07/17/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1284205416105353217

#ZLoader #malspam for today with .xls attachments.

Downloader URLs:
https://6730dartmouth.com/wp-keys.php
https://akcje.browarbrodacz.pl/wp-keys.php
http://myadvision.com/wp-keys.php
https://scoutadvisors.com/wp-keys.php

C2s:
http://myadvision.com/wp-parsing.php
https://6730dartmouth.com/wp-parsing.php
https://akcje.browarbrodacz.pl/wp-parsing.php
https://winfectsolutions.com/wp-parsing.php
https://wadapptanara.tk/wp-parsing.php
https://fortsanmanesilink.ga/wp-parsing.php

XLS sample:
https://app.any.run/tasks/5f826b3c-11b7-4fd9-8193-ce9eacf7cc81#

DLL sample:
https://app.any.run/tasks/8b72d71a-0d33-4b77-8f6b-f7e9dcad0403