07/09/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1281360946649235456

#ZLoader #malspam from today with .xls attachments.

Downloader URLs:
http://merter.shop/wp-keys.php
http://pasca.fapet.ub.ac.id/wp-keys.php
http://pick20shop.shop/wp-keys.php
http://posviat.ru/wp-keys.php

C2s:
http://draminski-retail.eu/wp-parsing.php
http://duanyong.top/wp-parsing.php
http://eternalstarculture.com/wp-parsing.php
http://gh99.cn/wp-parsing.php
https://nalighpicseracha.tk/wp-parsing.php
http://glossy.vn/wp-parsing.php
http://jiangchi.name/wp-parsing.php
https://roeslidegeralic.gq/wp-parsing.php
http://mawi.io/wp-parsing.php

XLS sample:
https://app.any.run/tasks/798ee109-8a8d-4942-8353-929a6a73cbfc#

DLL sample:
https://app.any.run/tasks/db4d0953-d59b-497d-beba-be79c42e2264

Another #ZLoader sample...

Downloader URLs:
http://merter.shop/wp-crunch.php
http://pasca.fapet.ub.ac.id/wp-crunch.php
http://pick20shop.shop/wp-crunch.php
http://posviat.ru/wp-crunch.php

C2s:
http://draminski-retail.eu/wp-parsing.php
http://duanyong.top/wp-parsing.php
http://eternalstarculture.com/wp-parsing.php
http://gh99.cn/wp-parsing.php
https://nalighpicseracha.tk/wp-parsing.php
http://glossy.vn/wp-parsing.php
http://jiangchi.name/wp-parsing.php
https://roeslidegeralic.gq/wp-parsing.php
http://mawi.io/wp-parsing.php

XLS Sample:
https://app.any.run/tasks/e73f2693-68cd-4944-aa3f-0079a8194053#