XtraMailer spam service phishing tool

 https://twitter.com/neonprimetime/status/1589084560675201024?s=46&t=CMAHRgmBZRQ-vkxgYQ9Znw

#XtraMailer spam service for credential #phishing 

urlscan.io/result/9274723…

mailer login: 62.210.81[.]212/XtraMailerLogin

stolen creds posted to: 62.210.81[.].212/next.php

https://twitter.com/prodaft/status/1286580568801640448?s=46&t=CMAHRgmBZRQ-vkxgYQ9Znw

were here in the past

hxxp://conferencias.falcorp[.]net

hxxp://195.154.164[.]184

hxxp://195.154.164[.]25

htxxp://62.210.72[.]29

tool error message that shows some internal information

urlscan.io/dom/8f93bd4e-7…

/var/www/xtramailer/vendor/laravel/framework/src/Illuminate/Routing/

RouteCollection.php

Router.php

Pipeline.php

Foundation/Http/Kernel.php

/fideloper/proxy/src/TrustProxies.php

/Middleware/TransformsRequest

/CheckForMaintenanceMode.php

/var/www/xtramailer/public/index.php

some related variables to #XtraMailer spam service #phishing tool

FACEBOOK_CALLBACK_URL

FACEBOOK_CLIENT_ID

FACEBOOK_CLIENT_SECRET

FCGI_ROLE

GOOGLE_APPLICATION_CREDENTIALS

MAIL_PASSWORD

MAIL_USERNAME

PUSHER_APP_ID

PUSHER_APP_KEY

PUSHER_APP_SECRET

RMQ_PASSWORD

RMQ_USER

Mega Super Autouploader - msau

Related Social Media Posts

 @500mk500

https://twitter.com/500mk500/status/1586505814839558145?s=20&t=e_pnOL_iyOz5x_fGUE5RpQ

Mega Super Autouploader

https://github.com/stamparm/maltrail/commit/7fca81e41937db476b1ddec47a7f01d1152355d6

Login pages found

http://analiticslist[.]com/msau/

http://solien[.]cc/msau/

Related Domains

alternative[.]am amazon-aws-cloud[.]com analiticslist[.]com app[.]sell-dar[.]com blackbirdpedalboards[.]com bwd86[.]com bwd87[.]com ciaraodoherty[.]com course[.]internationalglobalnetwork[.]com elevatearchitecture[.]com epicgeocaching[.]com go2namibia[.]com hellodolly[.]pw irishfireside[.]com megauploader[.]xyz mesonges[.]fr mrmikesgraphics[.]com nederland-server32[.]email nigerianstalk[.]org oficina[.]motonic[.]com[.]br portfolio[.]whitneybennettblog[.]com smokeyrow[.]com solien[.]cc studiomanufacturing[.]com[.]br thermalwise[.]ca tribuna[.]ee unsinkableplunkett[.]com www[.]agshacks[.]com www[.]cccmarketing[.]vegas www[.]cindyhayen[.]com www[.]datatech911[.]com www[.]kellyurbanphotography[.]com www[.]lottiedababy[.]com www[.]luxuryworldinteriors[.]in www[.]sarahbrownphotography[.]com[.]au www[.]thebiggestworld[.]com www[.]treetopscommunications[.]co[.]uk

Root folder names

www/megauploader.xyz/

www/msau/

www/msau_jml/

www/msau2612/

Files in the Kit

work.php

Core/MainSettings.php

DrwContent/ProcessingMacroses.php

DrwContent/ProcessResTemplate.php

DrwContent/Prs.php

DrwContent/GetContent.php

Sample errors found:

Deprecated: Implicit conversion from float 522588.00000000006 to int loses precision in /var/www/html/msau/Core/MainSettings.php on line 357

Deprecated: Implicit conversion from float 252717.00000000003 to int loses precision in /var/www/html/msau/DrwContent/Prs.php on line 90

Warning: preg_replace(): Unknown modifier '\' in /var/www/www-root/data/www/megauploader.xyz/DrwContent/ProcessResTemplate.php on line 83

Warning: preg_replace(): Unknown modifier '\' in /var/www/www-root/data/www/megauploader.xyz/DrwContent/ProcessResTemplate.php on line 83

Warning: shuffle() expects parameter 1 to be array, string given in /var/www/www-root/data/www/megauploader.xyz/Core/MainSettings.php on line 358

Warning: implode(): Invalid arguments passed in /var/www/www-root/data/www/megauploader.xyz/DrwContent/ProcessingMacroses.php on line 122

Warning: shuffle() expects parameter 1 to be array, string given in /var/www/www-root/data/www/megauploader.xyz/Core/MainSettings.php on line 358

Warning: implode(): Invalid arguments passed in /var/www/www-root/data/www/megauploader.xyz/DrwContent/ProcessingMacroses.php on line 139

Fatal error: Uncaught TypeError: preg_replace_callback(): Argument #2 ($callback) must be a valid callback, function "strip_tags_smart" not found or invalid function name in /var/www/html/msau/Core/MainSettings.php:590 Stack trace: #0 /var/www/html/msau/Core/MainSettings.php(590): preg_replace_callback('~ <[/!]?+\n ...', 'strip_tags_smar...', '510 E 84th Stre...') #1 /var/www/html/msau/DrwContent/Prs.php(168): MainSettings->strip_tags_smart('510 E 84th Stre...') #2 /var/www/html/msau/DrwContent/GetContent.php(26): Prs->getSnippets('education+princ...', 7) #3 /var/www/html/msau/work.php(248): GetContent->__construct(Object(MainSettings), 'education princ...', '1f13728d2ef56b6...', Object(Prs)) #4 {main} thrown in /var/www/html/msau/Core/MainSettings.php on line 590

Deprecated: Implicit conversion from float 519715.00000000006 to int loses precision in /var/www/html/msau_jml/Core/MainSettings.php on line 358

Fatal error: Uncaught TypeError: shuffle(): Argument #1 ($array) must be of type array, string given in /var/www/html/msau_jml/Core/MainSettings.php:359 Stack trace: #0 /var/www/html/msau_jml/Core/MainSettings.php(359): shuffle('Ivermectin wher...') #1 /var/www/html/msau_jml/DrwContent/ProcessingMacroses.php(121): MainSettings->shuffleArr('Ivermectin wher...') #2 /var/www/html/msau_jml/DrwContent/ProcessingMacroses.php(31): ProcessingMacroses->UPMIXKEY() #3 /var/www/html/msau_jml/work.php(258): ProcessingMacroses->goWork() #4 {main} thrown in /var/www/html/msau_jml/Core/MainSettings.php on line 359

Notes:

Seems related to Wordpress sites

Seems like redirect spam to porn, pharma, seo spam, etc.