2 different file names
officeee/Sign in to your account_files/microsoft_logo.png  1040 2016-09-06 16:09:40  e4b675007dc6492ee590131d1f7dfbb3
    File appears in 40 kits  and under 2 different file names
officeee/Sign in to your account_files/prefetch.htm  3325 2016-09-06 16:09:40  3db3f558c29763df615a1ede472992a4
    File appears in 3 kits
officeee/Sign in to your account_files/prefetch_data/boot.css 182391 2016-09-06 16:09:40  b139499248bd2fb2a99ff1436dd0ecd1
    File appears in 3 kits
officeee/Sign in to your account_files/prefetch_data/boot.js 624440 2016-09-06 16:09:40  8974e7be8f47f5fc026557ada72297dd
    File appears in 3 kits
officeee/Sign in to your account_files/prefetch_data/boot_002.js 624182 2016-09-06 16:09:40  294fec24d190c065cb9cf17e2e926ff5
    File appears in 3 kits
officeee/Sign in to your account_files/prefetch_data/boot_003.js 622132 2016-09-06 16:09:40  ac535e9d7352cabb642e7cb5c180a822
    File appears in 3 kits
officeee/Sign in to your account_files/prefetch_data/boot_004.js 623111 2016-09-06 16:09:40  abf6b0ab0dc9ac32471c461beaa472ed
    File appears in 3 kits
officeee/Sign in to your account_files/prefetch_data/sprite1.css  7584 2016-09-06 16:09:40  0346d135171f20a65334f60ab90ae884
    File appears in 26 kits  and under 3 different file names
officeee/Sign in to your account_files/prefetch_data/sprite1.png 16967 2016-09-06 16:09:40  934d28f5d1967abbde9663d01344bf24
    File appears in 26 kits  and under 3 different file names
officeee/successful.php                             4791 2017-07-10 08:07:42  da27f315456d5f40699ac263d7e0b3ba

6 Email addresses found:
    andrewparker45@yandex.com
    someone@contoso.com (appears in 8 kits)
    someone@contoso.onmicrosoft.com (appears in 8 kits)
    someone@example.com (appears in 61 kits)
    someone@example.onmicrosoft.com (appears in 11 kits)
    'someone@example.com (appears in 8 kits)



https://texasmalwareblog.blogspot.com   @phish_total