07/02/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1278721716106207233

#ZLoader #malspam with .xls attachment for today.

#ZLoader downloader URLs:
https://Celadon-Emerald.mockienan.com/wp-keys.php
https://macx.work/wp-keys.php
https://maifoxfiraverpclean.gq/wp-keys.php
https://smartdev.infinitytechsol.com/wp-keys.php

#ZLoader C2s:
https://tedxminna.com/wp-parsing.php
https://roeslidegeralic.gq/wp-parsing.php
https://marufait.com/wp-parsing.php
https://blackandprecious.com/wp-parsing.php
https://resources.digilentinc.com/wp-parsing.php
https://phywebtmoonsthevil.gq/wp-parsing.php
https://ews.asia/wp-parsing.php
https://ews1.icu/wp-parsing.php

XLS sample:
https://app.any.run/tasks/549c8728-1300-403e-9ad4-fce3c40c383e/

DLL sample uploaded by @JAMESWT_MHT:
https://bazaar.abuse.ch/sample/3dd800b875aa0ef2fa0923babdd4b162555a1c3ff3c58e9291d45fff82389816